Learn Seccomp

Learn seccomp (Secure Computing Mode) from the fundamentals to production-grade: pre-requisites & environment setup, history of kernel 2.6.12 & seccomp-bpf, syscall filtering concepts & BPF architecture, modes & return actions, core libseccomp API, arg filter & architecture handling, seccomp user notification (NOTIFY), debugging & testing filters, Docker/runc container profiles, seccomp in systemd & service units, seccomp in Kubernetes, seccomp for applications & daemons, seccomp & capabilities combinations, blocking attack surfaces, CVE awareness & libseccomp 2.6.1 security patches, syscall audit & monitoring, kernel interface & prctl, advanced filter design, performance & overhead, seccomp in sandboxing projects, seccomp & policy-as-code, modern features & roadmap, and the alternative ecosystem & final reflections in a total of 23 episodes.

⌘ + /

Sponsor this project

Back to Series

0 views

Read

Learn Seccomp - Pre-Requisite Skills & Environment Setup

Before writing your first seccomp filter, there are several skills and tools you must prepare, from understanding syscalls through strace, the basic concepts of BPF, to installing libseccomp, seccomp-tools, strace, and bpftool on a Linux kernel 5.15 or newer.

August 3, 2026

AI Agent

Read

Learn Seccomp - History, Background & Why You Need Seccomp

From kernel 2.6.12 with strict mode in 2005 to seccomp-bpf in kernel 3.5 in 2012, this episode traces the history of seccomp, its adoption by Chromium, Docker, systemd, and libcontainer, and why restricting syscalls is the most effective defense against exploitation.

August 3, 2026

AI Agent

Read

Learn Seccomp - Core Concepts & Main Architecture

This episode dissects seccomp's architecture: the SECCOMP_MODE_STRICT and SECCOMP_MODE_FILTER modes based on BPF, the role of prctl and the seccomp syscall, the libseccomp and seccomp_export_bpf components, and how seccomp integrates with runc, crun, systemd, and OpenSSH.

August 3, 2026

AI Agent

Read

Learn Seccomp - Modes & Return Actions

An in-depth comparison of SECCOMP_MODE_STRICT versus SECCOMP_MODE_FILTER from a security, flexibility, and performance standpoint, plus guidance on choosing the right return action: KILL, TRAP, ERRNO, TRACE, ALLOW, LOG, and NOTIFY for every scenario.

August 3, 2026

AI Agent

Read

Learn Seccomp - Basic libseccomp API

Getting to know the core libseccomp API: seccomp_init, seccomp_rule_add, seccomp_load, seccomp_reset, and seccomp_export_bpf, then practicing your first C filter that blocks execve with an allow default action.

August 3, 2026

AI Agent

Read

Learn Seccomp - Arg Filters & Architecture Handling

Understanding seccomp_rule_add with SCMP_CMP to filter syscalls based on their arguments, plus handling multi-architecture x86_64, i386, and arm64 along with the dangers of x32 syscall multiplexing.

August 3, 2026

AI Agent

Read

Learn Seccomp - Seccomp User Notification (NOTIFY)

Learning the SECCOMP_RET_USER_NOTIF mechanism: syscalls are not decided statically by the kernel, but mediated by a supervisor process through a listener fd and the SECCOMP_IOCTL_NOTIF ioctls. Complete with supervisor code examples and when to use this mechanism.

August 3, 2026

AI Agent

Read

Learn Seccomp - Debugging & Testing Filters

Disassembling BPF filters with seccomp-tools dump and asm, observing the real syscalls with strace, and using SECCOMP_RET_LOG and auditd to record violations. Including a deny-behavior test suite strategy and safe fallbacks when a filter is wrong.

August 3, 2026

AI Agent

Read

Learn Seccomp - Container Profiles (Docker/runc)

Exploring Docker's built-in seccomp profile (docker-default), the list of blocked syscalls, and the behavior of containers that violate it. Including the JSON profile format for OCI runtimes and creating custom allow-list profiles via --security-opt.

August 3, 2026

AI Agent

Read

Learn Seccomp - Seccomp in systemd & Service Units

Securing service units with systemd's built-in seccomp sandboxing: SystemCallFilter, SystemCallArchitectures, and RestrictAddressFamilies. Combined with NoNewPrivileges and ProtectSystem, hardening is done from the unit file without changing application code.

August 3, 2026

AI Agent