Lesson 4.34: Seccomp: a system call allow-list
A program talks to the kernel through a few hundred system calls, and a document converter needs only a fraction of them. Seccomp lets systemd hand the kernel an allow-list for a service: anything outside it kills the process or fails with an error, before the kernel code behind it ever runs. In the lab Northwind's converter processes files from customers, and one invoice carries a macro that reaches for perf_event_open, a kernel interface a converter never needs. You measure what the converter really uses, test the attack with and without a filter, choose a failure mode, and make the filter permanent.
19 min
You will learn to
- Explain what seccomp filters and why it reduces kernel attack surface
- Count a program's system calls with strace -c
- Test SystemCallFilter with systemd-run
- Choose between SIGSYS and SystemCallErrorNumber=EPERM
- Make the filter permanent with a drop-in
Key terms
- System call
- A request from a program to the kernel; Linux has a few hundred.
- Seccomp
- A kernel feature that checks each system call of a process against a filter.
- SystemCallFilter=
- systemd setting: allowed calls or groups (or ~ for a deny list).
- @system-service
- systemd's group of calls typical services use; excludes @debug, @mount, @module, @reboot and similar.
- SIGSYS
- The signal that kills a process making a filtered call (status=SYS).
- SystemCallErrorNumber=
- Return this errno for filtered calls instead of killing.
← Auditing the PAM stack · All lessons · Privileged containers and capabilities →