alt Hacker News> But if you've got a separation of duties where a sysadmin sets up seccomp filtering generically across applications
Is this even possible, regardless of io_uring?
Replies
klooney • 10/12/2024
Yes- systemd will let you do that, as well docker/containerd/podman.
Well the article brings up containers as an example. If the sysadmin controls “your” parent or root process (e.g. the login shell), they can just perform seccomp filtering there and it applies to everything within it (like any other sandbox).