Home / server / Questions / 556514
Accepted
Michael Neale
Asked: 2013-11-22 04:41:51 +0800 CST

how do I enable seccomp with lxc

  • 772

I can see in the lxc repo README there is a trivial example:

lxc.seccomp = /var/lib/lxc/q1/seccomp.full

whith some commands to fill up a file with a whitelist which (it is claimed) allows everything.

Is there any documentation of what you can do with that seccomp config (specifically with LXC in this case). There seems to be no visible documentation on seccomp and LXC that I can find.

linux

1 Answers

  1. Best Answer

    Looking at the config parser source it appears that lxc only supports a whitelist of permitted syscall numbers. Seccomp supports validating the parameters to syscalls, but the config format doesn't provide any way to express that.

    Syscalls: http://docs.cs.up.ac.za/programming/asm/derick_tut/syscalls.html

    • 2