4 ms·
I wrote an open source BPF tool recently that shows which capabilities your application is using, live, for the purposes of determining such a whitelist: http:/
by brendangregg 10y ago
I wrote an open source BPF tool recently that shows which capabilities your application is using, live, for the purposes of determining such a whitelist: http://www.brendangregg.com/blog/2016-10-01/linux-bcc-security-capabilities.html http://www.brendangregg.com/blog/2016-10-01/linux-bcc-securi...
- fnord123 10y agoAs you guys are using FreeBSD at Netflix, have you reached over to OpenBSD and tried pledge[1]? It looks like a terrific addition to the sandboxing suite of tools. It seems like it would go hand in hand with your whitelisting tool if only they ran on the same platforms. [1] http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/pledge.2 http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/...