fosstodon.org is one of the many independent Mastodon servers you can use to participate in the fediverse.
Fosstodon is an invite only Mastodon instance that is open to those who are interested in technology; particularly free & open source software. If you wish to join, contact us for an invite.

Administered by:

Server stats:

8.8K
active users

#seccomp

1 post1 participant0 posts today
alip<p>Fellow <a href="https://mastodon.online/tags/Exherbo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Exherbo</span></a> developer Johannes Nixdorf submitted a patch to <a href="https://mastodon.online/tags/lkml" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>lkml</span></a> yesterday, fixing a nasty race condition in <a href="https://mastodon.online/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a>: <a href="https://lkml.org/lkml/2025/7/23/1174" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">lkml.org/lkml/2025/7/23/1174</span><span class="invisible"></span></a> <a href="https://mastodon.online/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://mastodon.online/tags/sydbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sydbox</span></a></p>
alip<p>Latest <a href="https://mastodon.online/tags/sydbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sydbox</span></a> will come with a novel use of <a href="https://mastodon.online/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a>: Using unused syscall arguments as random cookies. Read here for more information: <a href="https://man.exherbo.org/syd.7.html#Syscall_Argument_Cookies" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">man.exherbo.org/syd.7.html#Sys</span><span class="invisible">call_Argument_Cookies</span></a> <a href="https://mastodon.online/tags/exherbo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>exherbo</span></a> <a href="https://mastodon.online/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> <a href="https://mastodon.online/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a></p>
alip<p>News from <a href="https://mastodon.online/tags/sydbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sydbox</span></a>: when you configure syd-tor to use a <a href="https://mastodon.online/tags/UNIX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>UNIX</span></a> domain socket for external <a href="https://mastodon.online/tags/TOR" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TOR</span></a> connections which is a new feature it will open an O_PATH fd to the socket, enter into a network+mount+user+... namespace, chroot into /proc/self/fd and access the unix socket using the fd number. This means it will work even if you remove the socket. The socket is duplicated to a random fd to make fd reuse harder. We also apply mdwe, <a href="https://mastodon.online/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> and <a href="https://mastodon.online/tags/landlock" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>landlock</span></a> on top, read more here: <a href="https://man.exherbo.org/syd-tor.1.html#SECURITY" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">man.exherbo.org/syd-tor.1.html</span><span class="invisible">#SECURITY</span></a></p>
boredsquirrel<p><span class="h-card" translate="no"><a href="https://mastodon.social/@yoasif" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>yoasif</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@mozillaofficial" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>mozillaofficial</span></a></span> </p><p>Mind to explain why??</p><p>The <a href="https://tux.social/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> filter in <a href="https://tux.social/tags/flatpak" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>flatpak</span></a> blocks apps from creating user <a href="https://tux.social/tags/namespaces" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>namespaces</span></a>.</p><p><a href="https://tux.social/tags/Chromium" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Chromium</span></a> has a fork server and using <a href="https://tux.social/tags/zypak" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>zypak</span></a> at least works as a workaround.</p><p>Firefoxes (current, since a few years) solution is to just use no sandbox, only seccomp-bpf. Chromium doesnt even launch.</p><p><span class="h-card" translate="no"><a href="https://fosstodon.org/@ublue" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>ublue</span></a></span></p>
Habr<p>О механизмах безопасности OpenSSH: разбираем уязвимости 2024 года</p><p>Прошлый год интересно проходил для SSH. Весной — бэкдор в xz-utils (CVE-2024-3094), в результате эксплуатации которого были скомпрометированы системы с systemd. В июле — критически опасная уязвимость «состояния гонки» для систем на базе glibc, получившая название regreSSHion. Спустя еще неделю была опубликована схожая проблема, получившая идентификатор CVE- 2024- 6409. А в августе — еще одна, уже специфичная для FreeBSD, CVE-2024-7589. Как заявляют исследователи, успешная эксплуатация «состояний гонки» позволяет получить RCE (удаленное выполнение кода) на подверженных системах. Более того, regreSSHion — главный баг, ставящий под угрозу безопасность множества SSH-серверов с glibc. Интересно, что эксплуатация уязвимости не требует особой конфигурации сервера (проблема актуальна и для конфигурации по умолчанию). При этом публичного PoC нет до сих пор. Мы решили разобраться в вопросе: так ли страшны эти «состояния гонки», так ли критически опасны? И какие механизмы в sshd призваны не допустить эксплуатации этой уязвимости или хотя бы уменьшить ущерб в случае успешной атаки?