On Thu, 19 Feb 2015 14:14:37 -0500 Mike Frysinger <[email protected]> wrote:
> pro: improved security in daemons (often network) > con: some packages might pull in libseccomp (~250KB) > > there shouldn't be measurable runtime overhead here as the filtering > is done by a JIT in the kernel itself. if the kernel lacks support > for seccomp, daemons generally should fallback at runtime. if they > don't, people should file bugs to get them fixed. +1 One thing to keep in mind: some upstreams don't really maintain their seccomp functionality so when, they add usage of new syscalls the daemon it just ends up crashing. This is definitely a bug that should be fixed though.
