Subject: Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering

From: Peter Zijlstra <[email-masked]>
Date: Fri, 13 May 2011 17:23:01 +0200

On Fri, 2011-05-13 at 11:10 -0400, Eric Paris wrote:
> Then again, I certainly don't see a
> reason that this syscall hardening patch should be held up while a whole
> new concept in computer security is contemplated...=20

Which makes me wonder why this syscall hardening stuff is done outside
of LSM? Why isn't is part of the LSM so that say SELinux can have a
syscall bitmask per security context?

Making it part of the LSM also avoids having to add this prctl().