On Mon, Oct 05, 2015 at 08:23:05AM -0500, Michael Catanzaro wrote:
(Also fun is to try making the same list of filters work across
distros.)
And across supported architectures. So far, I tested it only on x86_64
and i686 and there were quite a few differences. I would be surprised
if it worked on arm even in the default configuration :).
So chrony might work perfectly now, but who knows how broken it will
be
after a couple months of updates.... Well, you'll find out after
testing it in rawhide. Hope seccomp works better for you than it did
for me. Of course, for programs with few dependencies, there's not
really much problem.
I guess glibc and getaddrinfo() will be the most problematic part in
the chrony seccomp support. Is there a precedent in Fedora of a
package using a seccomp filter and getaddrinfo() by default?
If we can't enable it by default, I'll be ok with that. Currently I'm
just interested in how it works for others.
Another possibility is to add a new level to the chrony seccomp
support that would use a blacklisting approach, disabling syscalls or
their arguments that historically are most dangerous and we can be
sure won't be ever needed. I hope that's not an empty set.
--
Miroslav Lichvar