Hardening the Syscall Interface

Combine SECCOMP-BPF filters with MAC policies for multi-layered system call restriction.

Hardening the Syscall Interface

In this lesson, you will learn how to achieve defense-in-depth by layering SECCOMP-BPF filters with Mandatory Access Control (MAC) to create a robust, dual-layered restriction on your system calls.

While MAC systems like AppArmor or SELinux excel at controlling what a process can do with files, sockets, and capabilities, they don't always provide granular control over the raw system call interface. This is where SECCOMP-BPF (Secure Computing with Berkeley Packet Filter) shines. By combining both, you ensure that even if an attacker finds a way to bypass your MAC policy, the kernel will refuse to execute forbidden syscalls regardless of the application's credentials.

Layering the Defenses

Think of your MAC policy as the "gatekeeper" verifying identity and access, and your SECCOMP filter as the "physical lock" that only allows specific motions.

For instance, if you are running a web server that should never need to change its own ownership, you might write a MAC profile to deny chown file access. However, a malicious actor might attempt to trigger a raw sys_chown syscall to bypass file-level checks. By applying a SECCOMP filter, you can globally disable the chown syscall for that process entirely:

// A simplified BPF filter snippet
struct sock_filter filter[] = {
    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (offsetof(struct seccomp_data, nr))),
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_chown, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
};

When you combine these, the process is doubly protected. The MAC policy restricts high-level interactions with system objects, while the SECCOMP filter minimizes the "attack surface" of the kernel by pruning unused syscalls. This creates a trap: if the process attempts to perform an unauthorized action, the kernel kills it immediately; if the process tries to perform an authorized action in an unauthorized way, the MAC system blocks it. This multi-layered approach is the gold standard for container isolation and high-security services.

Key Takeaway: Combining SECCOMP-BPF with MAC policies provides a dual-layer defense that isolates processes from both unauthorized resource access and kernel-level exploitation.