experiment with taking seccomp out about bubblewrap HOT 6 CLOSED

That is kind of hard to use though. Especially from the shell. I think we could have a set of pre-build BPF sets linked into the app, and then be able to pass via an FD for additional rules.

from bubblewrap.

Keep in mind I see the goal here as to define a core - a higher level tool can add lots of porcelain that runs without any privileges.

from bubblewrap.

True.

What about security issues though. Does the kernel verify the passed in BPF? Are there any risks with loading arbitrary bits as a seccomp ruleset?

from bubblewrap.

Not any more than there are without this tool. There's nothing special about libseccomp - it's just a userspace library for making them, any userspace today can access the seccomp system call and install whatever it wants.

https://lwn.net/Articles/656307/

from bubblewrap.

Presumably you could have bubblewrap set up namespace jail and leave seccomp to whatever lives in the jail.

from bubblewrap.

Master supports --seccomp FD

from bubblewrap.