</p><p><a href="https://habr.com/ru/companies/pt/articles/877102/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">habr.com/ru/companies/pt/artic</span><span class="invisible">les/877102/</span></a></p><p><a href="https://zhub.link/tags/openssh" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>openssh</span></a> <a href="https://zhub.link/tags/fsop" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>fsop</span></a> <a href="https://zhub.link/tags/glibc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>glibc</span></a> <a href="https://zhub.link/tags/rce" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>rce</span></a> <a href="https://zhub.link/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> <a href="https://zhub.link/tags/regression" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>regression</span></a> <a href="https://zhub.link/tags/%D1%81%D0%BE%D1%81%D1%82%D0%BE%D1%8F%D0%BD%D0%B8%D0%B5_%D0%B3%D0%BE%D0%BD%D0%BA%D0%B8" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>состояние_гонки</span></a> <a href="https://zhub.link/tags/freebsd" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>freebsd</span></a> <a href="https://zhub.link/tags/github" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>github</span></a> <a href="https://zhub.link/tags/malloc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malloc</span></a></p>
Paul Moore<p>I&#39;d like to announce two new libseccomp releases today: libseccomp v2.5.6 which is a minor maintenance release to the v2.5.z release stream, and libseccomp v2.6.0 which is a new feature release for libseccomp. More details in the link below, but libseccomp v2.6.0 adds support for new architectures, transactional filter updates, and more. Give it a try, you&#39;ll like it :)</p><p><a href="https://github.com/seccomp/libseccomp/releases/tag/v2.6.0" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="ellipsis">github.com/seccomp/libseccomp/</span><span class="invisible">releases/tag/v2.6.0</span></a></p><p><a href="https://fosstodon.org/tags/seccomp" class="mention hashtag" rel="tag">#<span>seccomp</span></a></p>
Habr<p>Изоляция процессов и минимизация привилегий: использование Linux namespaces и seccomp</p><p>По статистике, каждые 39 секунд в мире происходит кибератака. Задумайтесь об этом на мгновение. А теперь представьте, что процессы</p><p><a href="https://habr.com/ru/companies/selectel/articles/866942/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">habr.com/ru/companies/selectel</span><span class="invisible">/articles/866942/</span></a></p><p><a href="https://zhub.link/tags/selectel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>selectel</span></a> <a href="https://zhub.link/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> <a href="https://zhub.link/tags/linux_namespace" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux_namespace</span></a> <a href="https://zhub.link/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> <a href="https://zhub.link/tags/%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D1%8B" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>процессы</span></a> <a href="https://zhub.link/tags/%D0%B8%D0%B7%D0%BE%D0%BB%D1%8F%D1%86%D0%B8%D1%8F_%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%81%D0%BE%D0%B2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>изоляция_процессов</span></a> <a href="https://zhub.link/tags/%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%BD%D0%B0%D1%8F_%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>информационная_безопасность</span></a> <a href="https://zhub.link/tags/%D0%B8%D0%B1" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>иб</span></a></p>
HoldMyType<p>if <a href="https://mathstodon.xyz/tags/systemd" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>systemd</span></a> socket activation is not needed, then it uses <a href="https://mathstodon.xyz/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> only. When a bind system call is detected, the process is stopped and if the bind address matches a force-bind rule, then the process memory is altered to replace the address given to bind() with a replacement address.</p><p> It uses SECCOMP_RET_USER_NOTIF which is only available on recent kernels.</p><p> If systemd socket activation is needed, then it uses SECCOMP_IOCTL_NOTIF_ADDFD which is even newer.</p><p> if -p flag is specified, then it uses seccomp in combinaison with ptrace and when a bind() system call is detected, then the process is stopped and ptrace is used to alter the process. The system call registers are dumped and if the address bound matches a pattern:</p><p> either ptrace is used to replace the address with a replacement address, just like with seccomp, and the bind system call continues</p><p> if systemd socket activation is needed for that pattern, then the system call is replaced by the dup2() system call and the return value is altered to return 0 in case of success.<br><a href="https://github.com/mildred/force-bind-seccomp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/mildred/force-bind-</span><span class="invisible">seccomp</span></a></p>
Sascha<p>The <a href="https://m6n.io/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Kubernetes</span></a> website features a new <a href="https://m6n.io/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> reference documentation: </p><p><a href="https://k8s.io/docs/reference/node/seccomp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">k8s.io/docs/reference/node/sec</span><span class="invisible">comp</span></a></p><p>Goal of this reference is to explain the API basics of seccomp profiles in Kubernetes and how it maps to the lower level kernel bits. Enjoy! 😊</p>
