[B! seccomp] udzuraã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

udzura id:udzura

seccompã«é–¢ã™ã‚‹udzuraã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (9)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

seccompã¨gdbã¯ä¸¡ç«‹ã—ãªã„ : é©å‘½ã®æ—¥ã€… ãã®ï¼’
ptraceã‚’ç„¡åŠ¹åŒ–ã—ã¦ãªã„ã¨ã€PTRACE_O_SUSPEND_SECCOMP ã§è‡ªç”±ã«seccompã‚’ç„¡åŠ¹åŒ–ã§ãã¦ã—ã¾ã†ã€‚ ãªã©ã¨æ›¸ã„ã¦ã‚ã‚‹æ–‡çŒ®ã‚’è¦‹ã¤ã‘ãŸã®ã§ã¡ã‚‡ã£ã¨èª¿æŸ» ãªãŠã€ã“ã®ã‚³ãƒŸãƒƒãƒˆã ã£ãŸæ¨¡æ§˜ commit 13c4a90119d28cfcb6b5bdd820c233b86c2b0237Author: Tycho Andersen <[email protected]>Date: Â Sat Jun 13 09:02:48 2015 -0600 seccomp: add ptrace options for suspend/resume This patch is the first step in enabling checkpoint/restore of processesÂ Â with seccomp enabled. One of the th
udzura 2018/07/30
ã‚“ã€ã“ã®å•é¡Œã¯...

seccomp
ãƒªãƒ³ã‚¯
ã‚³ãƒ³ãƒ†ãƒŠã‚’ã€Œå®ˆã‚‹ã€ä»•çµ„ã¿ã‹ã‚‰ä¸èº«ã‚’ç†è§£ã—ã‚ˆã†!!1; /how-to-be-a-container
@YAPC::Fukuoka 2017
udzura 2017/07/01
ä»Šæ—¥ã®è³‡æ–™ã‚ã’ã¾ã—ãŸ #yapcjapan

container

apparmor

seccomp

yapcasia
ãƒªãƒ³ã‚¯
mrubyã¨seccompã¨ptraceã§ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã‚’ã¨ã«ã‹ãè¿½ã„ã‹ã‘ã‚‹ - ãƒãƒ¼ãƒ•ã‚¡ã‚¤æ—¥è¨˜
ä¸–ã®ä¸ã«ã¯seccompã¨ã„ã†ã‚‚ã®ãŒã‚ã‚Šã€çŸ¥ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚çš†ã•ã‚“ã¯BPFã§ã™ã‹ã€‚äººã¯ã€ã€ã€ seccompã«ã¤ã„ã¦ã¯ä»¥å‰æ›¸ãã¾ã—ãŸã€‚Linuxã®ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«å‘¼ã³å‡ºã—ã‚’ãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ã—ã¦è¨±å¯ã—ãŸã‚Šç¦æ¢ã—ãŸã‚Šã™ã‚‹ã‚‚ã®ã§ã™ã€‚ udzura.hatena blog.jp ã•ã¦ä»Šå›žã€æ‹™ä½œ mruby-seccomp ã§ SCMP_ACT_TRACE ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã‚’ã‚µãƒãƒ¼ãƒˆã—ã¾ã—ãŸã€‚ãã®è¾ºã®è©±ã‚’ã—ã¦ã¿ã¾ã™ã€‚ libseccompã®ã‚³ãƒ³ãƒ†ã‚¯ã‚¹ãƒˆã« SCMP_ACT_TRACE ã®ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã‚’è¿½åŠ ã—ã¦ãƒãƒ¼ãƒ‰ã™ã‚‹ã¨ã€å½“è©²ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã®å‘¼ã³å‡ºã—ã‚’ ptrace(2) ã§ãƒˆãƒ¬ãƒ¼ã‚¹ã§ãã¾ã™ã€‚ ptrace(2) ã¯æ™®é€šã€ã‚ã‚‰ã‚†ã‚‹ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã‚’ SIGTRAP ã§æ¢ã‚ã‚‹ã¿ãŸã„ãªå‹•ãã‚’ã—ã¾ã™ãŒã€ç‰¹å®šã®ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã®ã¿ã‚’åœæ¢ã§ãã€ã¾ãŸã‚·ã‚°ãƒŠãƒ«ã‚‚ SIGTRAP ã§ã¯ãªãåˆ¥ã®ã‚‚ã®ã¨ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ ptrace(
udzura 2017/04/24
ãªã‚“ã‹å®¶å¸°ã£ã¦å†·é™ã«ãªã‚‹ã¨ã€ãªã‚“ã§ãƒ‘ãƒ«æ–‡ä½“ã£ã½ã„ã‚“ã ã‚

