Re: [patch 11/18] seccomp, treewide: Rename and convert __secure_computing() to return boolean
Kees Cook <[email protected]> Thu, 9 Jul 2026 09:22:06 -0700
| Newsgroups | gmane.linux.ports.alpha,gmane.linux.kernel,gmane.linux.ports.arm.kernel,gmane.linux.ports.mips,gmane.linux.ports.parisc,gmane.linux.ports.sh.devel,gmane.linux.uml.devel,gmane.linux.ports.ppc64.devel,gmane.linux.ports.riscv,gmane.linux.kernel.arc,gmane.linux.ports.hexagon,gmane.linux.ports.sparc,gmane.linux.kernel.cross-arch,gmane.linux.documentation |
|---|---|
| Message-ID | <202607090921.ABE4BB4A@keescook> |
On Tue, Jul 07, 2026 at 09:06:40PM +0200, Thomas Gleixner wrote: > From: Jinjie Ruan <[email protected]> > > The return value of __secure_computing() currently uses 0 to indicate > that a system call should be allowed, and -1 to indicate that it should > be blocked/killed. This 0/-1 pattern is non-intuitive for a security > check function and makes the control flow at the call sites less readable. Conceptually, I'm good with this. Just make sure that the tools/testing/selftests/seccomp/seccomp_bpf tests still passes. :) -- Kees Cook