Re: Playing with libseccomp

2017-02-23 Thread Martin Gräßlin
Am 2017-02-19 13:17, schrieb Martin Gräßlin: But I'm not able to authenticate any more. The seccomp filter gets inherited to forked processes and cannot be disabled any more (the idea is that you cannot escape the sandbox). KScreenlocker forks+exec kcheckpass and that somehow opens a file in writ

Playing with libseccomp

2017-02-19 Thread Martin Gräßlin
Hi all, this weekend I spent some time on trying to get kscreenlocker_greet into a sandbox through libseccomp. My aim was to make it impossible for a lnf package to intercept the password and e.g. write it to a file. In this mail I want to outline my findings. First of all, what does libsecc