Re: [PATCH v8 3/8] seccomp: add system call filtering using BPF

[Will Drewry]

On Thu, Feb 16, 2012 at 10:32 PM, H. Peter Anvin <hpa@xxxxxxxxx> wrote:
> On 02/16/2012 08:26 PM, Will Drewry wrote:
>>>
>>> For x32 you have the option of introducing a new value or relying on bit
>>> 30 in eax (and AUDIT_ARCH_X86_64).  The latter is more natural, probably.
>>
>> Will that bit be visible as the syscall number or will it be stripped
>> out before passing the number around?  If it's visible, then it
>> doesn't seem like there'd need to be a new AUDIT_ARCH, but I suspect
>> someone like Eric will have an actually useful opinion.
>>
>
> Bit 30 is visible in orig_eax; whether you export it as part of "the
> syscall number" is presumably TBD, but I think it's more natural to do so.

That's what I meant - thanks!
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/