Seccomp For Developers - Writing More Secure Applications
summary
Seccomp integration shows concrete libraries and demos: Python and Crystal examples block execve so a simple webserver calling /bin/ls fails when the policy is active, and netcat bind gets killed under a seccomp rule. Kernel support is configurable since Linux 3.5 (2012); elasticsearch uses a ~600-line system call filter that forbids fork/exec, while Beats uses a deny-by-default list. Monitoring uses auditbeat + Elasticsearch + Kibana to collect and visualize violations; repository includes runnable Vagrant examples.
AI-written summary · about
chapters (14)
- 0:00Introduction to Seccomp
- 1:48Why Security Matters
- 3:54What is Seccomp
- 8:27Seccomp in Practice
- 10:32Untrusted Code Risks
- 14:06BPF Filter Basics
- 15:51Seccomp in Java
- 18:37Seccomp in Go
- 19:20Seccomp in Crystal
- 20:22Demo: Crystal Example
- 23:39Monitoring Violations
- 25:31Elastic Stack Monitoring
- 27:59Audit Beat Dashboard
- 29:02Summary and Takeaways
related talks
44mSeccomp for Developers - Making Applications Simply More Secure
34mSeccomp: What Can It Do For You?
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp
01h 03mUsing seccomp to limit the Linux kernel attack service
52mUsing Seccomp to Limit the Kernel Attack Surface
01h 21mTutorial: The Why and How of libseccomp
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
23mOverview and Recent Developments: seccomp and Small Linux Security Modules