[v3,0/2] seccomp: pass uretprobe system call through seccomp

Message

Eyal Birger Feb. 2, 2025, 4:29 p.m. UTC

uretprobe(2) is an performance enhancement system call added to improve
uretprobes on x86_64.

Confinement environments such as Docker are not aware of this new system
call and kill confined processes when uretprobes are attached to them.

Since uretprobe is a "kernel implementation detail" system call which is
not used by userspace application code directly, pass this system call
through seccomp without forcing existing userspace confinement environments
to be changed.

To: Kees Cook <[e-mail]>
To: Andy Lutomirski <[e-mail]>
To: Will Drewry <[e-mail]>
To: Oleg Nesterov <[e-mail]>
To: Masami Hiramatsu (Google) <[e-mail]>
To: Jiri Olsa <[e-mail]>
To: Andrii Nakryiko <[e-mail]>
Cc: [e-mail]
Signed-off-by: Eyal Birger <[e-mail]>

Eyal Birger (2):
  seccomp: passthrough uretprobe systemcall without filtering
  selftests/seccomp: validate uretprobe syscall passes through seccomp

 kernel/seccomp.c                              |  24 ++-
 tools/testing/selftests/seccomp/seccomp_bpf.c | 195 ++++++++++++++++++
 2 files changed, 216 insertions(+), 3 deletions(-)