Menu

📰
0

Software sandboxing: The basics

Hacker News·about 16 hours ago
#FCsTaRku
#software#seccomp#syscalls#docker#bpf#article
Reading 0:00
15s threshold

// These policies are heavily influenced by Docker's default profile. Further // customization done on top: // // - Avoid syscalls that need root anyway. The policies here are mostly meant to // be used by unprivileged users (not containers with root inside). The // syscalls wouldn't be harmful, but would result in larger BPF programs that // in turn incur more overhead. // - Avoid rarely used syscalls that can be abused for yet more fingerprinting // on desktop applications. This category mostly contains syscalls useful for // profiling (e.g. mincore, cachestat). // - Split them into categories inspired by systemD's seccomp filter sets and // OpenBSD's pledge promises. POLICY Aio { ALLOW { io_cancel, io_destroy, io_getevents, io_pgetevents, io_setup, io_submit } } POLICY BasicIo { ALLOW { read, readv, tee, vmsplice, write, writev, // ioctl() is definitively not about generic/stream/basic I/O. ioctl() // is really a syscall in disguise that device drivers can use for // anything.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Read More