Skip to contentSkip to conversation

proc: add "Seccomp" to status

PATCH Superseded Kees Cook 3 participants 3 messages Oct 31, 2012 – Nov 1, 2012 Proc filesystem

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Kees Cook

author
#0 lore raw

PATCH 1/1 proc: add "Seccomp" to status

Adds the seccomp mode to the /proc/$pid/status file so the state of seccomp can be externally examined.

Signed-off-by Kees Cook <[email protected]>
---
 fs/proc/array.c |    8 ++++++++
 1 file changed, 8 insertions(+)
fs/proc/array.c +8 -0
index c1c207c..135d6ac 100644
@@ -327,6 +327,13 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p)
 	render_cap_t(m, "CapBnd:\t", &cap_bset);
 }
 
+static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
+{
+#ifdef CONFIG_SECCOMP
+	seq_printf(m, "Seccomp:\t%d\n", p->seccomp.mode);
+#endif
+}
+
 static inline void task_context_switch_counts(struct seq_file *m,
 						struct task_struct *p)
 {

@@ -360,6 +367,7 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
 	}
 	task_sig(m, task);
 	task_cap(m, task);
+	task_seccomp(m, task);
 	task_cpus_allowed(m, task);
 	cpuset_task_status_allowed(m, task);
 	task_context_switch_counts(m, task);
Signature · 6 lines
1.7.9.5


-- 
Kees Cook
Chrome OS Security
#2 lore raw
In reply to Kees Cook
Quoted 2 lines · On Wed, 31 Oct 2012 13:09:27 -0700 Kees Cook <[email protected]> wrote:

Adds the seccomp mode to the /proc/$pid/status file so the state of seccomp can be externally examined.

There's no reason here for anyone to apply this patch to anything. Presumably you see some value to our users - please share your thoughts with us ;)

fs/proc/array.c static inline void task_cap(struct seq_file *m, struct task_struct *p) · line 332

Quoted 9 lines
fs/proc/array.c +3 -0
@@ -327,6 +327,13 @@ static inline void task_cap(struct seq_file *m, struct task_struct *p)
 	render_cap_t(m, "CapBnd:\t", &cap_bset);
 }
 
+static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
+{
+#ifdef CONFIG_SECCOMP

hm, OK, cpuset_task_status_allowed() is a no-op if CONFIG_CPUSETS=n, so there is precedent for fields vanishing with Kconfig changes.

fs/proc/array.c static inline void task_cap(struct seq_file *m, struct task_struct *p) · line 333

Quoted 1 line
fs/proc/array.c +1 -0
+	seq_printf(m, "Seccomp:\t%d\n", p->seccomp.mode);

Get thee yon unto Documentation/filesystems/proc.txt!

Quoted 2 lines
fs/proc/array.c +2 -0
+#endif
+}