Re: RFC: seccomp-bpf support

On 8/28/19 12:47 PM, David Fetter wrote:
> On Wed, Aug 28, 2019 at 11:13:27AM -0400, Joe Conway wrote:
>> SECCOMP ("SECure COMPuting with filters") is a Linux kernel syscall
>> filtering mechanism which allows reduction of the kernel attack surface
>> by preventing (or at least audit logging) normally unused syscalls.
>> 
>> Quoting from this link:
>> https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt
>> 
>>    "A large number of system calls are exposed to every userland process
>>     with many of them going unused for the entire lifetime of the
>>     process. As system calls change and mature, bugs are found and
>>     eradicated. A certain subset of userland applications benefit by
>>     having a reduced set of available system calls. The resulting set
>>     reduces the total kernel surface exposed to the application. System
>>     call filtering is meant for use with those applications."
>> 
>> Recent security best-practices recommend, and certain highly
>> security-conscious organizations are beginning to require, that SECCOMP
>> be used to the extent possible. The major web browsers, container
>> runtime engines, and systemd are all examples of software that already
>> support seccomp.
> 
> Neat!
> 
> Are the seccomp interfaces for other kernels arranged in a manner
> similar enough to have a unified interface in PostgreSQL, or is this
> more of a Linux-only feature?


As far as I know libseccomp is Linux specific, at least at the moment.

Joe
-- 
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development