-
Notifications
You must be signed in to change notification settings - Fork 187
Description
Hello, I have a question about SCMP_FLTATR_API_TSKIP attribute.
SCMP_FLTATR_API_SKIP has been supported from dc87999 in order to address the #80 and the man page explains as follows:
A flag to specify if libseccomp should allow filter rules
to be created for the -1 syscall. The -1 syscall value
can be used by tracer programs to skip specific syscall
invocations, see seccomp(2) for more information.
Defaults to off ( value == 0).
However, I think tracer programs do not use SCMP_FLTATR_API_TSKIP to skip a syscall because the tracer skips a syscall by changing directly the register of syscall number as explained in seccomp(2), not using a seccomp filter.
Excerpt from SECCOMP_RET_TRACE section in seccomp(2):
The tracer can skip the system call by changing the system
call number to -1. Alternatively, the tracer can change
the system call requested by changing the system call to a
valid system call number. If the tracer asks to skip the
system call, then the system call will appear to return
the value that the tracer puts in the return value register.
Actually, the kernel will skip a syscall if the syscall number is set to -1 by a ptracer at the following point.
https://elixir.bootlin.com/linux/v5.16/source/kernel/seccomp.c#L1229
The ptracer can set the syscall value of -1 without SCMP_FLTATR_API_TSKIP because it just changes the register.
Hence, it does not seem to make sense to create a filter rule using a syscall value of -1. I'm sorry if I'm wrong, but I'm not sure why SCMP_FLTATR API_TSKIP was added.
Would you mind if I asked the use case of SCMP_FLTATR_API_TSKIP?