0

how can I use seccomp and prctl syscall vs bcc to interception syscalls? Is there another way to achieve this goal with bcc ??

I know that it is possible with pure ebpf code in C but it is too difficult to understand and use and I want to use bcc for it.

1 Answer 1

0

BCC is about observability (mostly), it will help you trace and inspect the system calls but won't allow you to block them like seccomp does. If this is what you're after, eBPF can do that on recent kernels, but you want to search for the eBPF-based LSM (see kernel's documentation on the topic).

A few additional pointers:

13
  • thanks Qeole! useful! May 10, 2021 at 11:45
  • Does using eBPF-based lsm basically require kernel rebuild??? May 10, 2021 at 11:50
  • and another question: does this line: If this is what you're after, eBPF can do that on recent kernels represent something different from this one: but you want to search for the eBPF-based LSM ? I mean can I achieve my goal with pure eBPF and without lsm?? May 10, 2021 at 11:54
  • eBPF programs never need a kernel rebuild (the only thing that might need it is if your kernel didn't have the relevant options turned on when it was compiled, but this is seldom an issue on the recent versions of mainstream distributions). I'm not sure what you mean by pure eBPF. eBPF programs need to be attached to a hook in the kernel, the LSM is such a hook. The only one, at the moment, to consider for everything related to filtering syscalls with eBPF. But it doesn't mean any additional frameworks or software, it's all self-contained in the kernel, look at the docs.
    – Qeole
    May 10, 2021 at 13:14
  • But I think (kernel)/samples/seccomp/dropper.c is not hooked with lsm. and it intercepts syscalls. it is true? Or I didn't consider something? May 10, 2021 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .