5 ms·
You might want to check out firejail - https://firejail.wordpress.com/ https://firejail.wordpress.com/ - it supports seccomp as well.
by absorber 11y ago
You might want to check out firejail - https://firejail.wordpress.com/ https://firejail.wordpress.com/ - it supports seccomp as well.
- viraptor 11y agoIt's a step in the right direction, but it misses one great feature of seccomp - you don't have to activate seccomp at startup. What it means in practice is (for example) a daemon running under firejail must be able to open log for writing and open sockets. An application which uses seccomp natively can first do those things and then block all further open/socket syscalls.
- netytan 11y agoAre you talking about pledge? Pledge works as you describe