Add basic seccomp filter

[ngc92]

prevents the exploit in #29 , which is added here in slightly modified form.

[Copilot]

Pull request overview

Adds a seccomp-based hardening layer to the benchmark runner to mitigate ptrace-based timing tampering, and includes a new exploit submission demonstrating the attack being blocked.

Changes:

• Add install_seccomp_filter() and a basic seccomp ruleset to block ptrace and specific prctl calls used to re-enable dumping / alter seccomp state.
• Invoke the seccomp installation right before importing/running untrusted kernels.
• Add a new exploits/submission_ptrace.py that demonstrates patching cudaEventElapsedTime via PTRACE_POKETEXT.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
exploits/submission_ptrace.py	Adds a ptrace-based exploit example to validate/illustrate the defense.
csrc/manager.cpp	Installs the new seccomp filter before importing untrusted kernel code.
csrc/landlock.cpp	Implements seccomp filter setup/loading and associated syscall blocks.
CMakeLists.txt	Links the extension against libseccomp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

This PR strengthens the benchmark sandbox against ptrace-based tampering by introducing a seccomp filter in the C++ harness, and adds a corresponding exploit script to validate the defense.

Changes:

• Add a libseccomp-based seccomp filter (blocking ptrace and certain prctl uses) and install it before importing untrusted kernels.
• Update build/CI to link against libseccomp and install required system packages.
• Add a new submission_ptrace.py exploit demonstrating PTRACE_POKETEXT patching of cudaEventElapsedTime.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
exploits/submission_ptrace.py	Adds a ptrace-based exploit to test whether defenses prevent .text patching of cudaEventElapsedTime.
csrc/manager.cpp	Installs the new seccomp filter before importing/executing untrusted kernel code.
csrc/landlock.cpp	Implements seccomp filter setup and moves dumpable/no_new_privs hardening into install_seccomp_filter().
CMakeLists.txt	Adds pkg-config + libseccomp discovery and links the extension against libseccomp.
.github/workflows/wheel.yml	Installs libseccomp-dev and pkg-config for wheel builds.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Adds a seccomp-based hardening step to the benchmark runner to block ptrace/abusive prctl usage (closing a demonstrated PTRACE_POKETEXT patching exploit), and updates build/CI dependencies to link against libseccomp.

Changes:

• Add a new ptrace-based exploit submission demonstrating .text patching via PTRACE_POKETEXT.
• Install a libseccomp filter before importing/running untrusted kernels; move related prctl hardening into this step.
• Update CMake + wheel CI to depend on and link libseccomp.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
exploits/submission_ptrace.py	New exploit submission that uses ptrace + prctl to patch cudaEventElapsedTime in-process.
csrc/manager.cpp	Calls install_seccomp_filter() before importing user kernels.
csrc/landlock.cpp	Adds seccomp filter setup/load and relocates prctl hardening from Landlock setup.
CMakeLists.txt	Adds pkg-config discovery and links _pygpubench with libseccomp.
.github/workflows/wheel.yml	Installs libseccomp-dev and pkg-config in wheel build job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Adds a seccomp-based hardening layer to PyGPUBench to prevent ptrace-based tampering of the benchmarking process, along with an exploit testcase that demonstrates the previously-viable attack path.

Changes:

• Install a libseccomp filter before importing untrusted kernels to block ptrace and specific dangerous prctl operations.
• Update build system / CI to link against libseccomp via pkg-config and ensure the dependency is installed in wheel builds.
• Add a new exploit submission demonstrating PTRACE_POKETEXT patching of cudaEventElapsedTime.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
exploits/submission_ptrace.py	New exploit testcase attempting a ptrace-based code patch against libcudart timing.
csrc/manager.cpp	Calls install_seccomp_filter() before importing user code.
csrc/landlock.cpp	Implements the seccomp filter rules and moves dumpable/no_new_privs hardening into the seccomp installer.
CMakeLists.txt	Adds pkg-config discovery and links _pygpubench against libseccomp.
.github/workflows/wheel.yml	Installs libseccomp-dev and pkg-config in the wheel build container.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.