4 ms·
Can dtrace do sandboxing the way ptrace can? I didnt think it could.
by justincormack 13y ago
Can dtrace do sandboxing the way ptrace can? I didnt think it could.
- comex 13y agoIt would probably be possible using destructive actions (e.g. use raise() to kill the process if it tries to do something bad). It would require root and not be easier than using OS X's built-in sandbox (i.e. if you need to allow access to some Mach services for some APIs to work, that still needs to happen regardless of what you're using to sandbox), but it could potentially be more secure, as OS X doesn't otherwise support limiting syscalls to a small set like seccomp on Linux.