Jan 💤<p>Linux experts… does someone know if there is a way in Landlock to apply rules dynamically, basically an equivalent to seccomp_unotify? Or something similar to allow and deny access dynamically.</p><p>Pls boost for reach 👉👈 really out of ideas here</p><p>(cringe hashtags, but hopefully more reach lol)<br><a href="https://hachyderm.io/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> <a href="https://hachyderm.io/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> <a href="https://hachyderm.io/tags/landlock" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>landlock</span></a> <a href="https://hachyderm.io/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://hachyderm.io/tags/sandbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sandbox</span></a></p>
Solène :flan_hacker:<p>Interesting research paper comparing <a href="https://bsd.network/tags/sandboxing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sandboxing</span></a> features found in <a href="https://bsd.network/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a>, <a href="https://bsd.network/tags/OpenBSD" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenBSD</span></a> and <a href="https://bsd.network/tags/FreeBSD" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FreeBSD</span></a>, respectively <a href="https://bsd.network/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a>, pledge/unveil and <a href="https://bsd.network/tags/Capsicum" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Capsicum</span></a></p><p><a href="https://arxiv.org/abs/2405.06447" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="">arxiv.org/abs/2405.06447</span><span class="invisible"></span></a> by Maysara Alhindi</p><p><span class="h-card"><a href="https://bsd.network/@op" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>op</span></a></span> you are mentioned there as gmid was studied :flan_smile: </p><p>via <span class="h-card"><a href="https://crispsandwi.ch/@goblin" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>goblin</span></a></span></p>
Peter Bui<p>After a few hours of debugging an issue with virtual backgrounds in the <a href="https://social.ndlug.org/tags/zoom" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>zoom</span></a> <a href="https://social.ndlug.org/tags/snap" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>snap</span></a> (frozen camera) I was able to put together a patch that:</p><p>1. Enables private shared memory (ie. /dev/shm/XXX)<br>2. Enables the use of posix message queue syscalls</p><p><a href="https://github.com/ogra1/zoom-snap/issues/128#issuecomment-2215316918" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/ogra1/zoom-snap/iss</span><span class="invisible">ues/128#issuecomment-2215316918</span></a></p><p>This is required b/c <a href="https://social.ndlug.org/tags/zoom" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>zoom</span></a> uses a helper process to perform the virtual background blurring and communicates via posix mqs.</p><p>Learned a bit about <a href="https://social.ndlug.org/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> and <a href="https://social.ndlug.org/tags/bpf" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bpf</span></a> from this trial today :}</p><p>Anyway, back to work...</p>
Pyrzout :vm:<p>Snowblind Abuses Android seccomp Sandbox To Bypass Security Mechanisms <a href="https://gbhackers.com/snowblind-android-seccomp-bypass/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">gbhackers.com/snowblind-androi</span><span class="invisible">d-seccomp-bypass/</span></a> <a href="https://social.skynetcloud.site/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CVE</span></a>/vulnerability <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurityNews</span></a> <a href="https://social.skynetcloud.site/tags/AndroidMalware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AndroidMalware</span></a> <a href="https://social.skynetcloud.site/tags/SecurityBypass" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityBypass</span></a> <a href="https://social.skynetcloud.site/tags/SystemCalls" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SystemCalls</span></a> <a href="https://social.skynetcloud.site/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Android</span></a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Malware</span></a> <a href="https://social.skynetcloud.site/tags/Seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Seccomp</span></a></p>
alip<p>Announcing <a href="https://mastodon.online/tags/sydbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sydbox</span></a> 3.22.0 with Proxy sandboxing! Introducing syd-tor, a secure SOCKS proxy forwarder, set to 127.0.0.1:9050 by default, perfect for <a href="https://mastodon.online/tags/Tor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tor</span></a>. Syd-tor features <a href="https://mastodon.online/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> filters and <a href="https://mastodon.online/tags/Landlock" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Landlock</span></a> (if available) for strict confinement, and offers full <a href="https://mastodon.online/tags/async" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>async</span></a> operations with edge-triggered epoll and zero-copy data transfer using splice. <a href="https://mastodon.online/tags/sydbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sydbox</span></a> is a rock-solid user-space <a href="https://mastodon.online/tags/kernel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>kernel</span></a> to <a href="https://mastodon.online/tags/sandbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sandbox</span></a> apps on <a href="https://mastodon.online/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> &gt;=5.19 written in <a href="https://mastodon.online/tags/rustlang" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>rustlang</span></a>: <a href="https://is.gd/w9LqZS" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">is.gd/w9LqZS</span><span class="invisible"></span></a></p>
