Also known as: syscall · kernel API
A system call is the mechanism by which a user-space program requests a service from the kernel — such as opening a file, allocating memory, or sending network data — crossing the privilege boundary between application and kernel.
System calls are the entire attack surface between unprivileged code and the kernel, which makes them the focus of both exploitation and containment. Sandboxing technologies work largely by restricting which system calls a process may make.
Linux maintains strict backward compatibility for its system call interface — a longstanding rule that the kernel must not break user space — which is why binaries compiled decades ago still run on modern kernels.
Kernel
The kernel is the core of an operating system, responsible for managing memory, scheduling processes, and mediating all access between software and hardware. The Linux kernel is the component that makes a system 'Linux'.
seccomp
seccomp is a Linux kernel feature that restricts which system calls a process may make, reducing the kernel attack surface available to a compromised or untrusted program.
Container
A container is a process or group of processes running in isolation on a shared kernel, using namespaces for visibility isolation and cgroups for resource limits, packaged with its own filesystem and dependencies.
Privilege Escalation
Privilege escalation is the act of exploiting a flaw or misconfiguration to gain a higher level of access than originally granted, such as moving from an unprivileged user account to administrator or root.
Namespace
A Linux namespace is a kernel feature that gives a process an isolated view of a particular system resource — process IDs, network interfaces, mount points, hostnames — forming the primary isolation mechanism behind containers.