On Mon, Oct 05, 2015 at 08:23:05AM -0500, Michael Catanzaro wrote: > (Also fun is to try making the same list of filters work across > distros.) And across supported architectures. So far, I tested it only on x86_64 and i686 and there were quite a few differences. I would be surprised if it worked on arm even in the default configuration :). > So chrony might work perfectly now, but who knows how broken it will be > after a couple months of updates.... Well, you'll find out after > testing it in rawhide. Hope seccomp works better for you than it did > for me. Of course, for programs with few dependencies, there's not > really much problem. I guess glibc and getaddrinfo() will be the most problematic part in the chrony seccomp support. Is there a precedent in Fedora of a package using a seccomp filter and getaddrinfo() by default? If we can't enable it by default, I'll be ok with that. Currently I'm just interested in how it works for others. Another possibility is to add a new level to the chrony seccomp support that would use a blacklisting approach, disabling syscalls or their arguments that historically are most dangerous and we can be sure won't be ever needed. I hope that's not an empty set. -- Miroslav Lichvar -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
