The article doesn't mention SECCOMP_RET_TRAP which was an existing way to inspect syscall pointer arguments during interception (when combined with a SIGSYS signal handler).
I'm curious how the two approaches compare - does USER_NOTIF give a greater range of possibilities, or is it mostly just a different interface?
In a small application that forks once and uses seccomp on the child process, would there be much benefit in moving from RET_TRAP to USER_NOTIF?
I'm curious how the two approaches compare - does USER_NOTIF give a greater range of possibilities, or is it mostly just a different interface?
In a small application that forks once and uses seccomp on the child process, would there be much benefit in moving from RET_TRAP to USER_NOTIF?