Deferring seccomp decisions to user space

Deferring seccomp decisions to user space

I have to say I'm interested in seeing how this turns out - at least partially because I wrote a linux-security-module which defers checks for exec calls to user-space. The code is reasonably clean, and the overhead of having to exec a user-space binary is essentially unnoticed.

The code is here:

• https://github.com/skx/linux-security-modules/tree/master/security/can-exec

BPF has so many uses, and I'm loving the way it is becoming better documented, and more useful. I'm sure it is only a matter of time before it is invoked by linux-security modules.

Note: you can avoid this step in the future by logging into your LWN account.