From 2be4f13a5689d561e03bfe8f75c417d651c0e753 Mon Sep 17 00:00:00 2001 From: Etienne Perot Date: Tue, 27 Aug 2024 21:20:44 -0700 Subject: [PATCH] Typo fix. PiperOrigin-RevId: 668263281 --- website/blog/2023-04-28-systrap-release.md | 4 ++-- website/blog/2024-02-01-seccomp.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/website/blog/2023-04-28-systrap-release.md b/website/blog/2023-04-28-systrap-release.md index b62bda9a7..0b32ff012 100644 --- a/website/blog/2023-04-28-systrap-release.md +++ b/website/blog/2023-04-28-systrap-release.md @@ -85,7 +85,7 @@ process must first incur the overhead of executing the seccomp filter[^3], and then generating a full signal stack before being able to run the signal handler. What if there was a way to simply have the sandboxed process jump to another user-space function when it wanted to perform a system call? Well, turns out, -there is[^4] There is a popular x86 instruction pattern that’s used to perform +there is[^4]! There is a popular x86 instruction pattern that’s used to perform system calls, and it goes a little something like this: **`mov sysno, %eax; syscall`**. The size of the mov instruction is 5 bytes and the size of the syscall instruction is 2 bytes. Luckily this is just enough space to fit in a @@ -160,7 +160,7 @@ encounter any issues, please let us know at [^3]: Seccomp filters are known to have a “not insubstantial” overhead: [https://lwn.net/Articles/656307/](https://lwn.net/Articles/656307/). -[^4]: On the x86_64 architecture, ARM does not have this optimization as of the +[^4]: On the x86_64 architecture. ARM does not have this optimization as of the time of writing. diff --git a/website/blog/2024-02-01-seccomp.md b/website/blog/2024-02-01-seccomp.md index c8d164e53..4c386ea5b 100644 --- a/website/blog/2024-02-01-seccomp.md +++ b/website/blog/2024-02-01-seccomp.md @@ -174,8 +174,8 @@ the optimizations described in this blog post: number must fit in 8 bits, so this cannot jump by more than 255 instructions. - The number of instructions to jump by if the condition is false. - This number must fit in 8 bits, so this cannot jump by by more than - 255 instructions. + This number must fit in 8 bits, so this cannot jump by more than 255 + instructions. ### `seccomp-bpf` caching in Linux