search

valoq / bwscripts

Bubblewrap example scripts
GNU Lesser General Public License v2.1
53 stars 3 forks source link

The exportFilter.c seccomp filter doesn't work. #1

Closed madaidan closed 4 years ago

madaidan commented 5 years ago

Hi,

I would love to be able to use seccomp with bubblewrap but I have no experience in creating seccomp filters so your filter template looked great for me.

When I compile it with gcc exportFilter.c -lseccomp -o exportFilter and create a sandbox with it by running bwrap --dev-bind / / --seccomp 10 10< exportFilter bash, I get an error from bubblewrap that says,

bwrap: prctl(PR_SET_SECCOMP): Invalid argument

It then quits and doesn't create the sandbox. Using your precompiled seccomp filter works but I would like to create my own.

Is there something wrong with the way I did it or is there an error in the filter?

valoq commented 4 years ago

exportFilter.c does not create the seccomp filter directly. It creates a small binary that can be executed to create the filter list. The list can then be found at /tmp/seccomp_filter.bpf

madaidan commented 4 years ago

Ah, thanks! Now it works.

chriscroome commented 2 years ago

I thought I'd try to also generate my own seccomp_filter.bpf file, this is as far as I have got (on Debian bookworm):

sudo apt install libseccomp-dev # to provide seccomp.h
git clone https://github.com/valoq/bwscripts.git
cd bwscripts
gcc exportFilter.c -lseccomp -o exportFilter
./exportFilter

This results in the exportFilter binary but running it doesn't create a /tmp/seccomp_filter.bpf file -- I'm clearly missing something fundamental here?

valoq commented 1 year ago

The current version will create the seccomp_filter.bpf file in your working directory instead.