From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <fweimer@redhat.com>
Received: from us-smtp-delivery-124.mimecast.com
 (us-smtp-delivery-124.mimecast.com [216.205.24.124])
 by sourceware.org (Postfix) with ESMTP id 618613850430
 for <libc-alpha@sourceware.org>; Mon, 31 May 2021 12:16:38 +0000 (GMT)
DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 618613850430
Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com
 [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id
 us-mta-355-E5GmV72LMkax9CF1Biq7aA-1; Mon, 31 May 2021 08:16:35 -0400
X-MC-Unique: E5GmV72LMkax9CF1Biq7aA-1
Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com
 [10.5.11.11])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mimecast-mx01.redhat.com (Postfix) with ESMTPS id D6A02A0CB1;
 Mon, 31 May 2021 12:16:33 +0000 (UTC)
Received: from oldenburg.str.redhat.com (ovpn-113-228.ams2.redhat.com
 [10.36.113.228])
 by smtp.corp.redhat.com (Postfix) with ESMTPS id CC94378632;
 Mon, 31 May 2021 12:16:32 +0000 (UTC)
From: Florian Weimer <fweimer@redhat.com>
To: "H.J. Lu" <hjl.tools@gmail.com>
Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>,  GNU C Library
 <libc-alpha@sourceware.org>
Subject: Re: [PATCH v7 1/3] Add an internal wrapper for clone, clone2 and
 clone3
References: <20210526123956.2712353-1-hjl.tools@gmail.com>
 <20210526123956.2712353-2-hjl.tools@gmail.com>
 <87h7ipsl03.fsf@oldenburg.str.redhat.com>
 <CAMe9rOorjfK_tx_y7158hwwP-JOisuegCF76VRDUUKJWiG2ukg@mail.gmail.com>
 <875yz5sjb4.fsf@oldenburg.str.redhat.com>
 <d8061d36-a1c8-de7d-3911-8f57fe4446b1@linaro.org>
 <CAMe9rOo1EzHoTGvV-oqLJKANKAChLdGcumB=RRep9jTDTHB-7Q@mail.gmail.com>
Date: Mon, 31 May 2021 14:16:30 +0200
In-Reply-To: <CAMe9rOo1EzHoTGvV-oqLJKANKAChLdGcumB=RRep9jTDTHB-7Q@mail.gmail.com>
 (H. J. Lu's message of "Mon, 31 May 2021 05:14:07 -0700")
Message-ID: <87im2zdroh.fsf@oldenburg.str.redhat.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux)
MIME-Version: 1.0
X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11
X-Mimecast-Spam-Score: 0
X-Mimecast-Originator: redhat.com
Content-Type: text/plain
X-Spam-Status: No, score=-6.4 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH,
 DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, KAM_NUMSUBJECT,
 RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE,
 SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
 server2.sourceware.org
X-BeenThere: libc-alpha@sourceware.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Libc-alpha mailing list <libc-alpha.sourceware.org>
List-Unsubscribe: <https://sourceware.org/mailman/options/libc-alpha>,
 <mailto:libc-alpha-request@sourceware.org?subject=unsubscribe>
List-Archive: <https://sourceware.org/pipermail/libc-alpha/>
List-Post: <mailto:libc-alpha@sourceware.org>
List-Help: <mailto:libc-alpha-request@sourceware.org?subject=help>
List-Subscribe: <https://sourceware.org/mailman/listinfo/libc-alpha>,
 <mailto:libc-alpha-request@sourceware.org?subject=subscribe>
X-List-Received-Date: Mon, 31 May 2021 12:16:39 -0000

* H. J. Lu:

> From:
>
> https://bugs.chromium.org/p/chromium/issues/detail?id=1213452#c5
>
> They can modify the sandbox to return ENOSYS on clone3.

Is this sufficient if we have detected before that the process supports
CET and should enable it?

I think browsers activate the sandbox *after* process initialization
(unlike containers, where it happens before startup).

Thanks,
Florian