CODEWITHSUNDEEP
csystem-callsseccomp
Jayakrishna Menon
Jayakrishna Menon

Reputation: 159

Find syscalls whitelisted by seccomp

So I stumbled across a program in C that uses seccomp to filter out a few syscalls. Is there anyway, other than bruteforcing, to find out the syscalls that are actually allowed.

Thanks in advance

Upvotes: 3

Views: 219

Answers (2)

tinytaro
tinytaro

Reputation: 390

You can refer to Kafel, write a policy and disassemble the generated eBPF code with its dump_policy_bpf tool.

Upvotes: 0

Mathieu
Mathieu

Reputation: 9659

If you can compile the C program, you can call seccomp_export_pfc function.

Upvotes: 1

Related Questions