Questions tagged [seccomp]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
0answers
76 views

Is it possible to use systemd seccomp filtering for running applications from command line?

Example systemd unit file, what I mean by "seccomp". ProtectSystem=full ProtectHome=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true PrivateTmp=true PrivateMounts=...
4
votes
2answers
413 views

Difference between linux capabities and seccomp

I know seccomp (secure computing) is a way to restrict a process from making particular system calls. While linux capabilities provides a way to give privileges to spcific user or process. So if I ...
6
votes
1answer
69 views

Opt-in a security profile at runtime, without tedious setup

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish. I would like to be able to ...
6
votes
2answers
2k views

Docker: when to use apparmor vs seccomp vs --cap-drop

Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container. However I couldn't find any documentation or guideline on when to use which ...