mruby

seccomp
ãƒªãƒ³ã‚¯
Firejail - ArchWiki
è¦å‘Š: ã‚¢ãƒƒãƒ—ã‚¹ãƒˆãƒªãƒ¼ãƒ ã§ã¯å¾ã€…ã«ãƒ›ãƒ¯ã‚¤ãƒˆãƒªã‚¹ãƒˆåˆ¶ãŒæŽ¡ç”¨ã•ã‚Œã¤ã¤ã‚ã‚Šã¾ã™ãŒ(/etc/firejail/firefox.profile ã‚’å‚ç…§)ã€æä¾›ã•ã‚Œã¦ã„ã‚‹ãƒ—ãƒãƒ•ã‚¡ã‚¤ãƒ«ã®æ®†ã©ãŒã¾ã ãƒ–ãƒ©ãƒƒã‚¯ãƒªã‚¹ãƒˆåˆ¶ã«å¼·ãä¾å˜ã—ã¦ã„ã¾ã™ã€‚ã“ã‚Œã¯ã€ãƒ—ãƒãƒ•ã‚¡ã‚¤ãƒ«ã«ã‚ˆã£ã¦æ˜Žç¤ºçš„ã«ç¦æ¢ã•ã‚Œã¦ã„ãªã‘ã‚Œã°ã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã‚¢ã‚¯ã‚»ã‚¹ã‚’è¨±ã—ã¦ã—ã¾ã†ã“ã¨ã‚’æ„å‘³ã—ã¾ã™ã€‚ä¾‹ãˆã°ã€btrfs ã®ã‚¹ãƒŠãƒƒãƒ—ã‚·ãƒ§ãƒƒãƒˆã‚’ /mnt/btrfs ã«ä¿å˜ã—ã¦ã„ã‚‹ã¨ã—ã¾ã™ã€‚éš”é›¢ã•ã‚ŒãŸãƒ—ãƒã‚°ãƒ©ãƒ ã¯ $HOME/.ssh ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã¯ç¦ã˜ã‚‰ã‚Œã¦ã„ã‚‹ã§ã—ã‚‡ã†ãŒã€/mnt/btrfs/@some-snapshot/$HOME/.ssh ã¸ã¯ã‚¢ã‚¯ã‚»ã‚¹ã§ãã¦ã—ã¾ã„ã¾ã™ã€‚ä½¿ç”¨ã™ã‚‹ãƒ—ãƒãƒ•ã‚¡ã‚¤ãƒ«ã‚’æ¤œæŸ»ã™ã‚‹ã‚ˆã†ã«ã—ã¦ãã ã•ã„ã€‚#ãƒ—ãƒãƒ•ã‚¡ã‚¤ãƒ«ã®ãƒ†ã‚¹ãƒˆã‚’å‚ç…§ã€‚ è¨å®š ã»ã¨ã‚“ã©ã®ãƒ¦ãƒ¼ã‚¶ã¯ã‚«ã‚¹ã‚¿ãƒ ã®è¨å®šã‚’ã™ã‚‹å¿…è¦ã¯ãªã„ã§ã—ã‚‡ã†ã€‚ãã®å ´åˆã€#ä½¿ç”¨æ–¹æ³• ã«é€²ã‚€ã“ã¨ãŒã§ã
udzura 2016/12/22
seccomp

