- ATC ‘18 Presentation
- Process-based isolation is slow. Use:
- Language-based isolation: Rust. Guaranteed in compile time.
- Fine-grained preemption: Restrict syscalls and abort long-running tasks.
Preload Dynamic Library
LD_PRELOAD to preload a dynamic library before any other library. Link
$ LD_PRELOAD=/path/to/my/malloc.so /bin/ls.
ldd to list alll runtime dependencies of a binary program or a shared library.
SIGALRM is a signal triggered after waiting for a certain amount of time. By default, it kills the process. In C,
settimer function can call the
A process passes a bad argument to a syscall. For example, it violates Seccomp security rules. It can also be used to emulate foreign syscalls: emulating Windows syscalls on Linux. By default, it terminates the process.
Linux uses seccomp to restrict the process’s syscalls. It is widely used in containers.
Useful Langauge Points