Skip to main content

Questions tagged [seccomp]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
3 votes
1 answer

Why I am unable to execute insmod on the docker container?

I have started an unprivileged docker container and trying to start the privileged exec session. It has CAP_SYS_MODULE capabilities, but still, I am getting operations not permitted in insmod. docker ...
tbhaxor's user avatar
  • 133
0 votes
0 answers

How to dump the input of a seccomp BPF filter?

I am writing a program that creates BPF seccomp filters. These filters are supposed to check syscalls and their arguments against predefined allowed values. The logic to check the syscall by its ...
inorik's user avatar
  • 197
1 vote
2 answers

Syscalls are disabled with seccomp. What attacks are still possible? How to prevent them?

I want to run a piece of untrusted code on my machine. I've disabled all syscalls (besides exit, sigreturn, read and write) with seccomp for a process. Now, I'd like to spawn a child process that will ...
John Smith's user avatar
2 votes
1 answer

What additional protection does seccomp provide when compared to capabilites?

From this answer I understand that seccomp-bpf filters the list of syscalls a process can call. Similarly, the capabilites mechanism will cause a syscall to fail if the caller does not have the ...
inorik's user avatar
  • 197
2 votes
1 answer

Is it possible to use systemd seccomp filtering for running applications from command line?

Example systemd unit file, what I mean by "seccomp". ProtectSystem=full ProtectHome=true ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true PrivateTmp=true PrivateMounts=...
adrelanos's user avatar
  • 764
14 votes
2 answers

Difference between linux capabities and seccomp

I know seccomp (secure computing) is a way to restrict a process from making particular system calls. While linux capabilities provides a way to give privileges to specific user or process. So if I ...
mchawre's user avatar
  • 243
7 votes
2 answers

Opt-in a security profile at runtime, without tedious setup

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish. I would like to be able to ...
fluxrider's user avatar
  • 171
20 votes
2 answers

Docker: when to use apparmor vs seccomp vs --cap-drop

Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container. However I couldn't find any documentation or guideline on when to use which ...
JackDaniels's user avatar