3 ms·
The other issues: Parent cannot seccomp itself without being highly coupled to the child (filters persist across exec), Different syscall numbers, socketcall, e
by nwmcsween 7y ago
The other issues: Parent cannot seccomp itself without being highly coupled to the child (filters persist across exec), Different syscall numbers, socketcall, etc, etc make it almost mandatory to use something to build the filter.
But there isn't really anything that Linux can replace it with, pledge works because Openbsd controls both libc and the kernel.
- the8472 7y agoThere are precedents for linux shipping associated libraries, e.g. libbf and liburing. But yeah, it's not likely to happen anytime soon.
- viraptor 7y ago> Parent cannot seccomp itself without being highly coupled to the child You can workaround this sometimes though. Unless you actually care about fork with current memory copy, (i.e. you care about spawning new processes only) you can fork a "spawner" process early which is only a thin proxy for pipe->exec commands. You apply seccomp after spawner is ready and you're all good.