A discussion on the pgsql-hackers mailing
list at the end of August is another reminder that the suitability of
seccomp()
filters is likely more narrow than was hoped. Applying filters to
the PostgreSQL database is difficult for a number of reasons and the
benefit for the project and its users is not entirely clear. The
discussion highlights the tradeoffs inherent in adding system-call
filtering to a complex software suite; it may help crystallize the thinking
of other projects that are also
looking at supporting seccomp() filters.
Source: LWN.net – [$] PostgreSQL considers seccomp() filters