Hi, all
We're using seccomp to increase container security, but bpf rules filter causes performance to deteriorate. So, is there a good solution to improve performance, or can we add a simplified seccomp mode to improve performance?
// Pseudo code
int __secure_computing(int this_syscall)
{
...
switch (mode) {
case SECCOMP_MODE_STRICT:
...
case SECCOMP_MODE_FILTER:
...
case SECCOMP_MODE_LIGHT_FILTER:
//do light syscall filter.
...
break;
}
...
}
int light_syscall_filter(int syscall_num) {
if(scno > SYSNUM_MAX) {
...
return -EACCESS;
}
bool *filter_map = get_filter_map(current);
if(filter_map == NULL) {
...
return -EFAULT;
}
if(filter_map[syscall_num] == true) {
...
return 0;
} else {
...
return -EACCESS;
}
...
}
