9 Commits

Author	SHA1	Message	Date
Tyler Hicks	37dba02bde	Ensure that each seccomp filter line is entirely read	2015-04-21 19:44:52 -05:00
Michael Vogt	3ab38515fc	src/seccomp.c: clarify why its ok to ignore syscall_nr == __NR_SCMP_ERROR errors	2015-04-21 17:39:38 +02:00
Michael Vogt	01a04e4c6c	drop PR_SET_NO_NEW_PRIVS as it will break anything that needs to do a apparmor profile transition (like docker)	2015-04-21 09:27:41 +02:00
Michael Vogt	65906c01ec	add debug	2015-04-18 13:25:14 +02:00
Michael Vogt	f18127f9fd	* fallback to seccomp_rule_add() if seccomp_rule_add_exact() fails ... * call prctl(PR_SET_NO_NEW_PRIVS, 1)	2015-03-31 17:53:05 +02:00
Michael Vogt	7e2830625e	ignore syscalls unavailable on the given kenerl/arch	2015-03-24 18:10:40 +01:00
Michael Vogt	69a64d449c	cleanup, add tests	2015-03-24 09:37:45 +01:00
Michael Vogt	390e1db3fb	add README, comments in the filter file and @unrestricted keyword	2015-03-24 08:48:15 +01:00
Michael Vogt	7ee289401f	add very crude seccomp support to the launcher	2015-03-20 11:13:53 +01:00