2 ms·
Selinux, apparmor, etc. are not viable security solutions for pretty much anything, because they are too coarse grained. Seccomp that blocks everything, but lea
by zzzcpan 7y ago
Selinux, apparmor, etc. are not viable security solutions for pretty much anything, because they are too coarse grained. Seccomp that blocks everything, but leaves just a couple of syscalls to interact with an external proxy process is closer to what could have worked, which is basically a sandbox.
- cyberpunk 7y agoHow do you feel about openbsd's pledge()? I would really like something as simple as that on linux...
- mmis1000 7y agoseccomp actually has that ability to allow only small portion of selective operations. Block everything except io is just one of its blocking mode. And the list is even configurable. Docker do use such ability to filter out sys-calls that shouldn't be used in the container.