Consider adding optional pre-configure seccomp filters
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- c, linux
- Domain
- operating-systems, security
Research direction
Start with SECURITY.md and compare the seccomp rules used by Flatpak and other consumers. Build the requested table of rules and when they are needed, then use it to assess possible optional pre-configured filter sets. The issue names no source files or tests, so the implementation and completion criteria remain open.
Written by the indexing model from the issue text.
Description
SECURITY.md clarifies that it is not the task of bwrap to enure that a real security barrier is created.
However, as I understand it, there is a list of seccomp rules that are fundamental to ensuring that bwrap can function as a sandbox at all. For example: unshare, setns, or mount.
I originally wasn't in favor of adding this to bwrap, and thought we could put it into a library that uses bwrap. But now I think if we can find a good set or good multiple sets, we should add them.
The issue currently is that there are too many consumers that have to create seccomp rules for this themselves, and this is very prone to errors.
First step would be to have a table which lists what seccomp rules are needed and when. Sadly, even Flatpak etc don't properly document their seccomp rules.
- Dominant language
- C
- Stars
- 8.8k
- Forks
- 387
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 13
Getting set up
We have not checked this project's setup files yet. Start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from containers/bubblewrap
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
containers/bubblewrap#767 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
containers/bubblewrap#743 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
containers/bubblewrap#298 · 4 comments · 5 reactions ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 45/100
containers/bubblewrap#808 · 4 comments ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 40/100
containers/bubblewrap#804 ·
Maintainers usually reply within 1 day
All issues in containers/bubblewrap
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
BasedHardware/omi#19711 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
microsoft/ebpf-for-windows#5604 ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
trezor/trezor-firmware#7985 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 2 days