View source for Seccomp (Secure Computing Mode)

'''Seccomp''' (short for '''secure computing mode''') is a computer security facility that provides an application sandboxing mechanism in the Linux kernel; it was merged into the Linux kernel mainline in kernel version 2.6.12, which was released on March 8, 2005.<ref>PATCH seccomp: secure computing support</ref> seccomp allows a process to make a one-way transition into a "secure" state where it cannot make any system calls except <tt>exit()</tt>, <tt>sigreturn()</tt>, <tt>read()</tt> and <tt>write()</tt> to already-open file descriptors.  Should it attempt any other system calls, the kernel will terminate the process with SIGKILL. In this sense, it does not virtualize the system's resources but isolates the process from them entirely.

Seccomp mode is enabled via the system call using the <tt>PR_SET_SECCOMP</tt> argument, or (since Linux kernel 3.17<ref>Linux kernel 3.17, Section 11. Security</ref>) via the system call.<ref>Seccomp: add "seccomp" syscall |work=kernel/git/torvalds/linux.git - Linux kernel source tree</ref> seccomp mode used to be enabled by writing to a file, <tt>/proc/self/seccomp</tt>, but this method was removed in favor of prctl().<ref>title =PATCH 1 of 2 move seccomp from /proc to a prctl</ref> In some kernel versions, seccomp disables the RDTSC x86 instruction.<!--and similar instructions on other arches?--><ref>Time-stamp counter disabling oddities in the Linux kernel</ref>

== seccomp-bpf ==
seccomp-bpf is an extension to seccomp<ref>Yet another new approach to seccomp</ref> that allows filtering of system calls using a configurable policy implemented using Berkeley Packet Filter rules. It is used by OpenSSH and vsftpd as well as the Google Chrome/Chromium web browsers on Chrome OS and Linux.<ref>A safer playground for your Linux and Chrome OS renderers</ref>

== Uses ==
* seccomp was first devised by Andrea Arcangeli in January 2005 for use in public grid computing and was originally intended as a means of safely running untrusted compute-bound programs.
* Arcangeli's CPUShare was the only known user of this feature.<ref> Re: stable PATCH 2/2 x86-64: seccomp: fix 32/64 syscall hole</ref>  Writing in February 2009, Linus Torvalds expresses doubt whether seccomp is actually used by anyone.<ref>Re: PATCH 2/2 x86-64: seccomp: fix 32/64 syscall hole</ref> However, a Google engineer replied that Google is exploring using seccomp for sandboxing its Chrome web browser.<ref>Re: PATCH 2/2 x86-64: seccomp: fix 32/64 syscall hole</ref><ref>Re: PATCH 2/2 x86-64: seccomp: fix 32/64 syscall hole</ref>
* As of Chrome version 20, seccomp-bpf is used to sandbox Adobe Flash Player.<ref>Chrome 20 on Linux and Flash sandboxing</ref>
* As of Chrome version 23, seccomp-bpf is used to sandbox the renderers.<ref>Introducing Chrome's next-generation Linux sandbox</ref>
* Vsftpd uses seccomp-bpf sandboxing as of version 3.0.0.<ref>vsftpd-3.0.0 and seccomp filter sandboxing is here!</ref>
* OpenSSH has supported seccomp-bpf since version 6.0.<ref>Openssh 6.0 release notes</ref>
* ''Mbox'' uses ptrace along with seccomp-bpf to create a secure sandbox with less overhead than ptrace alone.<ref>MBOX </ref>
* LXD, which is a "hypervisor" for containers<ref>LXD an "hypervisor" for containers (based on liblxc)</ref><ref>Where We're Going With LXD</ref>
* Firefox and FirefoxOS use seccomp-bpf to sandbox the child processes and certain plugins.<ref>Firefox Seccomp sandbox</ref><ref>Firefox Seccomp sandbox</ref>
* Cjdns uses seccomp-bpf as one of its sandbox mechanisms, filtering the system calls it performs on a Linux system, and strictly limiting its access to the outside world.<ref>Added SECCOMP sandboxing and new admin API call to check if permissions are properly dropped</ref>

== References ==
<references> </references>
== External links ==
* [https://code.google.com/p/seccompsandbox/wiki/overview| Official website]
* [http://lwn.net/Articles/347547/ Google's Chromium sandbox], LWN.net, August 2009, by Jake Edge
* [http://chdir.org/~nico/seccomp-nurse/ seccomp-nurse], a sandboxing framework based on seccomp
* [https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt Documentation/prctl/seccomp_filter.txt], part of the Linux kernel documentation
* [https://www.cr0.org/paper/jt-ce-sid_linux.pdf Security In-Depth for Linux Software: Preventing and Mitigating Security Bugs]

[[ru:Seccomp (Secure Computing Mode)]]