container
ãƒªãƒ³ã‚¯
seccompã‚’mrubyã§è©¦ã™ - ãƒãƒ¼ãƒ•ã‚¡ã‚¤æ—¥è¨˜
seccomp ã¨ã¯ã€Linuxã§ãƒ—ãƒã‚»ã‚¹ã®ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã®ç™ºè¡Œã‚’åˆ¶é™ã™ã‚‹æ©Ÿèƒ½ã®ã“ã¨ã€‚ä»Šå›žè©¦ã™ã‚‚ã®ã¯seccomp mode 2ã¨å‘¼ã°ã‚Œã‚‹ã€Linux3.5ã‹ã‚‰æè¼‰ã•ã‚ŒãŸã‚‚ã®ã§ã€ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«å˜ä½ã§ã®åˆ¶é™ã€ç‰¹å®šã®æ¡ä»¶ã‚’æº€ãŸã™å¼•æ•°ã®ã¿ã®è¨±å¯/åˆ¶é™ã‚’å®Ÿç¾ã§ãã‚‹ã€‚ ãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰ã§ã¯libpcapãªã©ã§ã‚‚åˆ©ç”¨ã—ã¦ã„ã‚‹BPFï¼ˆBerkeley Packet Filterï¼‰ã‚’åˆ©ç”¨ã—ã¦ã„ã¦ã€JITãªã©ã§é«˜é€Ÿã«å‹•ä½œã™ã‚‹ã‚‰ã—ã„ã€‚ ä»¥ä¸‹ã®ã‚µã‚¤ãƒˆãªã©ã‚‚å‚ç…§ã®ã“ã¨ã€‚ mmi.hatena blog.com yuzuhara.hatena blog.jp ä»Šå›žã€seccompã‚’åˆ©ç”¨ã™ã‚‹ãŸã‚ã®Cãƒ©ã‚¤ãƒ–ãƒ©ãƒªlibseccompã‚’ç”¨ã„ã¦ã€mruby-seccompã‚’ä½œæˆã—ãŸã€‚ã“ã‚Œã‚’åˆ©ç”¨ã—ã¦ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã®ç™ºè¡Œåˆ¶é™ã‚’è©¦ã™ã€‚ github.com åŸºæœ¬çš„ãªä½¿ã„æ–¹ åŸºæœ¬çš„ã«ã¯ã€Seccompã®ã‚³ãƒ³ãƒ†ã‚¯ã‚¹ãƒˆã‚’ä½œã£ã¦ã€ãƒ«ãƒ¼ãƒ«ã‚’è¨˜è¿°ã—ã€
udzura 2016/11/19
æ˜¼ã ã—ã‚»ãƒ«ã‚¯ãƒ»ãƒžãƒ¼ã—ã‚ˆ

mruby

seccomp

linux
ãƒªãƒ³ã‚¯
Using simple seccomp filters
The Linux kernel (starting in version 3.5) supports "seccomp filter" (or "mode 2 seccomp"). Ubuntu 12.04 LTS had it backported to its 3.2 kernel, and Chrome OS has been using it (in various forms) for a while. This document is designed as a quick-start guide for software authors that want to take advantage of this security feature. In the simplest terms, it allows a program to declare ahead of tim
udzura 2016/11/15
seccomp

kernel

linux
ãƒªãƒ³ã‚¯
mode 2 seccompã®è©± - yuzuharaã®æ—¥è¨˜
ã“ã®è¨˜äº‹ã¯ã‚«ãƒ¼ãƒãƒ«/VM Advent Calendar 2013ã®è¨˜äº‹ã§ã™ï¼Ž ã‚«ãƒ¼ãƒãƒ«/VM Advent Calendar 2013 - Qiita [ã‚ãƒ¼ã‚¿] å‰æ›¸ã ã«ã‚ƒã‚“â†‘ã±ã™ãƒ¼ï¼ˆæŒ¨æ‹¶ï¼‰ï¼Ž ã•ã¦ï¼Œä»Šå¹´ã¯mode 2 seccompã®è©±ã§ã™ï¼Ž ä»Šå¹´ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚ãƒ£ãƒ³ãƒ—2013ï¼Œã‚»ã‚ãƒ¥ã‚¢ãªã‚·ã‚¹ãƒ†ãƒ ã‚’ä½œã‚ã†çµ„ã‚·ã‚¹ãƒ†ãƒ ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‚¼ãƒŸã§ã‚‚å–ã‚Šæ‰±ã„ã¾ã—ãŸï¼Žã“ã®è¾ºã‚Šã®è©±ã¯ï¼Œã‚¼ãƒŸã®å’æ¥ç”Ÿç¬¬ä¸€å·ã§ã‚ã‚‹ãã‚ƒã«ãƒ¼ã•ã‚“ã®ãƒ–ãƒã‚°ã‚’è¦‹ã‚‹ã¨é›°å›²æ°—ãŒä¼ã‚ã‚‹ã‹ãªã¨æ€ã„ã¾ã™ï¼Ž seccamp2013å’æ¥ã—ã¾ã—ãŸ - åå‰ã¯ã¾ã ç„¡ã„ å½¼å¥³ã¯Cè¨€èªžã‚ã‚“ã¾ã‚Šè§¦ã£ãŸã“ã¨ãªãï¼Œæº–å‚™æœŸé–“ã§Cè¨€èªžã®ä¿®è¡Œã‚’ãŠã“ãªã„ï¼Œ1ãƒ¶æœˆã¨å°‘ã—ã§ãƒ—ãƒã‚»ã‚¹åˆ†å‰²ã¨ã‚µãƒ³ãƒ‰ãƒœãƒƒã‚¯ã‚¹åŒ–ã¾ã§å‡ºæ¥ã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸï¼Žé ‘å¼µã£ãŸï¼ ã•ã¦seccomp ã®è©±é¡Œã«æˆ»ã—ã¾ã™ï¼Žå··ã§ã¯seccomp 2, seccomp mode 2ãªã©ã¨ã‚‚æ›¸ã‹ã‚Œã¦ï¼Œã©ã†ã‚‚è¡¨è¨˜ã«å¹…ãŒã‚
udzura 2016/11/15
kernel

