Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Linux have seccomp feature which be used to filter syscalls according to a special program.

There is even dropper.c demo that allows to start programs with one syscall returning the given error.

Is there already implemented by somebody any non-demo, more usable seccomp wrapper that allow me to execute a program with a whitelist of syscalls? Expecting something like this:

# limit_syscalls  access brk close connect dup \
      execve exit_group fcntl64 fstat64 getsockname \
      getuid32 mmap2 mprotect munmap open read set_thread_area \
      setuid32 socket write -- /bin/ping 127.0.0.1
share|improve this question
up vote 1 down vote accepted

Implemented myself using libseccomp.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .