Designing to the Worst Case Scenario - Practical System Call Filtering with Seccomp
summary
Practical instructions for using the kernel Seccomp feature and libseccomp to restrict syscalls on embedded Linux, showing exact deployment paths: direct child-process filters, SystemCallFilter lines in systemd service units, LXC seccomp profile files, and the Docker default profile which denies ~44 calls. Examples show allowed/deny strategies, actions like kill or errno, parameter-matching rules for fine-grained limits, and a measured surprise: a trivial single-process container needs about 48 syscalls allowed to start. A systemd demo applying a deny rule fails as expected.
AI-written summary · about
chapters (11)
- 0:00Seccomp and system call filtering
- 3:34Worst case in security
- 7:54Seccomp and Linux system calls
- 10:02Seccomp filter setup
- 13:37Finding app system calls
- 16:47Seccomp in system init
- 19:57Systemd and seccomp
- 21:02Seccomp with LXC
- 23:46Seccomp with Docker
- 25:54Practical worst case design
- 28:48Live demo: systemd seccomp
related talks
01h 03mUsing seccomp to limit the Linux kernel attack service
52mUsing Seccomp to Limit the Kernel Attack Surface
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
44mSeccomp for Developers - Making Applications Simply More Secure
34mSeccomp: What Can It Do For You?
26mReinventing Seccomp for Fun and Profiles
36mSeccomp For Developers - Writing More Secure Applications
01h 21mTutorial: The Why and How of libseccomp