Re:Let's enable AppArmor by default (why not?)
by ris on Thursday October 12, 2017 @01:32PM
(#15459644)
It is flexible to an extent, but you still can't e.g. deference a pointer to a struct passed as an argument. And that's where much of the interesting detail is for many calls.
[ Parent
| on HN ]
Re:Let's enable AppArmor by default (why not?)
by language on Thursday October 12, 2017 @04:40PM
(#15461143)
Thanks for the clarification, although I recall messing with eBPF and kprobes before - pretty sure you can dereference pointers?
editx2: Oh, guess seccomp doesn't use eBPF yet? Suppose that raises a bunch of questions about permissions necessary for specifying programs that might dereference kernel pointers and such by emitting `bpf()` calls.