Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

Systemd gets seccomp filter support

Posted Jul 18, 2012 9:08 UTC (Wed) by renox (subscriber, #23785)
In reply to: Systemd gets seccomp filter support by hmh
Parent article: Systemd gets seccomp filter support

Blacklist are always tricky to get right, whether it's in a sandbox, a firewall or whatever.

I think that it's better to take advantage of the sources to get the list of syscall used..

(Log in to post comments)

Posted Jul 18, 2012 9:49 UTC (Wed) by anselm (subscriber, #2796) [Link]

The problem here is that the sources for a program don't actually tell you the exact syscalls it uses. What you can see is the C library calls, which may or may not be mapped one-to-one to actual syscalls into the kernel that seccomp could intercept.