3 ms·
You really need to know your system calls back to front to work out how to apply seccomp usefully and effectively. There are several hundred of them, including
by justincormack 11y ago
You really need to know your system calls back to front to work out how to apply seccomp usefully and effectively. There are several hundred of them, including historical versions which may or may not be used, depending on the libc version that runs.
- tyingq 11y agoSure. But libseccomp does use the same "only explicitly allowed" path that pledge() does. It also uses "pseudo" names for the syscalls, so there's one place to look up the list: https://github.com/seccomp/libseccomp/blob/master/include/seccomp.h.in#L581 https://github.com/seccomp/libseccomp/blob/master/include/se... The aliases that pledge offers (like stdio) that sum up logical groups would be nice, but that's a minor difference to me.
- justincormack 11y agoYou can blacklist or whitelist with seccomp it is up to you. The pseudo names dont help significantly. It gives you a small amount of help with the socketcall issues on 32 bit linux, but you are largely on your own. Pledge also gives you ability to block or allow on pathnames, which you cant do easily with seccomp, as you just get pointers. You are better off using one of the other security mechanisms to deal with paths, but it is not simple.