seccomp

Why does a process that has gone into seccomp mode always get killed on exit? $ cat simple.c #include <stdio.h> #include <stdlib.h> #include <linux/prctl.h> int main( int argc, char **argv ) { printf("Starting\n"); prctl(PR_SET_SECCOMP, 1); printf("Running\n"); exit(0); } $ cc -o simple simple.c $ ./simple || echo "Returned $?" Starting Running Killed Returned 137 From the man page, under PR_SET_SECCOMP, the only allowed system calls are read, write, exit, and sigreturn. When you call exit(0) in the standard library (in recent Linux), you call the exit_group system call, not exit. This is not

I have enabled seccomp via python-prctl in a project. I can't quite figure out how to exit cleanly - the result is always a kill. I saw some examples that use ctypes or ffi to try to reference libc, but if I expect them with WIFEXITED they also seem to have the same issue. Example code below. The result is always "We were killed to death". def main(): pid = os.fork() if not pid: prctl.set_seccomp(True) os.write(0, 'Hi\n') # os._exit(0) # _exit(0) # sys._exit(0) # return # ?!@#(*! What do? endpid, status = os.waitpid(pid, 0) print 'Child forked as %d and returned with %d' % (endpid, status) if

How can I restrict any system call made inside a docker container. If the given process makes a system call it will be blocked. Or how can I use seccomp with docker. You can see more at " Seccomp security profiles for Docker " (the eature is available only if the kernel is configured with CONFIG_SECCOMP enabled.) The supoprt for docker containers will be in docker 1.10: see issue 17142 allowing the Engine to accept a seccomp profile at container run time. In the future, we might want to ship builtin profiles, or bake profiles in the images. PR 17989 has been merged. It allows for passing a

Ηow to EXIT_SUCCESS after strict mode seccomp is set. Is it the correct practice, to call syscall(SYS_exit, EXIT_SUCCESS); at the end of main? #include <stdlib.h> #include <unistd.h> #include <sys/prctl.h> #include <linux/seccomp.h> #include <sys/syscall.h> int main(int argc, char **argv) { prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT); //return EXIT_SUCCESS; // does not work //_exit(EXIT_SUCCESS); // does not work // syscall(__NR_exit, EXIT_SUCCESS); // (EDIT) This works! Is this the ultimate answer and the right way to exit success from seccomp-ed programs? syscall(SYS_exit, EXIT_SUCCESS); //