Add seccomp

[JonathanBerhe]

Hi, thanks for the project, it's very intresting!
I would like to work on seccomp feature if possible.

[flxo]

@JonathanBerhe Just a note: @Inorik recently implemented some basic BPF stuff for something similar: https://github.com/esrlabs/northstar/blob/master/northstar/src/runtime/island/seccomp.rs Maybe this is helpful.

[utam0k]

@JonathanBerhe
Of course! I welcome your challenge.
I assigned you for this issue.
If possible, it would be helpful if you could keep the following points in mind

• Try not to make the build process too complicated or wrapped(e.g. using build.rs).
• Minimize rework by breaking the implementation into tiny PRs.

[JonathanBerhe]

@JonathanBerhe Just a note: @Inorik recently implemented some basic BPF stuff for something similar: https://github.com/esrlabs/northstar/blob/master/northstar/src/runtime/island/seccomp.rs Maybe this is helpful.

Many thanks for the input!

[flxo]

• Try not to make the build process too complicated or wrapped(e.g. using build.rs).

The crucial point is the mapping of syscall names to numbers. You have two options: A static to maintain list or the very very messy build.rs thing we do. If I would have to decide again I'd go for the list. Syscall number never change.

[utam0k]

@flxo
Thanks for the advice! I too am wondering what to do in this area rather than implement.

[JonathanBerhe]

@utam0k Hi, I'll show you the progress in the next days. I choose to map sys calls to the relative number of each architecture without a complex build system in build.rs

[utam0k]

@JonathanBerhe Copy that. Thank you for keeping me informed of your progress. I'll look forward to it :)

[utam0k]

@JonathanBerhe Hi! Do you have any problems about it? I don't want to rush you, but if there is anything I can do to help you, I would be happy.

[JonathanBerhe]

@utam0k Hi, sorry for the late.
I was being pretty occupied with other projects. I'll open a PR asap this week with docs that describes the solution. 👍

[utam0k]

@JonathanBerhe I understand. No problem at all. I was just wondering if I should wait for this or not since I'm thinking of doing the first release soon.

[JonathanBerhe]

@utam0k I think that we need to spend some times on testing, since this is a security feature. If you think that we can release a first version without a seccomp implementation for me is ok

[utam0k]

@JonathanBerhe Are you busy? Let me know if you find it difficult to find the time.

[JonathanBerhe]

@utam0k Hi, I've opened a new PR in WIP. #235