0
I’ll just assert that there’s no way to use seccomp()
correctly. Just like how there’s no way to use gets()
correctly, causing it to eventually be removed from the C and C++
standards.
seccomp
allows you to filter syscalls with a ruleset.
The obvious thing is to filter anything your program isn’t supposed to
be doing. If it doesn’t do file IO, don’t let it open files. If it’s
not supposed to execute anything, don’t let it do that.
But whether you use a whitelist (e.g. only allow working with already
open file descriptors), or a blacklist (e.g. don’t allow it to open
these files), it’s fundamentally flawed.
1. Syscalls change. Sometimes without even recompiling
open()
in your code actually becomes the openat
syscall. Maybe. At
least today. At least on my machine, today.
select()
actually becomes pselect6
. At least on Fridays.
If you upgrade libc or distribute a binary to other systems, this may
start to fail.
2. Surprising syscalls
Calling printf()
will call the syscall newfstatat
, a syscall hard
to even parse into words. But only the first time you call it! So
after your first printf()
you can block newfstatat
.
Maybe Continue reading