mptre
Sandbox abstraction proposal
This is really cool! Thanks for the great work @DBOTW and @mptre. Should #274 be merged into the branch for this PR?
It's not clear to me why the build is failing or why it's not outputting "disallowed syscall" messages.
It's not clear to me why the build is failing or why it's not outputting "disallowed syscall" messages.
I've been trying to figure out why the disallowed message doesn't show
up on Travis. Even strace:ing pick shows that the write call succeeds. I
got a bit reluctant to shipping support for seccomp after reading
this. The plan was to make make check || cat test-suite.log output
the missing syscall to ease debugging on platforms experiencing
failures.
I got a bit reluctant to shipping support for seccomp
seccomp should be disabled by default but can be used with --enable-seccomp ...
(latest https://github.com/calleerlandsson/pick/pull/274 has been modified accordingly)
Quoting https://github.com/google/sanitizers/issues/777#issuecomment-284220988:
Our general suggestion is to disable any sandboxes in sanitizer builds.
... I'm doing so in latest https://github.com/calleerlandsson/pick/pull/274 ...