diff options
| author | Kees Cook <keescook@chromium.org> | 2017-08-11 21:53:18 +0200 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2017-08-14 22:46:48 +0200 |
| commit | fd76875ca289a3d4722f266fd2d5532a27083903 (patch) | |
| tree | a2bfbf13137e9104f7b262b4f208a51aa8e2a3dc /Documentation | |
| parent | seccomp: Action to log before allowing (diff) | |
| download | linux-fd76875ca289a3d4722f266fd2d5532a27083903.tar.xz linux-fd76875ca289a3d4722f266fd2d5532a27083903.zip | |
seccomp: Rename SECCOMP_RET_KILL to SECCOMP_RET_KILL_THREAD
In preparation for adding SECCOMP_RET_KILL_PROCESS, rename SECCOMP_RET_KILL
to the more accurate SECCOMP_RET_KILL_THREAD.
The existing selftest values are intentionally left as SECCOMP_RET_KILL
just to be sure we're exercising the alias.
Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'Documentation')
| -rw-r--r-- | Documentation/networking/filter.txt | 2 | ||||
| -rw-r--r-- | Documentation/userspace-api/seccomp_filter.rst | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/Documentation/networking/filter.txt b/Documentation/networking/filter.txt index b69b205501de..73aa0f12156d 100644 --- a/Documentation/networking/filter.txt +++ b/Documentation/networking/filter.txt @@ -337,7 +337,7 @@ Examples for low-level BPF: jeq #14, good /* __NR_rt_sigprocmask */ jeq #13, good /* __NR_rt_sigaction */ jeq #35, good /* __NR_nanosleep */ - bad: ret #0 /* SECCOMP_RET_KILL */ + bad: ret #0 /* SECCOMP_RET_KILL_THREAD */ good: ret #0x7fff0000 /* SECCOMP_RET_ALLOW */ The above example code can be placed into a file (here called "foo"), and diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst index f4977357daf2..d76396f2d8ed 100644 --- a/Documentation/userspace-api/seccomp_filter.rst +++ b/Documentation/userspace-api/seccomp_filter.rst @@ -87,11 +87,11 @@ Return values A seccomp filter may return any of the following values. If multiple filters exist, the return value for the evaluation of a given system call will always use the highest precedent value. (For example, -``SECCOMP_RET_KILL`` will always take precedence.) +``SECCOMP_RET_KILL_THREAD`` will always take precedence.) In precedence order, they are: -``SECCOMP_RET_KILL``: +``SECCOMP_RET_KILL_THREAD``: Results in the task exiting immediately without executing the system call. The exit status of the task (``status & 0x7f``) will be ``SIGSYS``, not ``SIGKILL``. |