2 ms·
Just to add, pledge can be called repeatedly throughout the program to reduce the behaviors that are permitted unlike seccomp.
by gbrown_ 6y ago
Just to add, pledge can be called repeatedly throughout the program to reduce the behaviors that are permitted unlike seccomp.
- cyphar 6y agoYou can do that with seccomp -- each filter is run along with the others and the most restrictive return value is used by seccomp. If a program in a seccomp sandbox couldn't add a new secxokp filter to itself, you wouldn't be able to run programs like OpenSSH inside containers (which you can).