Subject: Re: [PATCH net-next] bpf, seccomp: prepare for upcoming criu support

From: Alexei Starovoitov <[email-masked]>
Date: Fri, 2 Oct 2015 08:09:50 -0700

On 10/2/15 6:17 AM, Daniel Borkmann wrote:
> The current ongoing effort to dump existing cBPF seccomp filters back
> to user space requires to hold the pre-transformed instructions like
> we do in case of socket filters from sk_attach_filter() side, so they
> can be reloaded in original form at a later point in time by utilities
> such as criu.
>
> To prepare for this, simply extend the bpf_prog_create_from_user()
> API to hold a flag that tells whether we should store the original
> or not. Also, fanout filters could make use of that in future for
> things like diag. While fanout filters already use bpf_prog_destroy(),
> move seccomp over to them as well to handle original programs when
> present.
>
> Signed-off-by: Daniel Borkmann<[email-masked]>

I agree that adding flag to bpf_prog_create_from_user() is cleaner
than exposing static bpf_prog_store_orig_filter(), so
Acked-by: Alexei Starovoitov <[email-masked]>