Systemd: Sandbox for background services
Systemd developer Lennart Poettering has extended the init system for Linux to include seccomp (Secure Computing Mode) support. Seccomp is a security extension in the Linux kernel that restricts the system calls a process can make – placing the process into a sandbox. Google uses seccomp to run the Flash plugin in a secure environment in the 64-bit version of the Chrome web browser for Linux.
On Google+, Poettering writes that, when defining a background service that is to be launched when booting, the permitted system calls can simply be listed after the SystemCallFilter keyword. If a service that has been restricted in this way attempts to make an unauthorised system call, it will be terminated by the kernel. Seccomp requires version 3.5 of Linux, which is expected to arrive in the next few days.
See also:
- Control Centre: The systemd Linux init system, a feature from The H.
- Booting up: Tools and tips for systemd, a Linux init tool, a feature from The H.
(crve)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
