On Mon, Jun 15, 2026 at 03:38:35PM -0700, Kees Cook wrote: > On Mon, Jun 15, 2026 at 05:23:53PM +0100, Jamie Hill-Daniel wrote: > > On Sat, Jun 13, 2026 at 5:14 AM Kees Cook <[email protected]> wrote: > > > On Tue, May 26, 2026 at 04:32:14PM +0100, Jamie Hill-Daniel wrote: > > > > Link: https://github.com/moby/moby/issues/42082 > > > > > > This doesn't show any particular application, just a demo program. > > > > > > I'd *really* prefer to only add complexity to seccomp if it is > > > absolutely needed. > > > > When I filed the original issue it was attempting a minimised > > reproduction; I was trying to run some legacy binary in a container > > that I unfortunately don't have the context for any more. > > I've submitted another series that should hopefully address some of > > the concerns raised here, including complexity. > > Right, I think I'd prefer the legacy binary be adjusted instead. And not > adding complexity to seccomp given the issue isn't actually a problem > any more. :)
And here's a wrapper, if there's no source for the binary: https://github.com/kees/kernel-tools/blob/trunk/seccomp/strict_launcher.c (This could probably be improved...) -Kees -- Kees Cook
