4 ms·

Chrome already uses seccomp-bpf to that end, this is why the `chrome-sandbox` binary is setuid.

• londons_explore 3y ago
  Perhaps the real solution here is to let non-root use seccomp-bpf.
  • boustrophedon 3y ago
    Non-root can use seccomp-bpf. Chrome already does.
    • londons_explore 3y ago
      So theres nothing preventing OP implementing what they want entirely in userspace with no kernel changes already?
      • jagrsw 3y ago
        malloc can use mmap (aside from s/brk) - it's impossible these days to sandbox any more complex program and not allow mmap (arguments can be limited though to only a subset of flags).
        • londons_explore 3y ago
          But that would be the same for both this proposed mseal() and my proposed seccomp solution.