summaryrefslogtreecommitdiffhomepage
path: root/runsc/fsgofer
diff options
context:
space:
mode:
authorFabricio Voznika <fvoznika@google.com>2018-11-20 22:55:41 -0800
committerShentubot <shentubot@google.com>2018-11-20 22:56:51 -0800
commiteaac94d91c28b745c51c33dd352ed9bfdd671b8c (patch)
treee552c91970be74c3a315bb6aa5eea157cb153890 /runsc/fsgofer
parent5236b78242677612ac71b19cee85b3bf4cca4008 (diff)
Use RET_KILL_PROCESS if available in kernel
RET_KILL_THREAD doesn't work well for Go because it will kill only the offending thread and leave the process hanging. RET_TRAP can be masked out and it's not guaranteed to kill the process. RET_KILL_PROCESS is available since 4.14. For older kernel, continue to use RET_TRAP as this is the best option (likely to kill process, easy to debug). PiperOrigin-RevId: 222357867 Change-Id: Icc1d7d731274b16c2125b7a1ba4f7883fbdb2cbd
Diffstat (limited to 'runsc/fsgofer')
-rw-r--r--runsc/fsgofer/filter/filter.go3
1 files changed, 1 insertions, 2 deletions
diff --git a/runsc/fsgofer/filter/filter.go b/runsc/fsgofer/filter/filter.go
index f50b6bc87..c120d57a6 100644
--- a/runsc/fsgofer/filter/filter.go
+++ b/runsc/fsgofer/filter/filter.go
@@ -29,6 +29,5 @@ func Install() error {
// when not enabled.
s.Merge(instrumentationFilters())
- // TODO: Set kill=true when SECCOMP_RET_KILL_PROCESS is supported.
- return seccomp.Install(s, false)
+ return seccomp.Install(s)
}