Seecomp
summary
Covers seccomp work landing between Linux 4.3 and 4.8: adds architecture support for powerpc tile usermode linux parisc, expands the regression test suite (including ptrace register handling), and serializes filters for checkpoint/restore via CRIU filter serialization. Reorders syscall handling so ptrace before seccomp closes a tracing bypass that let children inject syscalls, and fixes a no_new_privs ordering hole. Deep argument inspection still has no clean fix — options are tying checks to LSM hooks or redesigning syscall argument caching.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:30What is Seecomp
- 1:05Architecture support
- 1:30Regression tests
- 3:32Split phase
- 5:12Ptrace ordering
- 8:42Serializing filters
- 10:38Argument inspection
- 17:10Discoverable logging
- 18:40Outro
related talks
26mReinventing Seccomp for Fun and Profiles
23mOverview and Recent Developments: seccomp and Small Linux Security Modules
01h 03mUsing seccomp to limit the Linux kernel attack service
01h 21mTutorial: The Why and How of libseccomp
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
34mSeccomp: What Can It Do For You?
44mSeccomp for Developers - Making Applications Simply More Secure
52mUsing Seccomp to Limit the Kernel Attack Surface