Blogs›Cloudflare›Linux Sandboxing with seccomp
Cloudflare is exploring and implementing advanced sandboxing techniques in Linux, focusing on seccomp filters to restrict system call access for applications. This involves defining BPF programs to enforce policies, such as preventing network access for non-networked applications, and understanding the various penalty actions the kernel can take upon policy violation. The goal is to enhance security by isolating applications and preventing arbitrary code execution exploits without requiring code modifications.
7/8/2020
This post introduces Linux seccomp as a mechanism for sandboxing applications without writing code. It explains system calls, the seccomp filter mechanism using BPF programs, and demonstrates how to restrict specific system calls like 'uname' by returning error codes or terminating the process. The post also covers the importance of `PR_SET_NO_NEW_PRIVS` and different seccomp actions.