search

seccomp / libseccomp

The main libseccomp repository
GNU Lesser General Public License v2.1
810 stars 173 forks source link

Q: using seccomp system-wide #349

Closed rdwnali closed 3 years ago

rdwnali commented 3 years ago

Hi. I have a question about seccomp. can we use seccomp as system-wide and trace all processes on system? As far as I know, it can only be used with forking main process and exec certain process to trace or be restricted. how can we use this for all processes? thank you.

pcmoore commented 3 years ago

Hi @rdwnali, as seccomp filters are inherited across fork(2), seccomp filters installed when a process forks a child process will be inherited by the children. Likely the easiest way to apply a set of seccomp filters to an entire system would be to integrate the seccomp filters with the init system.