Re: [Qemu-devel] [RFC] [PATCHv2 2/2] Adding basic calls to libseccomp in vl.c

[Corey Bryant]

On 07/01/2012 10:18 PM, Will Drewry wrote:
> On Sun, Jul 1, 2012 at 8:25 AM, Paolo Bonzini <address@hidden> wrote:
> > Il 18/06/2012 23:53, Corey Bryant ha scritto:
> > > > Can each thread have separate seccomp whitelists? For example CPU
> > > > threads should not need pretty much anything but the I/O thread needs
> > > > I/O.
> > >
> > > No, seccomp filters are defined and enforced at the process level.
> >
> > Perhaps we can add (at the kernel level) a way for seccomp filters to
> > examine the current tid.

Sorry for the confusion.  I corrected my statement in a later thread 
based on Will's input: 
http://lists.nongnu.org/archive/html/qemu-devel/2012-06/msg03212.html

> seccomp filters are attached to the task_struct and apply per "thread"
> or per process since they both get their own task_structs.  (For
> Linux, process==thread with shared resources.)  Filter programs are
> also inherited across clone/fork, so it's possible to install a
> "global" filter program which applies which is inherited during thread
> creation, then apply per-thread refinements by stacking on additional
> filters (at the cost of additional evaluation time).
>
> hth!
> will

Thanks!

--
Regards,
Corey