[PATCH] helper: Add perf and ptrace to seccomp blacklist

[Alexander Larsson]

On tis, 2015-09-01 at 12:00 -0400, Colin Walters wrote:
> Note that I copied this xdg-app blacklist into linux-user-chroot:
> https://git.gnome.org/browse/linux-user-chroot/commit/?id=8cee4ab7345
> f126d1dec55b7ca1f28e8090a58d3
> 
> We should figure out a better way down the line to share code - maybe
> we can share a setup-seccomp.c?

Note that there are some known issues with the socket address type
filtering. It doesn't work on any architecture that uses the
"socketcall" syscall. This includes i686 which we currently handle by
not doing the filtering there, but there are other arches that need
this, and we should extend the blacklist.

> Possibly in the long run we'll end up with diverging blacklists, as
> linux-user-chroot can be a lot more aggressive, as its primary
> audience is build side, not generic applications.  We'll see.
> 
> But in this patch I added a big comment on how we should share code,
> and in particular credit sandstorm.io for some of these filters.
> (Although they may have gotten some of them from Android or
> Chromium?)
>
> Going back to the high level topic - let's add perf and ptrace to the
> blacklist.  We expect profiling to be done from a non-sandboxed
> terminal, or a less-restricted IDE type process which can look at the
> namespace of other apps and the desktop/kernel.

Looks good to me, pushed.

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 Alexander Larsson                                            Red Hat, Inc 
       alexl at redhat.com            alexander.larsson at gmail.com 
He's a lounge-singing ninja cat burglar possessed of the uncanny powers 
of an insect. She's a man-hating French-Canadian research scientist on 
her way to prison for a murder she didn't commit. They fight crime!