[lxc-devel] [lxc/master] docs: Adds missing doc entries for seccomp related API extensions
tomponline on Github
lxc-bot at linuxcontainers.org
Tue Apr 30 09:15:44 UTC 2019
A non-text attachment was scrubbed...
Name: not available
Size: 357 bytes
Desc: not available
-------------- next part --------------
From 7b766ddc3a6b5f38dcce3e7e24f74c87df97cde5 Mon Sep 17 00:00:00 2001
From: tomponline <thomas.parrott at canonical.com>
Date: Tue, 30 Apr 2019 10:14:55 +0100
Subject: [PATCH] docs: Adds missing doc entries for seccomp related API
Signed-off-by: tomponline <thomas.parrott at canonical.com>
doc/api-extensions.md | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/doc/api-extensions.md b/doc/api-extensions.md
index 14a5723522..8c95021ada 100644
@@ -33,6 +33,19 @@ This adds support for injecting and removing mounts into/from a running
containers. Two new API functions `mount()` and `umount()` are added. They
mirror the current mount and umount API of the kernel.
+This adds support for seccomp filters to be stacked regardless of whether a seccomp profile is
+already loaded. This allows nested containers to load their own seccomp profile.
+This adds "notify" as seccomp action that will cause LXC to register a seccomp listener and retrieve
+a listener file descriptor from the kernel. When a syscall is made that is registered as "notify"
+the kernel will generate a poll event and send a message over the file descriptor.
+The caller can read this message, inspect the syscalls including its arguments. Based on this information the caller is expected to send back a message informing the kernel which action to take. Until that message is sent the kernel will block the calling process. The format of the messages to read and sent is documented in seccomp itself.
This introduces the `lxc.net.[i].veth.ipv4.route` and `lxc.net.[i].veth.ipv6.route` properties
More information about the lxc-devel