procd/jail/seccomp-trace.c, branch masterOpenWrt service / process managerhttps://git.openwrt.org/project/procd/atom?h=master2026-08-21T04:31:30Zjail: add seccomp trace, audit and complain modes2026-08-21T04:31:30ZDaniel Golle2026-08-21T04:31:30Zurn:sha1:ef2d5fc5e09d72d6d40e2c1bb2d8db00c85afd16
Add a ptrace-based syscall tracer, selected via -m (enforce, trace, audit
or complain) with -M naming an NDJSON log. Trace records every syscall,
classifying each into a startup phase (linker, init, app) resolved from
entry-point and libc breakpoints, so a generated profile can cover the
application phase alone. Audit and complain run the real seccomp filter
but rewrite its returns to SECCOMP_RET_TRACE, logging every denial; audit
then enforces (errno or kill, including the two-stop errno arches), while
complain permits and only records. Events stream to a udebug ring and, as
a fallback, to the NDJSON file.
procd's instance config gains seccomp_mode and seccomp_log, passed
through to ujail as -m and -M.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>