Bug 1012689

Summary: Please build libseccomp's Python bindings
Product: [Fedora] Fedora Reporter: Andy Lutomirski <luto>
Component: libseccompAssignee: Paul Moore <pmoore>
Status: CLOSED DEFERRED QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 19CC: crobinso, luto, pmoore
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-12-17 19:48:02 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Andy Lutomirski 2013-09-26 21:49:21 UTC
libseccomp 2.1.0 added Python bindings, but the Fedora package doesn't seem to build them.

Comment 1 Paul Moore 2013-09-26 21:56:06 UTC
While the Python bindings do exist in libseccomp 2.1.0, they are intentionally disabled (support is removed from ./configure) as they are not yet supported.

Do you have a Python application that can make use of libseccomp?

Comment 2 Andy Lutomirski 2013-09-26 22:02:44 UTC
I'm writing one.  It's a simple web server that will sandbox itself after loading but before accepting any connections.

Comment 3 Paul Moore 2013-09-26 22:17:06 UTC
Please keep the upstream libseccomp developers aware of your progress, one of the reasons why the Python bindings are not yet supported is the lack of experience with any Python apps using libseccomp.  Your experience could help push that forward.

Comment 4 Andy Lutomirski 2013-09-27 01:20:06 UTC
Will do, but don't hold your breath...

This stuff is likely to be a bit messy, because it's perfectly valid for Python to issue unexpected syscalls.  I'll probably end up forcing some combination of ENOSYS returns and SIGSYS.

Comment 5 Cole Robinson 2013-12-17 19:48:02 UTC
Since the python bindings are still experimental, things are basically functioning as intended, so there isn't much use in keeping this bug open.