Topic

Seccomp

1 post about Seccomp. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Posts

Heroku
Applying Seccomp Filters at Runtime for Go Binaries
Seccomp filters let a Linux process restrict its available system calls, reducing the process attack surface beyond the Dyno’s existing restrictions. This tutorial builds a Go binary that creates /tmp/moo, uses strace -c to identify its runtime syscalls, and configures a whitelist with libseccomp-golang. The filter starts with libseccomp.ActErrno returning EPERM for unlisted calls, then adds ActAllow rules for named calls before loading the filter at runtime; the example also checks kernel support and installs libseccomp-dev. With the listed calls enabled, the program creates the folder successfully, while a later syscall.Exec attempt to run ls -l cannot perform unlisted ioctl, getdents, and statfs operations and reports “Operation not permitted.” The post then describes deploying the dependency with Govendor or Godeps on Heroku.

The best engineering reads, once a week.

Topic

1 post about Seccomp. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Heroku
Applying Seccomp Filters at Runtime for Go Binaries
Seccomp filters let a Linux process restrict its available system calls, reducing the process attack surface beyond the Dyno’s existing restrictions. This tutorial builds a Go binary that creates /tmp/moo, uses strace -c to identify its runtime syscalls, and configures a whitelist with libseccomp-golang. The filter starts with libseccomp.ActErrno returning EPERM for unlisted calls, then adds ActAllow rules for named calls before loading the filter at runtime; the example also checks kernel support and installs libseccomp-dev. With the listed calls enabled, the program creates the folder successfully, while a later syscall.Exec attempt to run ls -l cannot perform unlisted ioctl, getdents, and statfs operations and reports “Operation not permitted.” The post then describes deploying the dependency with Govendor or Godeps on Heroku.

The best engineering reads, once a week.