Lfs Tweak Notthetweakthatyouwant Full Info

Novice developers using ChatGPT to write Makefile or Theos templates often receive code that includes dummy error messages. The AI training data pulled from old forum posts containing notthetweakthatyouwant as a placeholder. Consequently, new tweaks are being born with this error.

Use seccomp via libseccomp to restrict syscalls per binary. lfs tweak notthetweakthatyouwant full

Example: Restrict sshd to only read, write, exit, select, socket, accept, close, openat, getpid, getuid. Novice developers using ChatGPT to write Makefile or

Create filter generator:

cat > /usr/local/bin/seccomp-sshd-filter.c << "EOF"
#include <seccomp.h>
int main() 
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
    // ... add 20 syscalls
    seccomp_load(ctx);
EOF
gcc -o /usr/local/bin/sshd-seccomp /usr/local/bin/seccomp-sshd-filter.c -lseccomp

Wrap sshd:

#!/bin/sh
/usr/local/bin/sshd-seccomp
exec /usr/sbin/sshd -D

Instead, host freestanding .deb files on a CDN (Cloudflare R2, Bunny.net) and store only the URL in your Git repo. Wrap sshd: #