Subject: Re: [RFC PATCH 0/5] Add eBPF hooks for cgroups

From: Thomas Graf <[email-masked]>
Date: Fri, 19 Aug 2016 18:37:55 +0200

On 08/19/16 at 06:31pm, Pablo Neira Ayuso wrote:
> Why do you need global seccomp policies? The process knows better what
> he needs to place in his sandbox, so attaching this from the process
> itself makes more sense to me... Anyway, this reminds me to selinux.

Two different objectives. The point is to sandbox applications and
restrict their capabilities. It's not the application itself but the task
orchestration system around it that manages the policies.