3 ms·
Oh, I wasn't thinking of firejail, I was thinking about programs sandboxing themselves via seccomp.
by staticassertion 5y ago
Oh, I wasn't thinking of firejail, I was thinking about programs sandboxing themselves via seccomp.
- staticassertion 5y agoedit: or landlock
- the8472 5y agoEven with self-sandboxing filters that won't be inherited can be made more tight than the inherited ones. Maybe you could fork a spawn helper at program startup before installing the filters to emulate this behavior, but that makes IPC more complicated.