Jesús 69035fc3de Added --seccomp to programs in firejail ...

seccomp (short for secure computing mode) is a computer security facility in the Linux kernel.
seccomp was first devised by Andrea Arcangeli in January 2005 for use in public grid computing
and was originally intended as a means of safely running untrusted compute-bound programs.
It was merged into the Linux kernel mainline in kernel version 2.6.12, which was released on
March 8, 2005. seccomp allows a process to make a one-way transition into a "secure" state
where it cannot make any system calls except exit(), sigreturn(), read() and write() to
already-open file descriptors. Should it attempt any other system calls, the kernel will
terminate the process with SIGKILL or SIGSYS. In this sense, it does not virtualize the
system's resources but isolates the process from them entirely.

2019-09-04 12:32:42 -05:00

14 KiB

Raw Blame History

View Raw