Handling New Syscalls in Seccomp Filters
Talkat Linux Security Summit North America 2025 · on Friday, 2025-06-27· at 11:55· Bluebird Ballroom (BBB) 3GH·
summary
Proposal adds a max-kernel-version attribute to libseccomp so filters record the kernel they were written for and a second attribute that sets the action for any syscall newer than that, commonly return ENOSYS for unknown syscalls. Implementation generates a per-syscall BPF table (opt‑in), works for both allow and deny lists, may produce ~400 BPF instructions per arch so a binary‑tree mitigation exists, and relies on an upstream syscall‑version table (PR linked).
AI-written summary · about
chapters (11)
- 0:00Handling new syscalls in seccomp
- 3:15New syscalls in seccomp filters
- 7:09Proposed solution for unknown syscalls
- 10:22Advantages and disadvantages
- 13:55Filter creation and testing
- 16:43Syscall differences across architectures
- 20:42User feedback and attributes
- 22:31Paul Moore's perspective
- 24:37BPF filter implementation
- 28:42Performance and future directions
- 30:32Conclusion and Q&A
related talks
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
52mUsing Seccomp to Limit the Kernel Attack Surface
01h 03mUsing seccomp to limit the Linux kernel attack service
35mRevisiting eBPF Seccomp Filters
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp
26mReinventing Seccomp for Fun and Profiles
28mUnderstanding programmable system call security with Secomp-eBPF in Linux.
01h 21mTutorial: The Why and How of libseccomp