SECCOMP (secure computing) is a way for programs to declare to the Linux kernel that they will never make certain system calls, thus any attempt to make one of these calls is interpreted as a security penetration and the kernel can forcibly kill off the program, preventing harm to the computer.
If you are reading this because cjdns is halting on you, you are probably getting a log message like the following:
Attempted banned syscall number [232] see docs/Seccomp.md for more information
This number (232 in the example) is specific to your system and you need to
run a command to convert it to a syscall name.
echo '#include <sys/syscall.h>' | cpp -dM | grep '#define __NR_.* 232'Obviously you'll be replacing 232 with the actual syscall number which your system
printed. The Result might look something like the following:
#define __NR_epoll_wait 232Which would tell you (for example) that the epoll_wait syscall was disallowed on
your system. In this case you'd need to go to util/Seccomp.c and inside of the
mkfilter() function where the actual SECCOMP rules are set up, you'll see a set
of entries such as the following.
#ifdef __NR_mmap2
IFEQ(__NR_mmap2, success),
#endifAdd a similar entry for the syscall (make sure you put it with the others and not)
below the RET(SECCOMP_RET_TRAP), line which triggers the failure). When you have
finished adding your system call rebuild and re-test cjdns. If it works well then
please make a Pull Request :-) If not then open a bug report and explain the problem.