boustrophedon / extrasafe / 6561617006

93%

master: 78%

Pull #26

github

Switch seccomp backend from libseccomp to seccompiler

Using seccompiler has three main advantages:
- The entire codebase is in Rust
- We get musl support for free
- You don't need to have libseccomp installed on the target machine

The biggest disadvantage is that we lose support for various platforms
that libseccomp supports but libseccompiler doesn't. However, since
seccompiler supports aarch64 and x86_64 and 99% of software that would
benefit from using seccomp runs on those platforms, I think it's a
worthwile tradeoff.

The other disadvantage is that seccompiler is not quite as mature as
libseccomp and doesn't support all the features libseccomp does. I'm not
currently using those features, several of which are aimed at container
runtimes, so I don't see an issue for now.

161 of 161 new or added lines in 5 files covered. (100.0%)

666 of 712 relevant lines covered (93.54%)

116.48 hits per line