diff options
Diffstat (limited to 'changes/seccomp2_sandbox')
| -rw-r--r-- | changes/seccomp2_sandbox | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/changes/seccomp2_sandbox b/changes/seccomp2_sandbox new file mode 100644 index 000000000..73b3a8d5e --- /dev/null +++ b/changes/seccomp2_sandbox @@ -0,0 +1,12 @@ + o Major features (security): + - Use the seccomp2 syscall filtering facility on Linux to limit + which system calls Tor can invoke. This is an experimental, + Linux-only feature to provide defense-in-depth against unknown + attacks. To try turning it on, set "Sandbox 1" in your torrc + file. This is an experimental feature, however, and some things + may break, so please be ready to report bugs. We hope to add + support for better sandboxing in the future, + including more fine-grained filters, better division of + responsibility, and support for more platforms. This work has + been done by Cristian-Matei Toader for Google Summer of Code. + |