From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:60713)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <wad@chromium.org>) id 1SlWDJ-0000jI-OF
	for qemu-devel@nongnu.org; Sun, 01 Jul 2012 22:18:10 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <wad@chromium.org>) id 1SlWDI-0002wE-2N
	for qemu-devel@nongnu.org; Sun, 01 Jul 2012 22:18:09 -0400
Received: from mail-lb0-f173.google.com ([209.85.217.173]:44221)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <wad@chromium.org>) id 1SlWDH-0002vz-OE
	for qemu-devel@nongnu.org; Sun, 01 Jul 2012 22:18:07 -0400
Received: by lbok6 with SMTP id k6so6267894lbo.4
	for <qemu-devel@nongnu.org>; Sun, 01 Jul 2012 19:18:03 -0700 (PDT)
MIME-Version: 1.0
In-Reply-To: <4FF04FE3.20905@redhat.com>
References: <cover.1339614945.git.otubo@linux.vnet.ibm.com>
	<f2fa29790fb19e6596e1cda0d441e0f45730b533.1339614945.git.otubo@linux.vnet.ibm.com>
	<CAAu8pHviHrjprgpRipE22JpgsSVAWXR_DC0WvCHfB=2z=1S8Ag@mail.gmail.com>
	<20120613203305.GC6019@redhat.com>
	<CAAu8pHuZgMXUPsaLGrk7sbUWi=2BJJc_-xkrL+wQnZvd9XVjZA@mail.gmail.com>
	<20120618083335.GD28026@redhat.com>
	<4FDF479B.9060502@linux.vnet.ibm.com>
	<CAAu8pHsKM4RR7EhrDCC6mCeJMG2b2X15FgBCDZHVjiq04o03rA@mail.gmail.com>
	<4FDFA36E.4010802@linux.vnet.ibm.com> <4FF04FE3.20905@redhat.com>
Date: Sun, 1 Jul 2012 21:18:03 -0500
Message-ID: <CABqD9hYFF6TRohk4ErEaa9WeXZ_GUW3Qf97jKkmwEaxHQD7iwA@mail.gmail.com>
From: Will Drewry <wad@chromium.org>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [Qemu-devel] [RFC] [PATCHv2 2/2] Adding basic calls to
 libseccomp in vl.c
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Blue Swirl <blauwirbel@gmail.com>, Paul Moore <pmoore@redhat.com>, Corey Bryant <coreyb@linux.vnet.ibm.com>, qemu-devel@nongnu.org, Eduardo Otubo <otubo@linux.vnet.ibm.com>

On Sun, Jul 1, 2012 at 8:25 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> Il 18/06/2012 23:53, Corey Bryant ha scritto:
>>>
>>> Can each thread have separate seccomp whitelists? For example CPU
>>> threads should not need pretty much anything but the I/O thread needs
>>> I/O.
>>>
>>
>> No, seccomp filters are defined and enforced at the process level.
>
> Perhaps we can add (at the kernel level) a way for seccomp filters to
> examine the current tid.

seccomp filters are attached to the task_struct and apply per "thread"
or per process since they both get their own task_structs.  (For
Linux, process==thread with shared resources.)  Filter programs are
also inherited across clone/fork, so it's possible to install a
"global" filter program which applies which is inherited during thread
creation, then apply per-thread refinements by stacking on additional
filters (at the cost of additional evaluation time).

hth!
will