Switch Seccomp back on - Githubissues

ghost commented 10 years ago

Resolve cjdelisle/cjdns#529 first. See 957d1d2c5fe4ea6a9083a829a8a5a5d17130f88a.

dangowrt commented 9 years ago

From what I can see seccomp works great on the MIPS and ARM systems I tested. Is this issue still existing in current builds?

wfleurant commented 9 years ago

good question. I usually enable seccomp, found this over the weekend (i think its IPTunnel related):

Wed Apr 15 01:32:57 2015 user.notice cjdns: Attempted banned syscall number [8] see doc/Seccomp.md for more information

note: I usually am testing against cjdns/crashey or hyperboria/next (~10 commits ahead of seattlemeshnet/meshbox)

Perhaps new cjdroute config time feature for seccomp is overruling this issue?

        // Seccomp is the most advanced sandboxing feature in cjdns, it uses
        // SECCOMP_BPF to filter the system calls which cjdns is able to make on a
        // linux system, strictly limiting it's access to the outside world
        // This will fail quietly on any non-linux system
        // Default: enabled
        { "seccomp": 1 },

wfleurant commented 9 years ago

@lgierth Is this the related issue: https://github.com/hyperboria/cjdns/issues/6

SeattleMeshnet / meshbox

Switch Seccomp back on #9