seitan: A plant-based recipe against syscall anxiety
summary
Seitan proposes a declarative JSON-based framework that maps filtered system calls to privileged actions using BPF and seccomp notifiers, compiling recipes with a cooker into BPF filters plus a bytecode of matches/actions evaluated by satanitor. Demos show argument matching (path/string), error injection (returning success or -1), and impersonated mkdev inside a rootless container to create a character device without CAP_MKNOD. Microbenchmarks on ~10 million synthetic events run in ~7–8.2 seconds, showing feasible overhead.
AI-written summary · about
chapters (16)
- 0:00Seitan and system calls
- 1:04System calls and security
- 2:27Containers vs VMs security
- 4:33BPF and syscall filtering
- 7:24Seitan and declarative approach
- 9:30Why a declarative system call management tool
- 11:37Testing and profiling with Seitan
- 13:07Seitan JSON recipes
- 14:33Seitan's BPF program deep dive
- 18:31User-space monitor and actions
- 21:26Security considerations and limitations
- 23:32Live demo setup
- 27:31Demo: Socket manipulation
- 28:37Demo: Character devices
- 32:09Key takeaways and plans
- 33:56Q&A
related talks
42mSandboxing a Linux application
38mSandboxing in Linux with zero lines of code
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp
44mSeccomp for Developers - Making Applications Simply More Secure
01h 03mUsing seccomp to limit the Linux kernel attack service
26mReinventing Seccomp for Fun and Profiles
01h 25mSandboxing a Linux Application
32mImplementing and Validating Linux Cyber Security Requirements: SEAPATH, a Case Study