| |||||||||||||
Systemd gets seccomp filter supportSystemd gets seccomp filter supportPosted Jul 18, 2012 9:08 UTC (Wed) by renox (subscriber, #23785)In reply to: Systemd gets seccomp filter support by hmh Parent article: Systemd gets seccomp filter support
Blacklist are always tricky to get right, whether it's in a sandbox, a firewall or whatever.
I think that it's better to take advantage of the sources to get the list of syscall used..
(Log in to post comments)
Systemd gets seccomp filter support Posted Jul 18, 2012 9:49 UTC (Wed) by anselm (subscriber, #2796) [Link] The problem here is that the sources for a program don't actually tell you the exact syscalls it uses. What you can see is the C library calls, which may or may not be mapped one-to-one to actual syscalls into the kernel that seccomp could intercept.
|
|||||||||||||