Hacker News Reader

Yeah, that caught my attention. I envy OpenBSD's ability to do "apply this to everything" projects like this one. Linux had seccomp for ages now, but there's still barely any application using it. I even wrote patches to add supports in some projects and they were just ignored. :(

View on HN

You might want to check out firejail - https://firejail.wordpress.com/ - it supports seccomp as well.

It's a step in the right direction, but it misses one great feature of seccomp - you don't have to activate seccomp at startup.

What it means in practice is (for example) a daemon running under firejail must be able to open log for writing and open sockets. An application which uses seccomp natively can first do those things and then block all further open/socket syscalls.

Are you talking about pledge? Pledge works as you describe

Reply on news.ycombinator.com