4 ms·
Are you saying this about SECCOMP and Landlock? Just to be clear: - unveil(), based on the Landlock LSM, is a function which whitelists files. - pledge(), bas
by jart 3y ago
Are you saying this about SECCOMP and Landlock? Just to be clear:
- unveil(), based on the Landlock LSM, is a function which whitelists files.
- pledge(), based on SECCOMP BPF, is a function which whitelists system calls.
- IshKebab 3y agoYeah, though looking through the code it does actually look very solid. I didn't see that you actually whitelist `/proc/cpuinfo` before.