Systemd gets seccomp filter support [LWN.net]

Systemd gets seccomp filter support

Posted Jul 17, 2012 18:46 UTC (Tue) by walters (subscriber, #7396)
In reply to: Systemd gets seccomp filter support by iabervon
Parent article: Systemd gets seccomp filter support

The nice thing about seccomp is that userspace is responsible for providing the policy, and the kernel just enforces it,

That's true of SELinux as well; I assume you're referring to AppArmor here or something. Or unless you're talking about the ability of a userspace program to *dynamically* adjust its filter in response to configuration files or environment, in which case yes it's definitely more flexible (although the proposed systemd syntax doesn't allow run-time mutation). What would be kind of interesting though is if shared libraries could come with lists of system calls they could possibly make. That way if e.g. your app upgrades from GLib 2.28 to 2.30 (in between a lot of things changed, but e.g. I switched the main loop to use eventfd instead of pipe()), your app wouldn't have to change. That'd require some integration work at the systemd side to introspect the binary before launching it and determine what shared libraries are used.

(Log in to post comments)

Systemd gets seccomp filter support

Posted Jul 17, 2012 19:24 UTC (Tue) by iabervon (subscriber, #722) [Link]

I'm talking about the parent of a process being able to dynamically adjust the policy for the process right before exec. In SELinux, the policy is written by userspace, but the kernel controls determining the security domain during exec(), and that selects the applicable policy, so there's no userspace involvement at the last minute. Userspace isn't necessarily given a chance to react to changes in NSS configuration between when the configuration last changed and starting new restricted processes.

AFAICT, the systemd syntax doesn't exclude the possibility of listing library functions in your syscall list, and having that trigger run-time mutation. And systemd is obviously constructing BFP based on a combination of your list and stuff it knows, if for no other reason than that it has to figure out syscall numbers from names.