seccomp.2: Add description of SECCOMP_RET_KILL_PROCESS

Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

diff --git a/man2/seccomp.2 b/man2/seccomp.2
index 2e912940eddd243554dbb2f093d64e3e7278b43e..1b6bb2e5155ee313c02fa5767bd776751a0ca929 100644 (file)
--- a/man2/seccomp.2
+++ b/man2/seccomp.2
@@ -399,6 +399,36 @@ returned by execution of all of the filters.
 In decreasing order of precedence,
 the values that may be returned by a seccomp filter are:
 .TP
+.BR SECCOMP_RET_KILL_PROCESS " (since Linux 4.14)"
+.\" commit 4d3b0b05aae9ee9ce0970dc4cc0fb3fad5e85945
+.\" commit 0466bdb99e8744bc9befa8d62a317f0fd7fd7421
+This value results in immediate termination of the process,
+with a core dump.
+The system call is not executed.
+By contrast with
+.BR SECCOMP_RET_KILL_THREAD
+below, all threads in the thread group are terminated.
+(For a discussion of thread groups, see the description of the
+.BR CLONE_THREAD
+flag in
+.BR clone (2).)
+.IP
+The process terminates
+.I "as though"
+killed by a
+.B SIGSYS
+signal.
+Even if a signal handler has been registered for
+.BR SIGSYS ,
+the handler will be ignored in this case and the process always terminates.
+To a parent process that is waiting on this process (using
+.BR waitpid (2)
+or similar), the returned
+.I wstatus
+will indicate that its child was terminated as though by a
+.BR SIGSYS
+signal.
+.TP
 .BR SECCOMP_RET_KILL_THREAD " (or " SECCOMP_RET_KILL )
 This value results in immediate termination of the thread
 that made the system call.