Skip to content

Remove SYS_futex, SYS_write, SYS_close, and SYS_mmap from list of default allowed syscalls for seccomp on Linux #183

@danbugs

Description

@danbugs

Currently, we allow SYS_futex, SYS_write, SYS_close, and SYS_mmap (

(libc::SYS_futex, vec![]),
) by default beause they are needed by some writer functions we have. Writer functions are not registered like normal host functions. Instead, they are passed in as a parameter to UninitializedSandbox::new (
host_print_writer: Option<&dyn HostFunction1<String, i32>>,
) and, so, allowing extra syscalls to it is a bit cumbersome. We should consider refactoring UninitializedSandbox::new to leverage a builder pattern.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/securityInvolves security-related changes or fixeslifecycle/confirmedBug is verified or proposal seems reasonable

    Projects

    Status

    No status

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions