Thanks for the clarification, although I recall messing with eBPF and kprobes before - pretty sure you can dereference pointers? editx2: Oh, guess seccomp does

Thanks for the clarification, although I recall messing with eBPF and kprobes before - pretty sure you can dereference pointers? editx2: Oh, guess seccomp doesn't use eBPF yet? Suppose that raises a bunch of questions about permissions necessary for specifying programs that might dereference kernel pointers and such by emitting `bpf()` calls.