Learn Seccomp - Arg Filters & Architecture Handling

#Introduction

In episode 4 you wrote your first filter that filtered by syscall name. But filtering by name alone is often not enough. Consider the socket syscall: it's used to create TCP sockets (AF_INET) that connect an application to the outside network — and also UNIX sockets (AF_UNIX) that only communicate between processes on the same machine. You might want to allow one but deny the other — and the difference is only visible in the syscall's arguments.

This episode covers two advanced libseccomp capabilities: argument filters with SCMP_CMP, and architecture handling for multi-architecture systems. Both are key to writing truly precise and secure filters.

#What Is an Argument Filter?

An argument filter is a rule that filters syscalls based on argument values, not just names. Recall seccomp_data from episode 2: the kernel provides six syscall arguments (args[0] through args[5]) to the BPF program. libseccomp exposes these through the SCMP_CMP parameter in seccomp_rule_add.

seccomp_rule_add(ctx, action, syscall, argc, SCMP_CMP(...), ...);

The argc argument states how many argument conditions must be satisfied (can be 0, 1, or more). If argc is greater than zero, each SCMP_CMP(...) condition must evaluate true — like an AND chain.

One important limitation you must understand from the start: the seccomp kernel only compares argument values, not the contents of the memory the arguments point to. You can compare pointer values, but you can't read the string a pointer points to. To filter based on file path contents (for example, "only allow opening /etc/passwd"), you need a different mechanism like Landlock — not pure seccomp.

#SCMP_CMP Operators

SCMP_CMP supports six comparison operators. The general form is SCMP_CMP(index, op, ...) where index is the argument position (0 through 5):

#Example: Restricting socket to AF_UNIX Only

Let's build a more precise filter: default-deny, but allow socket only when its domain is AF_UNIX (value 1). AF_INET and other sockets will be denied with EPERM.

#include <seccomp.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/socket.h>
 
int main(void) {
    scmp_filter_ctx ctx;
    int fd;
 
    /* 1. Default: deny everything with EPERM */
    ctx = seccomp_init(SCMP_ACT_ERRNO(EPERM));
    if (ctx == NULL) {
        perror("seccomp_init");
        return 1;
    }
 
    /* 2. Allow socket only for the AF_UNIX domain */
    if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1,
                         SCMP_CMP(0, SCMP_CMP_EQ, AF_UNIX)) != 0) {
        perror("seccomp_rule_add socket");
        return 1;
    }
 
    /* 3. Allow writing to stdout so the program can print */
    if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
                         SCMP_CMP(1, SCMP_CMP_EQ, STDOUT_FILENO)) != 0) {
        perror("seccomp_rule_add write");
        return 1;
    }
 
    /* 4. Allow exiting cleanly */
    if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0) != 0) {
        perror("seccomp_rule_add exit_group");
        return 1;
    }
 
    /* 5. Install the filter */
    if (seccomp_load(ctx) != 0) {
        perror("seccomp_load");
        return 1;
    }
    seccomp_release(ctx);
 
    /* 6. Testing */
    fd = socket(AF_INET, SOCK_STREAM, 0);
    printf("socket AF_INET -> %s\n", fd < 0 ? strerror(errno) : "succeeded");
 
    fd = socket(AF_UNIX, SOCK_STREAM, 0);
    printf("socket AF_UNIX -> %s\n", fd < 0 ? strerror(errno) : "succeeded");
 
    return 0;
}

Let's dissect the argument filter part. For the socket rule:

seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1,
                 SCMP_CMP(0, SCMP_CMP_EQ, AF_UNIX));

• SCMP_SYS(socket) — the syscall being filtered.
• 1 — the number of argument conditions.
• SCMP_CMP(0, SCMP_CMP_EQ, AF_UNIX) — argument 0 (domain) must equal AF_UNIX.

Meaning: socket is allowed only if its first argument equals AF_UNIX. Sockets with any other domain fall through to the default EPERM action.

For the write rule, we do the same for argument 1 (the fd):

SCMP_CMP(1, SCMP_CMP_EQ, STDOUT_FILENO)

write is only allowed if the file descriptor is stdout — no other syscall can write to any file except stdout. This is an example of a very strict "least privilege" pattern.

