Seccomp denylist bypass via 32-bit argument truncation
Ricardo Branco says containerd, Podman, systemd and QEMU denylists can misread 32-bit arguments in 64-bit registers.
Stories per day · 30 days
2 RSS
2 stories, newest first · one card per story
Stories tagged #seccomp
Software sandboxing: The basics (2025)
A technical write-up presents composable seccomp-BPF syscall allowlist policies for sandboxing unprivileged Linux applications, inspired by Docker, systemd, and OpenBSD pledge.