[bug#45344] [Patch 0/2] Libwaive for signify

[Vincent Legoll]

Hello,

On Sun, Feb 21, 2021 at 12:09 AM Leo Famulari <leo@famulari.name> wrote:
> I noticed that libwaive hasn't been active in a few years. I wonder if
> it's something we should pursue...

libwaive is a single-file C (~300 LOCs [1]) source code library, I glanced over
it and it looks straightforward enough. I compared it to the seccomp manpage
[2] code samples and saw nothing suspicious.

I think it may not have been updated for newly added syscalls, but that
should not make it unsecure, mainly because what is not explicitely allowed
is prevented from use (default-locked policy [3]).

So, I'll wait for a bit more feedback before working on this, but I think
it may still be a worthwhile addition.

WDYT ?

[1] https://github.com/dimkr/libwaive/blob/master/waive.c
[2] https://man7.org/linux/man-pages/man3/seccomp_rule_add.3.html
[3] https://en.wikipedia.org/wiki/Seccomp

-- 
Vincent Legoll