LDP
/
man-pages
mirror of https://github.com/mkerrisk/man-pages
0
1
Fork 0
Code Releases Activity

seccomp.2: Add description of SECCOMP_RET_KILL_PROCESS 

Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
This commit is contained in:
Michael Kerrisk 2017-11-18 19:58:42 +01:00
parent 5cfa062716
commit 51c58a6c11
1 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
man2/seccomp.2
View File

@ -399,6 +399,36 @@ returned by execution of all of the filters.
In decreasing order of precedence,
the values that may be returned by a seccomp filter are:
.TP
.BR SECCOMP_RET_KILL_PROCESS " (since Linux 4.14)"
.\" commit 4d3b0b05aae9ee9ce0970dc4cc0fb3fad5e85945
.\" commit 0466bdb99e8744bc9befa8d62a317f0fd7fd7421
This value results in immediate termination of the process,
with a core dump.
The system call is not executed.
By contrast with
.BR SECCOMP_RET_KILL_THREAD
below, all threads in the thread group are terminated.
(For a discussion of thread groups, see the description of the
.BR CLONE_THREAD
flag in
.BR clone (2).)
.IP
The process terminates
.I "as though"
killed by a
.B SIGSYS
signal.
Even if a signal handler has been registered for
.BR SIGSYS ,
the handler will be ignored in this case and the process always terminates.
To a parent process that is waiting on this process (using
.BR waitpid (2)
or similar), the returned
.I wstatus
will indicate that its child was terminated as though by a
.BR SIGSYS
signal.
.TP
.BR SECCOMP_RET_KILL_THREAD " (or " SECCOMP_RET_KILL )
This value results in immediate termination of the thread
that made the system call.