diff options
| author | Fabricio Voznika <fvoznika@google.com> | 2018-11-20 22:55:41 -0800 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-11-20 22:56:51 -0800 |
| commit | eaac94d91c28b745c51c33dd352ed9bfdd671b8c (patch) | |
| tree | e552c91970be74c3a315bb6aa5eea157cb153890 /runsc | |
| parent | 5236b78242677612ac71b19cee85b3bf4cca4008 (diff) | |
Use RET_KILL_PROCESS if available in kernel
RET_KILL_THREAD doesn't work well for Go because it will
kill only the offending thread and leave the process hanging.
RET_TRAP can be masked out and it's not guaranteed to kill
the process. RET_KILL_PROCESS is available since 4.14.
For older kernel, continue to use RET_TRAP as this is the
best option (likely to kill process, easy to debug).
PiperOrigin-RevId: 222357867
Change-Id: Icc1d7d731274b16c2125b7a1ba4f7883fbdb2cbd
Diffstat (limited to 'runsc')
| -rw-r--r-- | runsc/boot/filter/filter.go | 3 | ||||
| -rw-r--r-- | runsc/fsgofer/filter/filter.go | 3 |
2 files changed, 2 insertions, 4 deletions
diff --git a/runsc/boot/filter/filter.go b/runsc/boot/filter/filter.go index dc7294b1d..d69a6a2cc 100644 --- a/runsc/boot/filter/filter.go +++ b/runsc/boot/filter/filter.go @@ -57,8 +57,7 @@ func Install(opt Options) error { return fmt.Errorf("unknown platform type %T", p) } - // TODO: Set kill=true when SECCOMP_RET_KILL_PROCESS is supported. - return seccomp.Install(s, false) + return seccomp.Install(s) } // Report writes a warning message to the log. diff --git a/runsc/fsgofer/filter/filter.go b/runsc/fsgofer/filter/filter.go index f50b6bc87..c120d57a6 100644 --- a/runsc/fsgofer/filter/filter.go +++ b/runsc/fsgofer/filter/filter.go @@ -29,6 +29,5 @@ func Install() error { // when not enabled. s.Merge(instrumentationFilters()) - // TODO: Set kill=true when SECCOMP_RET_KILL_PROCESS is supported. - return seccomp.Install(s, false) + return seccomp.Install(s) } |