security

seccomp
ãƒªãƒ³ã‚¯
Seccomp security profiles for Docker
{ const container = $el; // The div with overflow const it em = document.getElementById('sidebar-current-page') if (it em) { const containerTop = container.scrollTop; const containerBottom = containerTop + container.clientHeight; const it em Top = it em.offsetTop - container.offsetTop; const it emBottom = it em Top + it em.offsetHeight; // Scroll only if the it em is out of view if (it emBottom > containerBo
udzura 2016/11/15
çµæ§‹ã„ã‚ã„ã‚ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§è¹´ã‚‰ã‚Œã¦ã‚‹ã®ã§ã‚ã‚‹ãªã‚

seccomp

docker

linux

kernel
ãƒªãƒ³ã‚¯
Linuxã®BPF : (2) seccompã§ã®åˆ©ç”¨ - ç¡åˆ†ä¸è¶³
seccompã«ã¤ã„ã¦ seccompã®ãƒ—ãƒã‚°ãƒ©ãƒ ç‰¹å®šã®ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã®ã¿è¨±å¯ã™ã‚‹ libseccomp ã“ã“ã¾ã§ã®ã¾ã¨ã‚ å‚è€ƒæ–‡çŒ® seccompã«ã¤ã„ã¦ seccomp (Secure Computingã®ç•¥ã‚‰ã—ã„)ã¯ï¼ŒLinuxã«ãŠã„ã¦ã‚µãƒ³ãƒ‰ãƒœãƒƒã‚¯ã‚¹ã‚’å®Ÿç¾ã™ã‚‹ãŸã‚ã« ãƒ—ãƒã‚»ã‚¹ã®ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã®ç™ºè¡Œã‚’åˆ¶é™ã™ã‚‹æ©Ÿèƒ½ã§ã™ï¼Ž seccompã‚’ä½¿ã£ã¦ã„ã‚‹ä»£è¡¨çš„ãªã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã¯chromeã‚„Open SSHãªã©ãŒã‚ã‚Šã¾ã™ï¼Žæœ€è¿‘åˆ©ç”¨ãŒå¢—ãˆã¦ãã¦ã„ã‚‹ã‚ˆã†ã§ã™ï¼Ž seccompã¯Linux 2.6.12 (2005)ã‹ã‚‰å°Žå…¥ã•ã‚Œã¾ã—ãŸï¼Ž ã“ã®ã¨ãseccompã¯/proc/pid/seccompã‚’1ã«ã™ã‚‹ã¨read()ï¼Œwrite()ï¼Œexit()ï¼Œsigreturn()ã®ã¿ã‚’è¨±å¯ã—ï¼Œ ãã‚Œä»¥å¤–ã®ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã‚’å‘¼ã¶ã¨SIGKILLã™ã‚‹ã¨ã„ã†ã‚‚ã®ã§ã—ãŸï¼Ž ãã®å¾Œï¼Œã‚‚ã†å°‘ã—æŸ”è»Ÿã«ã‚·ã‚¹ãƒ†ãƒ ã‚³ãƒ¼ãƒ«ã‚’
udzura 2016/11/15
seccompå…¥é–€

seccomp

linux
ãƒªãƒ³ã‚¯
1