seccomp-BPF
kernel-featureopen sourceA Linux facility that filters which a process may make, expressed as a BPF (Berkeley Packet Filter) program over the number and scalar arguments.
documentedKernel docs: seccomp_filter ↗
seccomp-BPF installs a kernel-enforced filter at the boundary. It sees the number and raw register arguments, but by design will not dereference pointer arguments, so it can ban a verb like ptrace outright, but cannot express which file a write targets. It is self-imposed, unprivileged, and inherited by children. It pairs with a filesystem mechanism (Landlock or bubblewrap) to cover what it cannot.
Notable syscalls
are the verbs a program asks the kernel for; each links to its man page.
Strengths
- Kernel-enforced, unprivileged, inherited by child processes
- Cheap, near-zero runtime overhead
- Can ban whole classes of dangerous syscalls (ptrace, mount, bpf)
Limitations
- Cannot inspect pointer arguments, so it cannot make path-based decisions
- Writing a correct allowlist is hard; a wrong filter breaks the program
- Shared kernel, a kernel LPE is below it