seccomp-bpf

Google created seccomp-bpf which is crucial to a meaningful sandbox and has no equivalent on other platforms.

Chromium has a working sandbox with or without seccomp-bpf based on a chroot, namespaces and IPC protocols.

How you'd do that with seccomp-bpf with forked child processes etc would be vastly more complex.

Is anyone aware of an interface to seccomp-bpf on Linux that is as easy to use as this tame() syscall?

For instance, a direct comparison to either seatbelt or seccomp-bpf would make it clear that the distinction between initialization vs.

Mechanisms such as seccomp-bpf offer a really convenient and high-performance way to pull it off.

And indeed, Chrome is by far the application using seccomp-bpf in the most advanced way.

I agree with sandboxing, but a problem is that by using something like seccomp-bpf, you're turning highly portable C code into a highly platform-specific and even architecture-specific system.

Google devs brought seccomp-bpf to the kernel, which is a simpler alternative (but also not always as useable) to many other mechanisms.

What would you want to do with seccomp-bpf that can't be expressed with BPF?

You might well be able to implement tame() entirely in userspace using seccomp-bpf.

What we really need is user-friendly libraries to make using seccomp-bpf as easy as using tame()!