A seccomp overview
A seccomp overview
Posted Sep 9, 2015 10:44 UTC (Wed) by nix (subscriber, #2304)In reply to: A seccomp overview by kjp
Parent article: A seccomp overview
It would be great if the article estimated the LOC of filter code vs the LOC of "surface" it is trying to protectSince this is protecting other processes from buggy userspace code, which can be any length, that's impossible.
(The disparity can be enormous -- e.g. perhaps the first thing ever sandboxed with seccomp was the Chromium renderer process: *part* of that is WebKit (now Blink) which takes about an hour just to compile...)