I got to the twentieth slide, and I still wonder:
What does tame() itself DO?
What does tame() itself DO?
Whitelist syscalls. Any non-whitelisted syscall being invoked causes the process to be terminated with SIGKILL (or a non-blockable SIGABRT if `abort` it set). Further tame(2) calls can only further restrict the whitelist. The whitelisting can get down to just _exit(2).
A request value of "" restricts the process to the _exit(2)
system call. This can be used for pure computation
operating on memory shared with another process.