Also known as: seccomp-bpf · syscall filtering
seccomp is a Linux kernel feature that restricts which system calls a process may make, reducing the kernel attack surface available to a compromised or untrusted program.
seccomp-bpf allows fine-grained filters that inspect system call numbers and arguments, permitting, denying, or trapping each. Container runtimes and browsers apply default profiles blocking system calls no normal workload needs.
Its effectiveness depends entirely on profile tightness. Default container profiles still permit a large fraction of the syscall surface for compatibility reasons, and bypasses typically involve reaching kernel functionality through a permitted call rather than defeating seccomp itself.
System Call
A system call is the mechanism by which a user-space program requests a service from the kernel — such as opening a file, allocating memory, or sending network data — crossing the privilege boundary between application and kernel.
Container
A container is a process or group of processes running in isolation on a shared kernel, using namespaces for visibility isolation and cgroups for resource limits, packaged with its own filesystem and dependencies.
Namespace
A Linux namespace is a kernel feature that gives a process an isolated view of a particular system resource — process IDs, network interfaces, mount points, hostnames — forming the primary isolation mechanism behind containers.
cgroups
cgroups (control groups) are a Linux kernel feature that limits, accounts for, and isolates the resource usage — CPU, memory, disk I/O, network — of a group of processes.
Privilege Escalation
Privilege escalation is the act of exploiting a flaw or misconfiguration to gain a higher level of access than originally granted, such as moving from an unprivileged user account to administrator or root.