Expand description
seccomp-bpf support on recent Linux kernels.
This works in tandem with namespace in order to implement sandbox profiles. It is generally
the weaker of the two approaches, because BPF is limited, but it’s useful for reducing kernel
attack surface area and implementing coarse-grained policies.
Structs§
Constants§
- ABS 🔒
- ALLOW_
SYSCALL 🔒 - ARCH_NR 🔒
- The architecture number for x86-64.
- ARCH_
NR_ 🔒OFFSET - ARG_
0_ 🔒OFFSET - ARG_
1_ 🔒OFFSET - ARG_
2_ 🔒OFFSET - AUDIT_
ARCH_ 🔒AARC H64 - The architecture number for ARM 64-bit.
- AUDIT_
ARCH_ 🔒ARM - The architecture number for ARM.
- AUDIT_
ARCH_ 🔒PPC - The architecture number for ppc.
- AUDIT_
ARCH_ 🔒PPC64 - The architecture number for ppc64.
- AUDIT_
ARCH_ 🔒PPC64LE - The architecture number for ppc64le.
- AUDIT_
ARCH_ 🔒X86 - The architecture number for x86.
- AUDIT_
ARCH_ 🔒X86_ 64 - The architecture number for x86-64.
- EM_386 🔒
- EM_
AARC 🔒H64 - EM_ARM 🔒
- EM_PPC 🔒
- EM_
PPC64 🔒 - EM_
X86_ 🔒64 - EXAMINE_
ARG_ 🔒0 - EXAMINE_
ARG_ 🔒1 - EXAMINE_
ARG_ 🔒2 - EXAMINE_
SYSCALL 🔒 - JEQ 🔒
- JMP 🔒
- JSET 🔒
- K 🔒
- KILL_
PROCESS 🔒 - LD 🔒
- NETLINK_
ROUTE 🔒 - PR_
SET_ 🔒NO_ NEW_ PRIVS - PR_
SET_ 🔒SECCOMP - RET 🔒
- SECCOMP_
MODE_ 🔒FILTER - SECCOMP_
RET_ 🔒ALLOW - SECCOMP_
RET_ 🔒KILL - SYSCALL_
NR_ 🔒OFFSET - VALIDATE_
ARCHITECTURE_ 🔒0 - VALIDATE_
ARCHITECTURE_ 🔒1 - VALIDATE_
ARCHITECTURE_ 🔒2 - W 🔒
- __
AUDIT_ 🔒ARCH_ 64BIT - A flag set in the architecture number for all 64-bit architectures.
- __
AUDIT_ 🔒ARCH_ LE - A flag set in the architecture number for all little-endian architectures.
Statics§
- ALLOWED_
SYSCALLS - Syscalls that are always allowed.
- ALLOWED_
SYSCALLS_ 🔒FOR_ FILE_ READ - ALLOWED_
SYSCALLS_ 🔒FOR_ NETWORK_ OUTBOUND - FILTER_
EPILOGUE 🔒 - FILTER_
PROLOGUE 🔒