Safer Seccomp: Dead Syscalls Elimination
summary
Implements dead syscalls elimination by rewriting the .pushsection assembler semantics so the linker can garbage collect syscall-related sections, and by changing the syscall table to comment out unwanted entries then running link-time dead code elimination. Eliminating the KEEP() directive lets associated functions and data be dropped, reducing kernel image size by about 7% for tested builds, targets fixed embedded workloads, and the initial patch set receives positive maintainer feedback.
AI-written summary · about
related talks
19mSeecomp
26mReinventing Seccomp for Fun and Profiles
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp
44mSeccomp for Developers - Making Applications Simply More Secure
01h 03mUsing seccomp to limit the Linux kernel attack service
31mHandling New Syscalls in Seccomp Filters
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
08mSubsystem Update: Seccomp, Yama, and LoadPin