Skip to main content

Interception

Simple Story

The three Linux layers each stand between the pupil and what they asked for.

The pupil asks for something and, instead of reaching the thing they asked for, they reach whoever is standing there first. Two of them hold a doorway, the kernel and the linker. The third holds none at all: it watches the clock.

What it is

Every Linux-based layer works by putting itself between the supervised program and the resource it requests, but each does so at a different level:

LayerInterception point
BubblewrapThe kernel. A mount namespace gives the process a different view of the file system.
LD-Preload FirewallThe dynamic linker. Socket symbols resolve to libnetblocker.so before they reach libc.
TimeoutSignal delivery. The wrapper sends a signal once the budget is spent.

This is the same idea as a pointcut in the aspect-oriented programming (AOP) layer, moved outside the Java Virtual Machine (JVM).

Further reading