search

seccomp / libseccomp

The main libseccomp repository
GNU Lesser General Public License v2.1
805 stars 171 forks source link

Q: modify seccomp filter for a running process #359

Closed norway5354 closed 2 years ago

norway5354 commented 2 years ago

If a process with seccomp filter is already running in memory. Can I modify the seccomp filter of this process remotely by programming? This may involve process injection.Thank you!

pcmoore commented 2 years ago

Hi @norway5354.

No, once a seccomp filter is loaded into the kernel it can not be modified. However, it is possible to load additional seccomp filters into the kernel for a given process assuming that the seccomp loading mechanisms, e.g. seccomp(2) or prctl(2), have not been blocked by any of the existing seccomp filters.

When multiple seccomp filters are loaded into the kernel each filter is evaluated on every syscall invocation and the "most restrictive" filter result is the action taken by the kernel, for example a KILL action is taken over an ALLOW action.

norway5354 commented 2 years ago

OK, thank you for your reply!

pcmoore commented 2 years ago

Your welcome @norway5354, if you have any more questions feel free to enter new issues. Thanks!