Re: Compat 32-bit syscall entry from 64-bit task!?

[Linus Torvalds]

On Wed, Jan 18, 2012 at 11:36 AM, Andi Kleen <andi@xxxxxxxxxxxxxx> wrote:
>
> The real fix is really to use a LSM for custom jails.  Trying to make
> ptrace secure is trying to make a sieve wather tight by plugging the individual
> holes one by one. It's simply not suitable for this.

Umm. But the exact same is true of "LSM for custom jail". It's a
f*&^ing disaster, and it's a whole lot more complicated than ptrace.

Plus it can't even do what ptrace does, so what's the point?  There's
a lot of system calls that don't have any kind of lsm hooks, and
shouldn't. Exactly because THAT is a "plugging individual holes one by
one" approach.

                     Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/