Documentation
¶
Overview ¶
Package seccomp installs the syscall restrictions used by the privileged rshell worker.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrUnsupported = errors.New("seccomp is not supported on this platform")
ErrUnsupported is returned when syscall filtering is unavailable on the current operating system.
Functions ¶
func DefaultDenylist ¶
func DefaultDenylist() []string
DefaultDenylist returns a copy of the reviewed privileged-worker denylist. Callers may safely modify the returned slice.
func Restrict ¶
Restrict installs a default-allow seccomp filter that returns EPERM for the named syscalls. clone is the one exception: it returns EPERM unless its flags exactly match the Go runtime's thread-creation flags. The filter is synchronized to every existing thread and sets no_new_privs before it is loaded.
A syscall that exists on a supported architecture but not on the current one is ignored because it cannot be invoked with the current ABI. Unknown names and duplicate entries are rejected instead of silently weakening the policy.
func RestrictDefault ¶
func RestrictDefault() error
RestrictDefault installs the reviewed privileged-worker denylist.
Types ¶
This section is empty.
Source Files