Disable custom seccomp profile - Githubissues

rimerosolutions / entrusted

Sanitize documents to safe PDFs, for active content removal

GNU General Public License v3.0

26 stars 0 forks source link

Disable custom seccomp profile #68

Closed yveszoundi closed 1 year ago

yveszoundi commented 1 year ago

Background

As software libraries and dependencies get upgraded, maintaining a custom seccomp profile has become a maintenance nightmare.

Generating a stripped (and working) seccomp profile is neither quick nor trivial
Sandbox container image upgrades are risky and often require regenerating the custom seccomp profile
- Changing the base OS from Debian to Alpine or another distribution is problematic
- Upgrading to a newer OS version of the Debian-based container image can lead to few hours or days of testing

Request

Disable custom seccomp profile, as minimizing required syscalls is both tedious and mistakes crash conversions.

Overall changes

[x] Remove the custom seccomp profile json file
[x] Disable custom seccomp profile checks
[x] Remove references to environment variables for enabling a custom seccomp profile