genode/tool/seccomp/Makefile

.DEFAULT_GOAL := seccomp_bpf_filters

seccomp_bpf_filters: seccomp_bpf_policy_x86_32.bin seccomp_bpf_policy_x86_64.bin seccomp_bpf_policy_arm.bin

seccomp_bpf_policy_%.bin: seccomp_bpf_compiler_%.prg
	./$< > $@

seccomp_bpf_compiler_%.prg: seccomp_bpf_compiler_%.cc
	@g++ $< -o $@ -lseccomp

clean:
	@rm seccomp_bpf_policy_*.bin 2> /dev/null; true
	@rm seccomp_bpf_compiler_*.prg 2> /dev/null; true
base-linux: enabled seccomp base-linux uses seccomp to reduce the available system calls to the minimum set needed to run base-linux. There are still some syscalls that allow accessing global state which should be further reduced. The combination of seccomp and socket descriptor caps should provide an intermediate level of security for base-linux thereby enabling base-linux as a migration path from using the Linux kernel to the use of microkernel-based Genode. Fixes #3581 2019-09-17 14:40:52 +02:00			`.DEFAULT_GOAL := seccomp_bpf_filters`

			`seccomp_bpf_filters: seccomp_bpf_policy_x86_32.bin seccomp_bpf_policy_x86_64.bin seccomp_bpf_policy_arm.bin`

			`seccomp_bpf_policy_%.bin: seccomp_bpf_compiler_%.prg`
			`./$< > $@`

			`seccomp_bpf_compiler_%.prg: seccomp_bpf_compiler_%.cc`
			`@g++ $< -o $@ -lseccomp`

			`clean:`
			`@rm seccomp_bpf_policy_*.bin 2> /dev/null; true`
			`@rm seccomp_bpf_compiler_*.prg 2> /dev/null; true`