Enabling seccomp strict mode gets "Invalid Argument" error on Replit

Question

I am making an online code judge using Replit, and I want to use seccomp to securely run submitted code.

Through reading a few tutorials, I have made a simple test program to test seccomp:

#include <stdio.h>
#include <unistd.h>

#include <sys/prctl.h>
#include <linux/seccomp.h>

int main(){
    prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT);

    printf("Message #1\n");
    fork();
    printf("Message #2\n");
}

When I run the program, Message #2 prints twice, which must mean seccomp didn't do it's job of stopping the fork. When I investigate using strace, I notice the following message within the output, though I am not sure what to do with it:

...
prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT) = -1 EINVAL (Invalid argument)
...

How can I fix this problem, and get seccomp running in strict mode? I do not own a Linux machine, so I am not sure if this problem is specific to Replit, or I am doing something wrong.

Answer 1

Seccomp is already in use on replit. Make your program do prctl(PR_GET_SECCOMP);, or check /proc/self/status, and you'll see it's already active and in filter mode. While I don't see anything about that in prctl's man page, I do in seccomp's (which fails the same way if you try syscall(SYS_seccomp, SECCOMP_SET_MODE_STRICT, 0, NULL);):

       EINVAL A secure computing mode has already been set, and
              operation differs from the existing setting.

So if you want to use seccomp strict mode, you'll need to do so somewhere else. Setting up a Linux VM on your computer is easy and free, so that's what I'd recommend.