diff options
Diffstat (limited to 'pkg/sentry/kernel/task.go')
| -rw-r--r-- | pkg/sentry/kernel/task.go | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/pkg/sentry/kernel/task.go b/pkg/sentry/kernel/task.go index 7f6735320..e705260da 100644 --- a/pkg/sentry/kernel/task.go +++ b/pkg/sentry/kernel/task.go @@ -355,11 +355,11 @@ type Task struct { parentDeathSignal linux.Signal // syscallFilters is all seccomp-bpf syscall filters applicable to the - // task, in the order in which they were installed. + // task, in the order in which they were installed. The type of the atomic + // is []bpf.Program. Writing needs to be protected by mu. // - // syscallFilters is protected by mu. syscallFilters is owned by the task - // goroutine. - syscallFilters []bpf.Program + // syscallFilters is owned by the task goroutine. + syscallFilters atomic.Value `state:".([]bpf.Program)"` // If cleartid is non-zero, treat it as a pointer to a ThreadID in the // task's virtual address space; when the task exits, set the pointed-to @@ -469,6 +469,17 @@ func (t *Task) loadLogPrefix(prefix string) { t.logPrefix.Store(prefix) } +func (t *Task) saveSyscallFilters() []bpf.Program { + if f := t.syscallFilters.Load(); f != nil { + return f.([]bpf.Program) + } + return nil +} + +func (t *Task) loadSyscallFilters(filters []bpf.Program) { + t.syscallFilters.Store(filters) +} + // afterLoad is invoked by stateify. func (t *Task) afterLoad() { t.interruptChan = make(chan struct{}, 1) |