mirror of
https://github.com/marcoallegretti/WEFT_OS.git
synced 2026-03-27 09:23:09 +00:00
Marco Allegretti
98a21da734
Add seccomp feature flag (seccompiler + libc, Linux-only, optional). When compiled with --features seccomp, weft-runtime installs a SECCOMP_MODE_FILTER immediately after argument parsing, before any package resolution or WASM execution. Filter strategy: default-allow with explicit KillProcess rules for high-risk syscalls a WASM runtime process has no legitimate need for: ptrace, process_vm_readv/writev, kexec_load, personality, syslog, reboot, mount/umount2, setuid/setgid/setreuid/setregid/setresuid/ setresgid, chroot, pivot_root, init_module/finit_module/delete_module, bpf, perf_event_open, acct. The feature is off by default so the standard build and tests are unaffected. Enable in production service builds with --features seccomp.
24 lines
657 B
TOML
24 lines
657 B
TOML
[package]
|
|
name = "weft-runtime"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
|
|
[[bin]]
|
|
name = "weft-runtime"
|
|
path = "src/main.rs"
|
|
|
|
[features]
|
|
default = []
|
|
wasmtime-runtime = ["dep:wasmtime", "dep:wasmtime-wasi", "dep:cap-std"]
|
|
seccomp = ["dep:seccompiler", "dep:libc"]
|
|
|
|
[dependencies]
|
|
anyhow = "1.0"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
wasmtime = { version = "30", optional = true }
|
|
wasmtime-wasi = { version = "30", optional = true }
|
|
cap-std = { version = "3", optional = true }
|
|
seccompiler = { version = "0.4", optional = true }
|
|
libc = { version = "0.2", optional = true }
|