https://github.com/dimkr/libwaive

A library that allows processes to waive their rights
https://github.com/dimkr/libwaive

Last synced: over 1 year ago
JSON representation

A library that allows processes to waive their rights

• Host: GitHub
• URL: https://github.com/dimkr/libwaive
• Owner: dimkr
• License: mit
• Created: 2015-07-28T21:06:14.000Z (about 11 years ago)
• Default Branch: master
• Last Pushed: 2015-12-22T21:30:48.000Z (over 10 years ago)
• Last Synced: 2025-03-30T20:33:42.478Z (over 1 year ago)
• Language: C
• Homepage:
• Size: 11.7 KB
• Stars: 27
• Watchers: 5
• Forks: 4
• Open Issues: 0
• Metadata Files:
  • Readme: README
  • License: COPYING

Awesome Lists containing this project

README

          
 _ _ _                  _

| (_) |____      ____ _(_)_   _____

| | | '_ \ \ /\ / / _` | \ \ / / _ \

| | | |_) \ V  V / (_| | |\ V /  __/

|_|_|_.__/ \_/\_/ \__,_|_| \_/ \___|

Overview

========

libwaive is a tiny library that provides waive(), a function that allows a

process to waive its right to perform certain actions (e.g. open a file).

It is inspired by Theo de Raadt's tame() system call

(http://article.gmane.org/gmane.os.openbsd.tech/43085) and uses libseccomp

(https://github.com/seccomp/libseccomp) and cmake (https://cmake.org).

Building

========

libwaive can be built with either CMake (https://www.cmake.org/) or GNU Make

(https://www.gnu.org/software/make/), with some limitations.

To build, simply run the following commands:

  $ mkdir build

  $ cd build

  $ cmake ..

  $ make

  $ sudo make install

or:

  $ make

  $ sudo make install

Limitations

===========

libwaive has three major shortcomings:

  1) It has to be updated when new system calls are introduced.

  2) When built against older kernel headers, libwaive won't block newer system

     calls present in the kernel it actually runs on, because detection is done

     at build-time.

  3) Due to limitations of libseccomp's API, libwaive cannot check the

     parameters of system calls that accept pointers (e.g. socketcall).

     Therefore, it is recommended to use WAIVE_SOCKET rather than WAIVE_INET,

     WAIVE_UN or WAIVE_PACKET, if possible.

Credits and Legal Information

=============================

libwaive is free and unencumbered software released under the terms of the MIT

license; see COPYING for the license text. For a list of its authors and

contributors, see AUTHORS.

The ASCII art logo at the top was made using FIGlet (http://www.figlet.org/).