4 ms·

> But if you've got a separation of duties where a sysadmin sets up seccomp filtering generically across applications Is this even possible, regardless of io_u

• amarshall 2y ago
  Well the article brings up containers as an example. If the sysadmin controls “your” parent or root process (e.g. the login shell), they can just perform seccomp filtering there and it applies to everything within it (like any other sandbox).
  • 0x74696d 2y ago
    (author here) I'm one of the maintainers of HashiCorp's Nomad, so that example was likely inspired by the separation of duties that's part of our security model. In that environment, there's a subset of task (ex. container) configuration that's controlled by the cluster admin and a subset that's controlled by the job author deploying onto the cluster.
• klooney 2y ago
  Yes- systemd will let you do that, as well docker/containerd/podman.