3 ms·
A seccomp overview
- ShaneWilton 11y agoseccomp is a really exciting feature that I haven't seen talked about too often. It actually played a fairly large role in CTFs this year, being used by LegitBS in the DEFCON Finals. Since we didn't have access to a lot of the syscalls we'd need to achieve persistence, we (and a lot of other teams), had to focus on actually solving the problems, instead of on sidestepping them with cheap tactics.
- wyldfire 11y ago> There are now a number of tools that are using seccomp filters, including the Chrome/Chromium browser, OpenSSH, vsftpd, and Firefox OS. Does Chrome seccomp itself at all, or just 3rd party helpers/plugins? What about other popular services like http (apache/nginx), SQL (postgres/mysql), DNS -- do they plan to add seccomp support?
- anarazel 11y agoFor postgresql it seems hard to do do so in a generic fashion. There's a great emphasis on being able to extend postgres and that extension code will do stuff we don't allow. Only superusers are allowed to configure/load such extensions for obvious reasons. There are so called 'trusted' languages which means they execute code in a sandboxed manner. But they're mostly executed in the same process context as the normal backend, so it'll hard to effectively use seccomp afaics.