Sam' 🐧<p><a href="https://mastodon.social/tags/Container" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Container</span></a> security fundamentals part 6: <a href="https://mastodon.social/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> <a href="https://securitylabs.datadoghq.com/articles/container-security-fundamentals-part-6/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">securitylabs.datadoghq.com/art</span><span class="invisible">icles/container-security-fundamentals-part-6/</span></a></p>
Sascha<p>I published a new blog post 📰</p><p>"CRI-O: Applying seccomp profiles from OCI registries"</p><p><a href="https://k8s.io/blog/2024/03/07/cri-o-seccomp-oci-artifacts" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">k8s.io/blog/2024/03/07/cri-o-s</span><span class="invisible">eccomp-oci-artifacts</span></a></p><p><a href="https://m6n.io/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> <a href="https://m6n.io/tags/oras" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>oras</span></a> <a href="https://m6n.io/tags/oci" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>oci</span></a> <a href="https://m6n.io/tags/crio" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>crio</span></a> <a href="https://m6n.io/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>kubernetes</span></a></p>
federico :debian:<p>Both <a href="https://oldbytes.space/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> and <a href="https://oldbytes.space/tags/landlock" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>landlock</span></a> are amazing security tools but IMHO we need a standard, friendly DSL to configure them.</p>
alip<p>syd-3.13.1 has been released: fixes readlink path issues, boosts stat sandboxing with readlink enhancements, updates MSRV to 1.71, secures /proc magiclinks against sandbox escapes, and strengthens container security with advanced resolution strategies. See <a href="https://man.exherbolinux.org" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">man.exherbolinux.org</span><span class="invisible"></span></a>. Want to test your hacking skills? Check out syd <a href="https://mastodon.online/tags/ctf" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ctf</span></a> at <a href="https://ctftime.org/event/2178" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">ctftime.org/event/2178</span><span class="invisible"></span></a> <a href="https://mastodon.online/tags/exherbo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>exherbo</span></a> <a href="https://mastodon.online/tags/gnu" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>gnu</span></a> <a href="https://mastodon.online/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> <a href="https://mastodon.online/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> <a href="https://mastodon.online/tags/landlock" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>landlock</span></a> <a href="https://mastodon.online/tags/container" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>container</span></a> <a href="https://mastodon.online/tags/rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>rust</span></a> <a href="https://mastodon.online/tags/rustlang" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>rustlang</span></a></p>
Thomas Strömberg<p>The data isn't fully populated yet, but bincapz can also tell you what syscalls you may need to run a binary in case you are a <a href="https://triangletoot.party/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> user, <a href="https://triangletoot.party/tags/OpenBSD" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenBSD</span></a> pledge groups, or <a href="https://triangletoot.party/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> capabilities. </p><p>The latter two will never be perfect though, as it depends on the arguments passed to the syscalls, but at least it'll give you an idea.</p>
alip<p>SydB☮x-3.11.1 has been released: new syd-run tool to run commands inside syd containers, hardening of sandbox process environment, and many minor fixes. syd-ldd - syd's secure alternative to ldd(1) - now uses the stricter 'immutable' profile rather than the 'container' profile ... see: <a href="https://sydbox.exherbolinux.org" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">sydbox.exherbolinux.org</span><span class="invisible"></span></a> <a href="https://mastodon.online/tags/sydbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sydbox</span></a> <a href="https://mastodon.online/tags/exherbo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>exherbo</span></a> <a href="https://mastodon.online/tags/gnu" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>gnu</span></a> <a href="https://mastodon.online/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> <a href="https://mastodon.online/tags/seccomp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seccomp</span></a> <a href="https://mastodon.online/tags/landlock" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>landlock</span></a> <a href="https://mastodon.online/tags/container" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>container</span></a> <a href="https://mastodon.online/tags/rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>rust</span></a> <a href="https://mastodon.online/tags/rustlang" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>rustlang</span></a></p>