19 ms·
> Note that seccomp has limited visibility into recvmsg / sendmsg args because bpf can't dereference syscall arg pointers. I guess landlock can't help you here
by tych0 4y ago
> Note that seccomp has limited visibility into recvmsg / sendmsg args because bpf can't dereference syscall arg pointers.
I guess landlock can't help you here since it is still mostly about filesystem access right now, but maybe someday? It looks like "minimal network access control" is on the long term roadmap: https://landlock.io/ https://landlock.io/
- l0kod 4y agoThere is an ongoing work to support network access-control: https://lore.kernel.org/all/20220621082313.3330667-1-konstantin.meskhidze@huawei.com/ https://lore.kernel.org/all/20220621082313.3330667-1-konstan...