Seccomp for Developers - Making Applications Simply More Secure
summary
Shows how to embed seccomp syscall filtering into applications using libseccomp/BPF to whitelist or blacklist syscalls (example policy blocks exec/fork/open and prevents binding to port 8000), with low single-digit percent overhead. Provides ready code for Java (JNI), Go, Crystal and Python, and a workflow to run seccomp in log-first audit mode, then switch to fail-closed, shipping kernel events with auditbeat to the Elastic Stack and visualizing incidents in dashboards.
AI-written summary · about
chapters (5)
related talks
36mSeccomp For Developers - Writing More Secure Applications
01h 21mTutorial: The Why and How of libseccomp
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
52mUsing Seccomp to Limit the Kernel Attack Surface
01h 03mUsing seccomp to limit the Linux kernel attack service
34mSeccomp: What Can It Do For You?
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp
28mUnderstanding programmable system call security with Secomp-eBPF in Linux.