3 ms·
Doesn’t gVisor require symbol interposition to do its sandboxing thing? (At least, for binaries with static-linked runtimes, like the type Golang produces by de
by derefr 5y ago
Doesn’t gVisor require symbol interposition to do its sandboxing thing? (At least, for binaries with static-linked runtimes, like the type Golang produces by default.)
- falldmg 5y agoSymbol interposition? I don't know for sure, but I would guess gVisor is using ptrace or another mechanism, to interpose on syscalls, not library calls. But these flags, I believe, only impact interposition of symbols in the same library, so even if gVisor did use interposition for something, it may not matter.
- dathinab 5y agoIf you have a fully static-linked library you already don't have symbol interposition. Furthermore this options still allow the thinks you need interposition for, for calls from/to external dynamic linked libraries like libc. But most important gVisor is based around intercepting system calls (over simplified), for which you don't need symbol interposition.