3 ms·
seccomp and eBPF will let you build something like this but it does not do the same thing as pledge.
by anaphor 7y ago
seccomp and eBPF will let you build something like this but it does not do the same thing as pledge.
- roryrjb 7y agoI'm not saying you're wrong, but at least in terms of the default behaviour of pledge with regard syscalls and configuring seccomp so the kernel kills your whole process when it hits a syscall you haven't whitelisted, it sounds the same, so it would be good to know what the differences are.
- anaphor 7y agoI think the difference is just that seccomp/eBPF is lower level and more powerful in terms of what it can do. So pledge gives you a simpler interface to manage things, whereas with eBPF you have much more flexibility (since you're writing in a subset of C) but with that flexibility also comes more complexity. I.e., eBPF is its own scripting language for the kernel, pledge is just a way of managing fine-grained capabilities.