Domesticating applications, OpenBSD style

Posted Jul 23, 2015 3:01 UTC (Thu) by thestinger (guest, #91827)
In reply to: Domesticating applications, OpenBSD style by roc
Parent article: Domesticating applications, OpenBSD style

It's already quite painless to use seccomp-bpf via the libseccomp library. It has a very nice API and abstracts over most of the architecture portability issues.

to post comments

Domesticating applications, OpenBSD style

Posted Jul 23, 2015 5:53 UTC (Thu) by roc (subscriber, #30627) [Link] (1 responses)

The issues that tame() abstracts over are not so much architecture portability issues, but having to understand the whole system-call interface to figure out which syscalls to block.

Domesticating applications, OpenBSD style

Posted Jul 27, 2015 1:41 UTC (Mon) by thestinger (guest, #91827) [Link]

You also have to understand subtleties about the system calls whitelisted by tame to use it safely, such as the gotchas pointed out by spender. It only provides convenient (or inconvenient, if your goal is minimal attack surface) groupings of related system calls. It doesn't prevent you from shooting yourself in the foot at all.

Anyway, in most sandboxes, seccomp-bpf (or tame) is for reducing the kernel attack surface. Other mechanisms are used to implement the sandboxing semantics (uid/gid separation, chroot, FreeBSD jail, Linux namespaces).