research seccomp for better python script security

[phabricator-migrator]

Information

ID: 128
PHID: PHID-TASK-jabdssnf7ycrcodmvutb
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Find out if seccomp (and/or seccomp.py) would be useful to increase security.

A good good candidate for testing and confinement, because relatively simple to play with, would be url_to_unixtime (T102). Later also control-port-filter-python.

See also:

• Security Enhancements for Python scripts - seccomp.py

Related:

• research PyPy for better python script security: T129 [if we start using pypy, we might not need seccomp.py T128]

Comments

---

Patrick

2015-04-25 19:26:57 UTC

[Whonix-devel] hardening python scripts with seccomp.py:
[Whonix-devel] hardening python scripts with seccomp.py

---

HulaHoop

2015-06-18 01:19:51 UTC

seccomp.py would have needed a lot of effort to extend to be able to meet cpfp’s syscall requirements while making sure its still secure. prctl’s interface is far from pythonic to deal with. Not a solution that scales.

---

systemd.exec integrates and exposes Linux’s security features in an easy to use manner. It was chosen instead.

Whonix Forum

---

Patrick

2017-02-13 19:42:49 UTC

! In T128#5598, @HulaHoop wrote:
Whonix Forum

new link:
https://forums.whonix.org/t/cpfpd-data-options-control-port-filter-python-hardening