4 ms·

Is ProcessSystemCallDisablePolicy somehow similar to seccomp on Linux? I understand that seccomp allows to selectively allow/disallow individual system calls wh

• mdriley 12y ago
  They're comparable features. In both cases, a simple but hardened filter is placed in front of some part of the kernel attack surface. Vulnerable processes (e.g. renderers) opt in to these protections so that, in the event of compromise, they're less likely to be vectors for a successful escalation of privilege attack against the kernel syscall interface.