Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Linux have seccomp feature which be used to filter syscalls according to a special program.

There is even dropper.c demo that allows to start programs with one syscall returning the given error.

Is there already implemented by somebody any non-demo, more usable seccomp wrapper that allow me to execute a program with a whitelist of syscalls? Expecting something like this:

# limit_syscalls  access brk close connect dup \
      execve exit_group fcntl64 fstat64 getsockname \
      getuid32 mmap2 mprotect munmap open read set_thread_area \
      setuid32 socket write -- /bin/ping 127.0.0.1
share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Implemented myself using libseccomp.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.