procd/jail/seccomp-inject.h, branch masterOpenWrt service / process managerhttps://git.openwrt.org/project/procd/atom?h=master2026-08-21T04:30:22Zjail: apply OCI seccomp filters via ptrace syscall injection2026-08-21T04:30:22ZDaniel Golle2026-06-17T13:50:35Zurn:sha1:f15d0c407c09c2b10791065c3a2f2ef208448b46
Arm the compiled cBPF profile by injecting prctl(NO_NEW_PRIVS) and
seccomp(SET_MODE_FILTER) into the freshly-execve'd workload over ptrace.
The child does PTRACE_TRACEME before its final execve; the parent catches
the post-execve stop, drives the two syscalls via a temporary trap at the
program counter, restores registers and code, then detaches. This installs
the filter for static binaries too, closing the gap left by the dropped
LD_PRELOAD installer (preload.c, seccomp.c and the shared library are removed).
A dynamic binary needs extra loader and libc pre-main syscalls. They are
granted once in a phase-1 app + linker_base filter, then revoked with deny
deltas at the entry and main boundaries (located via AT_BASE/auxv and ELF
marker addresses), each delta reverting to the profile default. Static and
Go-style binaries collapse to fewer phases. NOTIFY or flag profiles still go
in-process; audit and complain modes reuse the same staging to log denials.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>