进程创建时安全计算处理

static void copy_seccomp(struct task_struct *p) { #ifdef CONFIG_SECCOMP  /*   * Must be called with sighand->lock held, which is common to   * all threads in the group. Holding cred_guard_mutex is not   * needed because this new task is not yet running and cannot   * be racing exec.   */  assert_spin_locked(¤t->sighand->siglock);

 /* Ref-count the new filter user, and assign it. */  get_seccomp_filter(current);  p->seccomp = current->seccomp;

 /*   * Explicitly enable no_new_privs here in case it got set   * between the task_struct being duplicated and holding the   * sighand lock. The seccomp state and nnp must be in sync.   */  if (task_no_new_privs(current))   task_set_no_new_privs(p);

 /*   * If the parent gained a seccomp mode after copying thread   * flags and between before we held the sighand lock, we have   * to manually enable the seccomp thread flag here.   */  if (p->seccomp.mode != SECCOMP_MODE_DISABLED)   set_tsk_thread_flag(p, TIF_SECCOMP); #endif }