Q: dereferencing syscall arguments about libseccomp HOT 3 CLOSED

In the example above, the filter for the read() syscall is simply examining the pointer as a scalar value, it isn't dereferencing the pointer.

from libseccomp.

Thanks for explaining.

The question still remaining is whether filtering for specific files like in the example is reliable/secure to build sandboxes.

from libseccomp.

That question is beyond the scope of libseccomp. The libseccomp project provides a easy to use interface to the seccomp-bpf mechanism inside the Linux kernel, it is up to the individual application developers to make use of this functionality.

from libseccomp.