woj/woj-sandbox
1
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

重新设计沙箱机制 #1

New Issue
Closed
opened 2023-12-28 01:11:33 +08:00 by Paul · 1 comment
Paul commented 2023-12-28 01:11:33 +08:00
Owner
Copy Link

最早设计时 seccomp 采用白名单机制，只允许执行几个经过挑选的系统调用，对于 Go 在内的语言不友好

可能的方式：

  1. 针对 open 有限制性的约束
  2. 转换为黑名单机制，屏蔽危险的系统调用
最早设计时 `seccomp` 采用白名单机制，只允许执行几个经过挑选的系统调用，对于 `Go` 在内的语言不友好 可能的方式： 1. 针对 `open` 有限制性的约束 2. 转换为黑名单机制，屏蔽危险的系统调用
Paul changed title from 考虑使用黑名单机制 to 重新设计沙箱机制 2023-12-31 14:29:31 +08:00
Paul commented 2024-01-01 21:42:57 +08:00
Author
Owner
Copy Link
  • 针对 open 有限制性的约束: ae91f2c3f5
  • 黑名单机制暂不考虑
- [x] 针对 `open` 有限制性的约束: ae91f2c3f5 - [x] 黑名单机制暂不考虑
Paul closed this issue 2024-01-01 21:42:57 +08:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: woj/woj-sandbox#1
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?