TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Linux Sandboxing with seccomp

1 post · Jul 2020 – Oct 2020

What this trail covers

Cloudflare is leveraging seccomp filters in Linux to implement granular security policies without requiring kernel module modifications or extensive configuration. This approach is being used to address specific security risks, such as preventing unprivileged users from escalating privileges via USER namespaces using the `unshare` syscall. The LSM BPF framework allows for dynamic policy enforcement at specific kernel hook points, offering a flexible and robust security mechanism.

All Cloudflare trails
  1. Diving into /proc/[pid]/memThis post details the implementation of the `/proc/[pid]/mem` file within gVisor, a Linux container runtime. This feature allows for the retrieval of debug symbols from stack traces within sandboxed processes, which was previously not possible due to the absence of this file in gVisor's virtual file system. The implementation involved understanding the Linux kernel's `proc_mem_open` and `mem_rw` operations, including access checks via `ptrace_may_access` and `mm_access`, and replicating this functionality within gVisor's Sentry component. The successful implementation provides readable stack traces in case of crashes.
  2. Sandboxing in Linux with zero lines of codeThis post details how to use Linux seccomp filters to sandbox applications without writing any code, by defining BPF programs that specify allowed system calls and the kernel's response to violations. It demonstrates this with a C program that restricts the `uname` system call, showing how to return specific error codes like EPERM or ENETDOWN upon violation.