Re: [less-CONFIG_NET v2 7/8] seccomp: drop CONFIG_NET

[Kees Cook <keescook@chromium.org>]

On Thu, Jun 28, 2018 at 5:45 AM, Norbert Manthey <nmanthey@amazon.de> wrote:
> With the goal of dropping CONFIG_NET, we have to drop the dependency
> in the configuration management. Since SECCOMP_FILTER also requires
> BPF functionality, which is usually activated by CONFIG_NET, imply
> BPF from SECCOMP_FILTER directly.

Nit: "select" not "imply"

> In case both CONFIG_NET and CONFIG_SECCOMP_FILTER are activated, BPF
> will be activated as well, so this additional dependency does not
> destroy original builds.
>
> Signed-off-by: Norbert Manthey <nmanthey@amazon.de>

Otherwise, sure. As long as this still compiles and runs, it looks
fine to me! :)

-Kees

> ---
>  arch/Kconfig | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index 1aa5906..8cfb634 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -397,7 +397,8 @@ config HAVE_ARCH_SECCOMP_FILTER
>
>  config SECCOMP_FILTER
>         def_bool y
> -       depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
> +       depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP
> +       select BPF
>         help
>           Enable tasks to build secure computing environments defined
>           in terms of Berkeley Packet Filter programs which implement
> --
> 2.7.4
>
> Amazon Development Center Germany GmbH
> Berlin - Dresden - Aachen
> main office: Krausenstr. 38, 10117 Berlin
> Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
> Ust-ID: DE289237879
> Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
>



-- 
Kees Cook
Pixel Security