News for hackers. Stuff that matters.

A comment on Open-sourcing gVisor, a sandboxed container runtime. Parent comment

Re:Open-sourcing gVisor, a sandboxed container runtime by jagger11 on Wednesday May 02, 2018 @11:05AM (#16977572)
Also, if you don't trust it, just set everything to SECCOMP_RET_TRACE, which kills the process if there is no ptracer

A small correction, it causes for the syscall not to be executed, and return with errno==ENOSYS

[ Parent | on HN ]
Re:Open-sourcing gVisor, a sandboxed container runtime by geofft on Wednesday May 02, 2018 @11:36AM (#16977950)
Oh, thanks. (It's still safe, because the inability to execute system calls basically translates into an inability to do anything the process was not previously authorized to do via... mmapped memory, and I think that's it.)
[ Parent | on HN ]