Subject: Re: RFC: disablenetwork facility. (v4)

From: Al Viro <[email-masked]>
Date: Sun, 27 Dec 2009 12:18:49 +0000

On Sun, Dec 27, 2009 at 08:49:17PM +0900, Tetsuo Handa wrote:

> We can determine what syscalls we need from application's code and libc's code,
> can't we?

_Which_ libc?  And no, I'm not talking about other implementations; even
glibc is more than enough.  It changes and it *does* change the set of
syscalls used to implement given function.

I'm not disagreeing about what's seccomp worth, BTW.