Failing Randomly: Linux Seccomp and Kernel Hacking
Seccomp filters system calls with cBPF code. One can blacklist certain system call numbers or even make a decision based on call arguments. Both Docker and Chromium use seccomp to protect host from malicious or misbehaving programs. With seccomp we can make a syscall fail consistently. We can’t make a syscall fail with a certain probability though. How hard could it be to extend seccomp for…