# System call interception
LXD supports intercepting some specific system calls from unprivileged
containers and if they're considered to be safe, will executed with
elevated privileges on the host.

Doing so comes with a performance impact for the syscall in question and
will cause some work for LXD to evaluate the request and if allowed,
process it with elevated privileges.

# Available system calls
## mknod / mknodat
The `mknod` and `mknodat` system calls can be used to create a variety of special files.

Most commonly inside containers, they may be called to create block or character devices.
Creating such devices isn't allowed in unprivileged containers as this
is a very easy way to escalate privileges by allowing direct write
access to resources like disks or memory.

But there are files which are safe to create. For those, intercepting
this syscall may unblock some specific workloads and allow them to run
inside an unprivileged containers.

The devices which are currently allowed are:

 - overlayfs whiteout (char 0:0)
 - /dev/console (char 5:1)
 - /dev/full (char 1:7)
 - /dev/null (char 1:3)
 - /dev/random (char 1:8)
 - /dev/tty (char 5:0)
 - /dev/urandom (char 1:9)
 - /dev/zero (char 1:5)

All file types other than character devices are currently sent to the
kernel as usual, so enabling this feature doesn't change their behavior
at all.

This can be enabled by setting `security.syscalls.intercept.mknod` to `true`.

## setxattr
The `setxattr` system call is used to set extended attributes on files.

The attributes which are handled by this currently are:

 - trusted.overlay.opaque (overlayfs directory whiteout)

Note that because the mediation must happen on a number of character
strings, there is no easy way at present to only intercept the few
attributes we care about. As we only allow the attributes above, this
may result in breakage for other attributes that would have been
previously allowed by the kernel.

This can be enabled by setting `security.syscalls.intercept.setxattr` to `true`.

Add documentation for syscall interception
doc: Add documentation for syscall interception

Signed-off-by: Stéphane Graber <089afc6d81f66f1168a9849e15660feae286e024@ubuntu.com>
