Enable Secure Computing Mode #47
Description
Following the implementation of #43 to properly ensure uid/gid privileges dropping and chroot of Tor2web, this ticket is to further improve the security of the daemon by enabling Linux's Secure Computing Mode.
Secure Computing Mode
Linux Kernel introduced Secure Computing Mode.
After the secure computing mode has been set to True, the only system calls that the thread is permitted to make are read(), write(), _exit(), and sigreturn(). Other system calls result in the delivery of a SIGKILL signal.
It is implemented by prctl.set_seccomp(mode) with package PRCTL available on http://packages.python.org/python-prctl/
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.