This article is outdated. (May 2012)
seccomp (short for secure computing mode) is a simple but solid secure-computing facility ( sandboxing mechanism) for the Linux kernel. It was added to version 2.6.12 of the Linux kernel mainline on March 8, 2005. It allows a [1 ] process to make a one-way transition into a "secure" state where it cannot make any system calls except exit(), sigreturn(), read() and write() to already-open file descriptors. Should it attempt any other system calls, the kernel will terminate the process with SIGKILL. In this sense, it does not virtualize the system's resources but isolates the process from them entirely.
seccomp mode is enabled via the
system call using the prctl(2) PR_SET_SECCOMP argument, or with a seccomp system call . seccomp mode used to be enabled by writing to a file, [2 ] /proc/self/seccomp, but this method was removed in favor of prctl(). In some kernel versions, seccomp disables the [3 ] RDTSC x86 instruction. [4 ]
seccomp-bpf [ edit ]
seccomp-bpf is an extension to seccomp
that allows filtering of system calls using a configurable policy implemented using [5 ] Berkeley Packet Filter rules. It is used by OpenSSH and vsftpd as well as the Google Chrome/Chromium web browsers on Chrome OS and Linux. [6 ]
seccomp was first devised by
Andrea Arcangeli in January 2005 for use in public grid computing and was originally intended as a means of safely running untrusted compute-bound programs. Arcangeli's
CPUShare was the only known user of this feature. Writing in February 2009, [7 ] Linus Torvalds expresses doubt whether seccomp is actually used by anyone. However, a Google engineer replied that Google is exploring using seccomp for [8 ] sandboxing its Chrome web browser. [9 ] [10 ] As of Chrome version 20, seccomp-bpf is used to sandbox Adobe Flash Player.
[11 ] As of Chrome version 23, seccomp-bpf is used to sandbox the renderers.
Vsftpd uses seccomp-bpf sandboxing as of version 3.0.0. [13 ]
OpenSSH has supported seccomp-bpf since version 6.0. [14 ]
Mbox uses ptrace along with seccomp-bpf to create a secure sandbox with less overhead than ptrace alone. [15 ]
References [ edit ]
^ "[PATCH] seccomp: secure computing support". Linux kernel history. Kernel.org git repositories. 2005-03-08 . Retrieved 2013-08-02.
^ Arcangeli, Andrea (2007-06-14). "[PATCH 1 of 2] move seccomp from /proc to a prctl" . Retrieved 2013-08-02.
^ Tinnes, Julien (2009-05-28). "Time-stamp counter disabling oddities in the Linux kernel". cr0 blog . Retrieved 2013-08-02.
^ Corbet, Jonathan (2012-01-11). "Yet another new approach to seccomp". lwn . Retrieved 2013-08-02.
^ Tinnes, Julien (2012-11-19). "A safer playground for your Linux and Chrome OS renderers". The Chromium Blog . Retrieved 2013-08-02.
^ van de Ven, Arjan (2009-02-28). "Re: [stable] [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole". Linux Kernel Mailing List . Retrieved 2013-08-02.
^ Torvalds, Linus (2009-02-28). "Re: [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole". Linux Kernel Mailing List . Retrieved 2013-08-02.
^ Gutschke, Markus (2009-05-06). "Re: [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole" . Retrieved 2013-08-02.
^ Gutschke, Markus (2009-05-06). "Re: [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole". Linux Kernel Mailing List . Retrieved 2013-08-02.
^ Evans, Chris (2012-07-04). "Chrome 20 on Linux and Flash sandboxing" . Retrieved 2013-08-02.
^ Tinnes, Julien (2012-09-06). "Introducing Chrome's next-generation Linux sandbox". cr0 blog . Retrieved 2013-08-02.
^ Evans, Chris (2012-04-09). "vsftpd-3.0.0 and seccomp filter sandboxing is here!" . Retrieved 2013-08-02.
^ "Openssh 6.0 release notes" . Retrieved 2013-10-14.
^ "MBOX" . Retrieved 2014-05-20.
External links [ edit ]