Re: [patch 11/18] seccomp, treewide: Rename and convert __secure_computing() to return boolean
Kees Cook <[email protected]>
| Newsgroups | dev.linux.lists.loongarch,org.infradead.lists.linux-riscv,org.infradead.lists.linux-snps-arc,org.infradead.lists.linux-um,org.kernel.vger.linux-alpha,org.kernel.vger.linux-arch,org.kernel.vger.linux-csky,org.kernel.vger.linux-doc,org.kernel.vger.linux-hexagon,org.kernel.vger.linux-kernel,org.kernel.vger.linux-m68k,org.kernel.vger.linux-mips,org.kernel.vger.linux-openrisc,org.kernel.vger.linux-parisc,org.kernel.vger.linux-s390,org.kernel.vger.linux-sh,org.kernel.vger.sparclinux,org.ozlabs.lists.linuxppc-dev |
|---|---|
| Message-ID | <202607090921.ABE4BB4A@keescook> |
On Tue, Jul 07, 2026 at 09:06:40PM +0200, Thomas Gleixner wrote: > From: Jinjie Ruan <[email protected]> > > The return value of __secure_computing() currently uses 0 to indicate > that a system call should be allowed, and -1 to indicate that it should > be blocked/killed. This 0/-1 pattern is non-intuitive for a security > check function and makes the control flow at the call sites less readable. Conceptually, I'm good with this. Just make sure that the tools/testing/selftests/seccomp/seccomp_bpf tests still passes. :) -- Kees Cook