Remove privilege and filter a syscall
Separate root identity, Linux capabilities, and seccomp policy.
Jump to code and terminal ↓Root is not one permission bit
Linux divides many privileged operations into capabilities. A process with UID 0 can lose these powers. Clear effective, permitted, and inheritable sets and set no_new_privs so a later exec cannot gain privileges from file metadata.
A syscall policy is another boundary
Seccomp filters syscall entries. The supplied classic BPF filter checks the RISC-V architecture, rejects uname with EPERM, and allows other syscalls. Blocking uname is deliberately observable and harmless; it is a teaching policy, not a production sandbox.
Your change
In restrict_process, apply no_new_privs, capset, and the filter before exec. The provided probe makes real syscalls after exec and checks inherited policy. The grader verifies its own privileges and uname still work outside your child.
Your goal
Launch a process with empty capability sets, no_new_privs, and a seccomp filter that makes uname fail with EPERM.
What the tests observe
- Capability sets empty after exec
- no_new_privs inherited
- Actual syscall denied
- Parent unaffected
Need a nudge?
Hint 1
prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) makes privilege gain across exec impossible.
Hint 2
syscall(SYS_capset, &header, caps) applies the zeroed capability words.
Hint 3
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &filter) installs the supplied filter. Every return value matters.
What happens inside Linux
The child still has root identity, but its capability sets are empty, exec cannot grant new privilege, and the kernel rejects a selected syscall before executing it. Production isolation also needs a carefully reviewed syscall policy, filesystem exposure, credentials, and device policy.
Optional account sync. Exercises work without an account.