3 ms·
Hmm, I think OS level syscall restriction is also a good mitigation for simple programs. Things like https://en.wikipedia.org/wiki/Seccomp https://en.wikipedia.
by andrewchambers 11y ago
Hmm, I think OS level syscall restriction is also a good mitigation for simple programs. Things like https://en.wikipedia.org/wiki/Seccomp https://en.wikipedia.org/wiki/Seccomp.
- dmix 11y agoHow popular is Seccomp? I know Chrome uses it, but I'm not familiar with many other programs outside of sandboxing software.
- andrewchambers 11y agoThings like gzip or tar or compilers should use it imo. They are programs which just read from one file descriptor and write to another.