Tutorial: The Why and How of libseccomp
Talkat Linux Security Summit North America 2019 · on Monday, 2019-08-19· at 15:30· Sapphire D, Hilton San Diego Bayfront·
summary
Explains how libseccomp turns BPF syscall filters into a portable C/Python API, shows live C code that builds a whitelist vs blacklist filter, loads it into the kernel (irreversible for that process) and tests argument checks including a string pointer gotcha; warns that container runtimes hit ~300-rule whitelists with measurable slowdowns and describes stacked filters inheritance, audit/logging options and exportable raw BPF for bootstrapping — practical demo with compile/run errors and fixes.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 2:12Why use libseccomp
- 3:49What is call filtering
- 5:29Cisco filtering history
- 9:13BPF
- 11:26BPF Improvements
- 14:33Documentation
- 15:29Eye Chart
- 16:37Questions
- 20:18Whitelist vs Blacklist
- 22:22Other considerations
- 29:07Making a Simple C Program
- 41:42Making mistakes
- 47:27Improved logging
- 49:52Strace
- 50:34Exit
- 51:02Question
- 52:07Adding parameters
- 54:19Strings
- 55:20Printing
- 57:18String Matching
related talks
01h 03mUsing seccomp to limit the Linux kernel attack service
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
44mSeccomp for Developers - Making Applications Simply More Secure
52mUsing Seccomp to Limit the Kernel Attack Surface
28mUnderstanding programmable system call security with Secomp-eBPF in Linux.
35mRevisiting eBPF Seccomp Filters
26mReinventing Seccomp for Fun and Profiles
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp