diff options
Diffstat (limited to 'doc/manual/rl-next/linux-sandbox-consistency.md')
| -rw-r--r-- | doc/manual/rl-next/linux-sandbox-consistency.md | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/doc/manual/rl-next/linux-sandbox-consistency.md b/doc/manual/rl-next/linux-sandbox-consistency.md new file mode 100644 index 000000000..6538362b3 --- /dev/null +++ b/doc/manual/rl-next/linux-sandbox-consistency.md @@ -0,0 +1,12 @@ +--- +synopsis: Enforce syscall filtering and no-new-privileges on Linux +cls: 1063 +category: Breaking Changes +credits: alois31 +--- + +In order to improve consistency of the build environment, system call filtering and no-new-privileges are now unconditionally enabled on Linux. +The `filter-syscalls` and `allow-new-privileges` options which could be used to disable these features under some circumstances have been removed. + +In order to support building on architectures without libseccomp support, the option to disable syscall filtering at build time remains. +However, other uses of this option are heavily discouraged, since it would reduce the security of the sandbox substantially. |