Using seccomp to limit the Linux kernel attack service
summary
Explains how Linux seccomp actually limits syscalls by loading BPF bytecode filters that inspect syscall numbers and up to six register arguments, showing working examples that kill the process or return specific errno values; demonstrates building filters by hand and with libseccomp and notes a simple filter that inspects six BPF instructions and slows a tight getppid loop ~20x without JIT off; covers ABI/architecture pitfalls, how to block open/openat flags, and tools around seccomp and BPF.
AI-written summary · about
chapters (10)
- 0:00Seccomp introduction
- 3:14Reducing kernel attack surface
- 12:01BPF virtual machine role
- 27:18BPF instruction set
- 34:06Practical seccomp filter
- 45:17Arch-specific syscalls
- 52:05Tools for seccomp filters
- 56:26Performance impact
- 58:31Challenges with seccomp
- 1:01:19Resources and conclusion
related talks
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
52mUsing Seccomp to Limit the Kernel Attack Surface
28mUnderstanding programmable system call security with Secomp-eBPF in Linux.
01h 21mTutorial: The Why and How of libseccomp
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp
26mReinventing Seccomp for Fun and Profiles
44mSeccomp for Developers - Making Applications Simply More Secure
31mHandling New Syscalls in Seccomp Filters