| |||||||||||||
Limiting system calls via control groups?Limiting system calls via control groups?Posted Oct 20, 2011 13:43 UTC (Thu) by alonz (subscriber, #815)Parent article: Limiting system calls via control groups? I wonder if it wouldn't be better to start from the other end of the solution space—small, incremental extensions to seccomp. For example: just adding recvmsg and poll to the set of system calls permitted by seccomp is already a huge increase in the capabilities of sandboxed processes—the “controller” process will be able to open files on behalf of the sandbox (after applying proper policy), or pipes, or sockets, or even supply interfaces to signals (using signalfd) and interval timers (using timerfd), and pass these fd's to the sandbox via a UNIX domain socket. And by using poll, the sandbox will have full control over the way it processes the available data / events.
(Log in to post comments)
|
|||||||||||||