Seccomp: What Can It Do For You?
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Friday, 2020-11-20· at 16:00· Intrado Virtual Event Platform,·
summary
Seccomp is a Linux syscall filter that Docker enables by default and that blocks high-risk subsystems, and the Docker default policy prevents real CVEs (notably iptables/user namespace and BPF verifier exploits) but is fragile and hard to maintain. The current JSON profile is an 800-line profile that breaks apps (historic failures with Emacs and Steam), causes performance edge cases, and needs rapid updates across architectures. Alternatives include a short blocklist approach, runtime sandboxes like gVisor or Firecracker, or using the new eBPF LSM in Linux 5.7.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:24Justin Cormack
- 0:46Secure Computing
- 2:27In theory
- 2:53seccomp in practise
- 4:11In Docker and Kubernetes
- 7:04Do not use
- 9:03User namespaces
- 9:31CVE 2016-3134
- 10:23CVE 2020-8835
- 11:13The war on Emacs
- 13:04Accidentally broke Steam!
- 14:24Performance
- 15:09CVE 2018-17182
- 20:12Don't use it?
- 21:16Are small blocklists better?
- 24:03Is it better to push to runtime? 3 Virtual
- 25:15gVisor
- 26:02Lambda like?
- 28:36eBPF LSM
- 30:48Prediction
related talks
44mSeccomp for Developers - Making Applications Simply More Secure
36mSeccomp For Developers - Writing More Secure Applications
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp
52mUsing Seccomp to Limit the Kernel Attack Surface
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
01h 21mTutorial: The Why and How of libseccomp
26mReinventing Seccomp for Fun and Profiles
01h 03mUsing seccomp to limit the Linux kernel attack service