Skip to content

Comment on FreeBSD Capsicum vs. Linux Seccomp Process Sandboxing

Comments

Excuse me for being ignorant, is Seccomp what SELinux is based on ?

Also, what is well-known piece of software that uses Capsicum on FreeBSD ? Can someone name a few ?

No. SELinux is based on the Linux Security Module framework, which places explicit hooks at key points within the kernel.

They also operate under pretty fundamentally different philosophies. Seccomp is based on a program dropping its own permissions. SELinux is based on a system integrator writing an ahead of time policy restricting what a program can do.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.