Packages

alcove

0.40.0
1.0.1 1.0.0 0.40.6 0.40.5 0.40.4 0.40.3 0.40.2 0.40.1 retired 0.40.0 0.39.1 0.38.0 0.37.0 0.36.0 0.35.0 0.34.0 0.33.1 0.33.0 0.31.0 0.30.0 0.29.0 0.28.0 0.27.1 0.27.0 0.26.2 0.26.1 0.26.0 0.25.0 0.23.0 0.22.3 0.22.2

Control plane for Unix processes, containers and sandboxes

HexDocs

Current section

Files

Jump to
Readme
30 Versions
0 Dependencies
Dependants
Files
Activity
alcove edoc seccomp-5.edoc
Raw

edoc/seccomp-5.edoc 

@doc seccomp(2): restrict system operations



Also see prctl/7.



== Support ==



• Linux



== Examples ==



To enforce a seccomp filter:



```

% NOTE: this filter will cause the port to receive a SIGSYS

% See test/alcove_seccomp_tests.erl for all the syscalls

% required for the port process to run



Arch = alcove:define(Drv, [], alcove:audit_arch()),

Filter = [

    ?VALIDATE_ARCHITECTURE(Arch),

    ?EXAMINE_SYSCALL,

    sys_read,

    sys_write

],



{ok,_,_,_,_,_} = alcove:prctl(Drv, [], pr_set_no_new_privs, 1, 0, 0, 0),

Pad = (erlang:system_info({wordsize,external}) - 2) * 8,



Prog = [

    <<(iolist_size(Filter) div 8):2/native-unsigned-integer-unit:8>>,

    <<0:Pad>>,

    {ptr, list_to_binary(Filter)}

],

alcove:seccomp(Drv, [], seccomp_set_mode_filter, 0, Prog).

'''