Abandoned seccomp by default.

seccomp is causing too many problems, and I don't have the resources to
test all the hardware and software combinations that are required.

I'll continue to update the machinery when patches come in, but until
Linux has a security mechanism that doesn't require a corporate
infrastructure to operate, sandboxing for this operating system is
disabled by default.

If you're running kcgi in a security-sensitive environment, seccomp can
be enabled in the Makefile (instructions are therein).  If you're
packaging kcgi for seccomp systems, please don't enable it unless you've
tested for the target platform!

I strongly urge security-sensitive applications to move to OpenBSD or
FreeBSD, whose security mechanisms are much more friendly to
development.

Makefile

@@ -9,9 +9,11 @@ include Makefile.configure
 
 #LDADD_STATIC	 =
 
-# Linux apps might one seccomp debugging.
+# Seccomp is disabled by default.  To enable it, uncomment the following
+# line and run `make regress` to make sure it runs on your target
+# architecture and system.
 
-#CPPFLAGS	+= -DSANDBOX_SECCOMP_DEBUG
+#CPPFLAGS	+= -DSANDBOX_SECCOMP_DEBUG -DENABLE_SECCOMP_FILTER=1
 
 # You probably don't need to change anything else...
 

sandbox-seccomp-filter.c

@@ -16,7 +16,7 @@
  */
 #include "config.h"
 
-#if HAVE_SECCOMP_FILTER
+#if HAVE_SECCOMP_FILTER && ENABLE_SECCOMP_FILTER
 
 #ifndef SECCOMP_AUDIT_ARCH
 #error Unknown seccomp arch: please contact us with your uname -m