3 ms·
seccomp in linux is _roughly_ similar to pledge. they aim to accomplish the same goals but pledge is more straightforward. think of it like sudo vs doas.
by robmusial 5y ago
seccomp in linux is _roughly_ similar to pledge. they aim to accomplish the same goals but pledge is more straightforward. think of it like sudo vs doas.
- Godel_unicode 5y agoSeccomp profiles are typically applied externally to a process in my experience though. I think this is more analogous to using capset() to remove capabilities in highly permissioned processes. For instance dnsmasq makes use of this ability to be minimally permissioned.