lib-src/seccomp-filter

lib-src/seccomp-filter

[Ulrich Mueller]

I have noticed that there is a configure check for libseccomp. If it
is successful (plus some additional conditions), then a seccomp-filter
binary and some *.bpf files are created in lib-src/. However, looks
like none of them are being installed?

Is this as intended? What is the purpose of these files?

Re: lib-src/seccomp-filter

[Philipp Stephani]

Am Do., 14. Juli 2022 um 16:06 Uhr schrieb Ulrich Mueller <ulm@gentoo.org>:
>
> I have noticed that there is a configure check for libseccomp. If it
> is successful (plus some additional conditions), then a seccomp-filter
> binary and some *.bpf files are created in lib-src/. However, looks
> like none of them are being installed?
>
> Is this as intended? What is the purpose of these files?
>

They are meant to be used in conjunction with the --seccomp flag to
support a basic sandbox interface which would allow users to run
untrusted ELisp code in a secure manner. Right now the files are only
used in unit tests, and the higher-level sandboxing interface hasn't
materialized yet, but distributors could nevertheless choose to
install the files into e.g. /usr/share.