With the generous help of the Ubuntu kernel team, Will Drewry’s seccomp filter code has landed in Ubuntu 12.04 LTS in time for Beta 2, and will be in Chrome OS shortly. Hopefully this will be in upstream soon, and filter (pun intended) to the rest of the distributions quickly.
One of the questions I’ve been asked by several people while they developed policy for earlier “mode 2” seccomp implementations was “How do I figure out which syscalls my program is going to need?” To help answer this question, and to show a simple use of seccomp filter, I’ve written up a little tutorial that walks through several steps of building a seccomp filter. It includes a header file (“seccomp-bpf.h“) for implementing the filter, and a collection of other files used to assist in syscall discovery. It should be portable, so it can build even on systems that do not have seccomp available yet.
Read more in the seccomp filter tutorial. Enjoy!
© 2012 – 2017, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.
Um, you’re introducing a feature into LTS that isn’t even certain to make it into upstream?
Are you sure you’re not going to be left holding the baby here?
Comment by Robert — March 23, 2012 @ 5:09 am
Yup — it’s that critical a feature. And it was pretty touch-and-go for a while there, but everything seems to have worked out.
Comment by kees — August 7, 2012 @ 8:59 am