Add command line option for system call restrictions#191
Open
gkreitz wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Seccomp syscall filtering was recently added, and it's a nice feature. Some of the system call restrictions do need to be lifted in certain scenarios (e.g., some compilers lock files, and this require 4 not to be set, the PL/I toolchain is 32-bit, so it requires 16 not to be set (thanks for adding that setting, turned out to be useful! :)).
Currently,
syscall_flagsare globally configured for an isolate installation in the config file. This PR makes it so that they can be given as a command-line option when starting an isolate run. This allows us to only permit dangerous system calls more dynamically. For instance, I'm less worried about file locks during compilation than during a run. And similarly, while we need to support an esoteric language with a 32-bit compiler, I prefer not allowing 32-bit binaries in all my sandboxes.I initially wrote this as a feature request issue, but figured that the patch was so small and simple, I may as well just turn the feature request into a PR. Obviously, feel free to just close if I got the style wrong/this is a bad idea/you prefer to build it yourself. I struggled a bit with naming the option to not make
isolate --helpugly,--syscall-flags=<flags>would feel more natural, but is too long.