add lxd syscall interception like future about crun HOT 5 CLOSED

I guess need add

{
  "defaultAction": "SCMP_ACT_ALLOW",
  "syscalls": [
    {
      "names": ["sysinfo"],
      "action": "SCMP_ACT_NOTIFY",
      "args": []
    }
  ]
}

and implement seccomp_notify.c return fake results based on the container def.

from crun.

yes, you'd need to handle the intercepted syscall by yourself.

I am closing the issue since it is out of the scope for crun. There is no crun process that can intercept the syscall while the container runs.

from crun.

I find this code https://github.com/canonical/lxd/blob/main/lxd/seccomp/seccomp.go

please suggestion how to intercepted syscall with crun.

from crun.

crun only sets up the container and then exits. Conmon (container monitor) is the processes that continues running with the container. This potentially could be used, but probably only for rootful containers.

from crun.

it works also for rootless, but of course you are limited in what you can do since you can still only perform operations possible to the unprivileged user in the user namespace

from crun.