Overview and Recent Developments: seccomp and Small Linux Security Modules
summary
Crash-course on three kernel features and what actually changed: LoadPin with dm-verity pins kernel reads to a cryptographically verified backing filesystem so modules, firmware and certs only load from that read‑only source; Chrome OS runs it and recent patches add an enforced mode and readable device names. Yama ptrace ancestry checks stops a same‑UID attacker from tracing unrelated processes by walking parentage and offers whitelists for crash handlers. seccomp BPF filters let policies return allow/log/errno/trap/kill and work with libseccomp and mini_jail; watch out for user‑pointer races and prefer set_no_new_privs or an LSM like Landlock.
AI-written summary · about
chapters (5)
related talks
08mSubsystem Update: Seccomp, Yama, and LoadPin
19mSeecomp
01h 03mUsing seccomp to limit the Linux kernel attack service
01h 21mTutorial: The Why and How of libseccomp
36mSeccomp For Developers - Writing More Secure Applications
59mGetting Started with Embedded Linux Security
44mSeccomp for Developers - Making Applications Simply More Secure
26mReinventing Seccomp for Fun and Profiles