Compile and run:

gcc -o filter-socket filter_socket.c -lseccomp
./filter-socket
socket AF_INET -> Operation not permitted
socket AF_UNIX -> succeeded

#Masked Equality: Restricting File Access Modes

Now let's see SCMP_CMP_MASKED_EQ in action. Imagine we want to only allow openat in read-only mode. On Linux, bits 0-1 of the flags argument are the access mode: O_RDONLY (0), O_WRONLY (1), O_RDWR (2). We can block every openat that requests write access:

#include <fcntl.h>
 
/* deny-list: reject openat calls requesting write access */
/* (arg & (O_WRONLY|O_RDWR)) == 0 means read-only */
seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(openat), 1,
                 SCMP_CMP(2, SCMP_CMP_MASKED_EQ,
                          O_WRONLY | O_RDWR, O_WRONLY | O_RDWR));

The part SCMP_CMP(2, SCMP_CMP_MASKED_EQ, O_WRONLY | O_RDWR, O_WRONLY | O_RDWR) means: if (flags & (O_WRONLY | O_RDWR)) == (O_WRONLY | O_RDWR) — that is, if the access mode bits indicate write — then the syscall is denied. Since we're using a deny-list (default SCMP_ACT_ALLOW), openat with O_RDONLY remains allowed.

#Architecture Handling

Seccomp filters are architecture-specific: every architecture has different syscall numbers, and the BPF program must know which architecture is running. That's why seccomp_data includes the arch field.

#Native ABI and Other Architectures

When you create a context with seccomp_init, libseccomp by default follows the native ABI — the main architecture of the running process (e.g. x86_64). You can add other architectures with seccomp_arch_add:

#include <seccomp.h>
 
/* Context follows the native architecture (e.g. x86_64) */
scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ERRNO(EPERM));
 
/* Add support for 32-bit i386 and arm64 */
seccomp_arch_add(ctx, SCMP_ARCH_X86);
seccomp_arch_add(ctx, SCMP_ARCH_AARCH64);

Every rule you add is automatically applied to all registered architectures — libseccomp handles the syscall number mapping across architectures internally. That's why you don't need to write the architecture-check prologue by hand (we saw it when disassembling in episode 4).

#The Danger of x32 Syscall Multiplexing

Now for the often-overlooked but dangerous part: the x32 ABI. Linux x86_64 actually has three ABIs a single process can use:

1. x86_64 — the normal 64-bit ABI (standard syscall numbers).
2. i386 — the 32-bit ABI (32-bit syscall numbers).
3. x32 — the "32-bit pointers, 64-bit registers" ABI that uses x86_64 syscall numbers but with bit 30 set (e.g. read becomes syscall number 0x40000000 + 0).

The danger is clear: if your filter allows read on the x86_64 ABI, a malicious program can invoke the same syscall through the x32 ABI — and if the filter doesn't check the architecture, that rule may be bypassed. Syscall multiplexing like this is a classic hole in hand-written seccomp filters. libseccomp handles this automatically: when you register SCMP_ARCH_X86_64, libseccomp also adds x32 ABI handling in the BPF prologue — ensuring x32 syscalls can't slip past rules meant for x86_64. This is one of the strongest reasons to always use libseccomp rather than writing BPF by hand.

#Conclusion

In episode 5 you mastered two advanced capabilities:

• Argument filters with SCMP_CMP: EQ, NE, LT, LE, GT, GE, and MASKED_EQ — filtering syscalls based on argument values.
• Real examples: restricting socket to AF_UNIX only, and restricting write to stdout.
• Architecture handling: native ABI, adding SCMP_ARCH_X86 / SCMP_ARCH_AARCH64, and the x32 syscall multiplexing danger that libseccomp handles automatically.

With these capabilities, you can now write precise, secure seccomp filters for your own applications. In the next episode 6, we'll cover the most modern feature: seccomp user notification (SECCOMP_RET_NOTIFY) — letting a supervisor in user-space make decisions about certain syscalls dynamically, and how this changes the way we design sandboxes. See you then!