3 ms·
> Which are ...? seccomp. Local code execution doesn't mean a thing (except for wasted CPU cycles and/or memory) if number of syscalls the process can do is l
by drdaeman 10y ago
> Which are ...?
seccomp.
Local code execution doesn't mean a thing (except for wasted CPU cycles and/or memory) if number of syscalls the process can do is limited to the bare minimum.
- ryuuchin 10y agoAnd the Windows equivalent (win32k lockdown)[1]. This restricts a number of win32k syscalls including all GDI ones. Chrome already uses this mitigation for renderer processes and has support for PPAPI plugin processes on their dev/beta channels. [1] https://msdn.microsoft.com/en-us/library/windows/desktop/hh871472(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/hh8...