Testing chrony seccomp support

Miroslav Lichvar mlichvar at redhat.com
Mon Oct 5 15:27:54 UTC 2015


On Mon, Oct 05, 2015 at 08:23:05AM -0500, Michael Catanzaro wrote:
> (Also fun is to try making the same list of filters work across
> distros.)

And across supported architectures. So far, I tested it only on x86_64
and i686 and there were quite a few differences. I would be surprised
if it worked on arm even in the default configuration :).

> So chrony might work perfectly now, but who knows how broken it will be
> after a couple months of updates.... Well, you'll find out after
> testing it in rawhide. Hope seccomp works better for you than it did
> for me. Of course, for programs with few dependencies, there's not
> really much problem.

I guess glibc and getaddrinfo() will be the most problematic part in
the chrony seccomp support. Is there a precedent in Fedora of a
package using a seccomp filter and getaddrinfo() by default?

If we can't enable it by default, I'll be ok with that. Currently I'm
just interested in how it works for others.

Another possibility is to add a new level to the chrony seccomp
support that would use a blacklisting approach, disabling syscalls or
their arguments that historically are most dangerous and we can be
sure won't be ever needed. I hope that's not an empty set.

-- 
Miroslav Lichvar


More information about the devel mailing list