doc update

NEWS

@@ -7,6 +7,7 @@
   authentication methods). That feature is disabled by default as it
   requires the security module to keep state for each connected user.
 - Corrected escaping of URL-encoded passwords. Patch by Hexchain Tong.
+- Seccomp is now compiled-in by default, and can be enabled at runtime.
 - ocpasswd: Added --delete parameter.
 
 

doc/sample.config

@@ -16,6 +16,11 @@ auth = "plain[./sample.passwd]"
 # to generate password entries.
 #auth = "plain[/etc/ocserv/ocpasswd]"
 
+# Whether to enable seccomp worker isolation. That restricts the number of 
+# system calls allowed to a worker process, in order to reduce damage from a
+# bug in the worker process. It is available on Linux systems at a performance cost.
+#use-seccomp = true
+
 # Whether to enable the authentication method's session control (i.e., PAM).
 # That requires more resources on the server, and makes cookies one-time-use;
 # thus don't enable unless you need it.