Seccomp and Syscall Filtering

A backend service often needs only a small subset of the system calls Linux provides.

For example, an image-processing worker may need to read files, allocate memory, synchronize threads, and write results. It does not need to load kernel modules, configure network interfaces, mount filesystems, or reboot the machine.

Seccomp, short for secure computing, lets a Linux process restrict which system calls it and its descendants can make.

The filter examines each system call and decides what should happen based on the syscall and its arguments.

Seccomp reduces attack surface by exposing only the system calls an application actually needs.

Even if an attacker gains control of the process, they remain limited to that restricted system-call interface rather than the full Linux API.

This chapter develops the seccomp filter model, actions, architecture checks, inheritance, thread synchronization, argument filtering, and no_new_privs, then explains allowlist design, observation, testing, diagnosis, notification, and sandboxing limits.