3 ms·
How do you feel about openbsd's pledge()? I would really like something as simple as that on linux...
by cyberpunk 7y ago
How do you feel about openbsd's pledge()? I would really like something as simple as that on linux...
- mmis1000 7y agoseccomp actually has that ability to allow only small portion of selective operations. Block everything except io is just one of its blocking mode. And the list is even configurable. Docker do use such ability to filter out sys-calls that shouldn't be used in the container.