How can I find all syscalls that have to be whitelisted for seccomp?
How can I find all syscalls that have to be whitelisted for seccomp?
I have an existing program that I would like to sandbox using seccomp (v2).
How can I find what seccomp rules I need to allow for the program?
I've tried adding seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(…), 0) for all syscalls printed by strace -xfc a.out, but apparently that wasn't enough, since I'm still getting "SIGSYS, Bad system call" when I run the program with seccomp.
seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(…), 0)
strace -xfc a.out
1 Answer
1
Probably the most reliable way is to switch your seccomp filter to return SECCOMP_RET_TRAP ("send catchable SIGSYS on error") rather than SECCOMP_RET_KILL ("kill the process with an uncatchable SIGSYS"), then print the siginfo_t from the signal handler, then commit suicide.
SECCOMP_RET_TRAP
SIGSYS
SECCOMP_RET_KILL
SIGSYS
siginfo_t
scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_TRAP);
Yes, that's one of the C-level libraries; I was answering at the syscall level since that's the same.
– o11c
Jul 1 at 20:56
By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.
Is that equivalent to
scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_TRAP);?– Kornel
Jul 1 at 17:03