Lightweight Filesystem sandboxing with eBPF

lwn.net

32 pointsriyakhanna19833 comments

code is now available: https://github.com/sandfs/LibSandFS

This damned cool, and neat!

I do wonder if this can be combined with something like whitelisting based on some criteria. A _very_ unthought-through version would be checking a SHA-512 sum of a binary or some such.

Either way, a neat tool in the toolbox.

Linux users keep being jealous of OpenBSD's pledge(2) and unveil(2) system calls.

Reply on news.ycombinator.com