A common question asked when debugging seccomp filters is "how many filters are attached to your process?" Provide a way to easily answer this question through /proc/$pid/status with a "Seccomp_filters" line.
Showing the changes to kernel (1 of 4 files). Show all
Unified · Split
| @@ -398,6 +398,8 @@ static inline void seccomp_sync_threads(unsigned long flags) · 397 unmodified lines | |||
| 398 | put_seccomp_filter(thread); | 398 | put_seccomp_filter(thread); |
| 399 | smp_store_release(&thread->seccomp.filter, | 399 | smp_store_release(&thread->seccomp.filter, |
| 400 | caller->seccomp.filter); | 400 | caller->seccomp.filter); |
| 401 | atomic_set(&thread->seccomp.filter_count, | ||
| 402 | atomic_read(&thread->seccomp.filter_count)); | ||
| 401 | 403 | ||
| 402 | /* | 404 | /* |
| 403 | * Don't let an unprivileged task work around | 405 | * Don't let an unprivileged task work around |
| @@ -544,6 +546,7 @@ static long seccomp_attach_filter(unsigned int flags, · 140 unmodified lines | |||
| 544 | */ | 546 | */ |
| 545 | filter->prev = current->seccomp.filter; | 547 | filter->prev = current->seccomp.filter; |
| 546 | current->seccomp.filter = filter; | 548 | current->seccomp.filter = filter; |
| 549 | atomic_inc(¤t->seccomp.filter_count); | ||
| 547 | 550 | ||
| 548 | /* Now that the new filter is in place, synchronize to all threads. */ | 551 | /* Now that the new filter is in place, synchronize to all threads. */ |
| 549 | if (flags & SECCOMP_FILTER_FLAG_TSYNC) | 552 | if (flags & SECCOMP_FILTER_FLAG_TSYNC) |