Contents
How does seccomp work?
seccomp allows a process to make a one-way transition into a “secure” state where it cannot make any system calls except exit() , sigreturn() , read() and write() to already-open file descriptors. In this sense, it does not virtualize the system’s resources but isolates the process from them entirely.
What are Cgroups in Docker?
Control Groups (cgroups) are a feature of the Linux kernel that allow you to limit the access processes and containers have to system resources such as CPU, RAM, IOPS and network. In this lab you will use cgroups to limit the resources available to Docker containers.
How to use seccomp _ set _ mode _ filter operation?
In order to use the SECCOMP_SET_MODE_FILTER operation, either the calling thread must have the CAP_SYS_ADMIN capability in its user namespace, or the thread must already have the no_new_privs bit set.
What does seccomp _ Ret _ kill _ thread do?
SECCOMP_RET_KILL_THREAD (or SECCOMP_RET_KILL ) This value results in immediate termination of the thread that made the system call. The system call is not executed. Other threads in the same thread group will continue to execute. The thread terminates as though killed by a SIGSYS signal.
What happens if seccomp ( 2 ) fails in errno?
If the filter is invalid, seccomp () fails, returning EINVAL in errno . If fork (2) or clone (2) is allowed by the filter, any child processes will be constrained to the same system call filters as the parent. If execve (2) is allowed, the existing filters will be preserved across a call to execve (2) .
How does seccomp system call work in Linux?
The seccomp () system call operates on the Secure Computing (seccomp) state of the calling process. Currently, Linux supports the following operation values: SECCOMP_SET_MODE_STRICT The only system calls that the calling thread is permitted to make are read (2), write (2), _exit (2) (but not exit_group (2)), and sigreturn (2).