Documentation
¶
Overview ¶
Package seccomp implements integration between snappy and ubuntu-core-launcher around seccomp.
Snappy creates so-called seccomp profiles for each application (for each snap) present in the system. Upon each execution of ubuntu-core-launcher, the profile is read and "compiled" to an eBPF program and injected into the kernel for the duration of the execution of the process.
There is no binary cache for seccomp, each time the launcher starts an application the profile is parsed and re-compiled.
The actual profiles are stored in /var/lib/snappy/seccomp/profiles. This directory is hard-coded in ubuntu-core-launcher.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Backend ¶
type Backend struct{}
Backend is responsible for maintaining seccomp profiles for ubuntu-core-launcher.
func (*Backend) Setup ¶
func (b *Backend) Setup(snapInfo *snap.Info, devMode bool, repo *interfaces.Repository) error
Setup creates seccomp profiles specific to a given snap. The snap can be in developer mode to make security violations non-fatal to the offending application process.
This method should be called after changing plug, slots, connections between them or application present in the snap.
Source Files