Secure Computing Profiles: Declarative Syscall Filtering
In this lesson, you will learn how to architect and enforce JSON-based filter lists to constrain the system calls (syscalls) a process can execute, significantly hardening your containerized workloads.
While seccomp provides the kernel-level mechanism to filter syscalls, managing these filters manually for complex containers is error-prone. Secure Computing Profiles—often implemented via JSON files—provide a structured, declarative way to define exactly what a process is allowed to do. Instead of writing low-level BPF (Berkeley Packet Filter) programs, you draft a policy that specifies an defaultAction (e.g., SCMP_ACT_ERRNO or SCMP_ACT_KILL) and an allowlist of specific syscalls.
Drafting the Profile
A JSON-based seccomp profile acts as a security contract. For example, if your containerized application only needs to perform basic I/O and process management, you can explicitly forbid dangerous syscalls like mount or reboot.
Consider this minimalist profile excerpt:
{
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": ["SCMP_ARCH_X86_64"],
"syscalls": [
{
"names": ["read", "write", "exit", "nanosleep"],
"action": "SCMP_ACT_ALLOW"
}
]
}
By setting the defaultAction to SCMP_ACT_ERRNO, any syscall not explicitly listed in the syscalls array will be blocked, and the process will receive an error code instead of executing the kernel function. This "deny-by-default" approach minimizes your attack surface. If an attacker attempts to trigger a syscall outside this list, the kernel immediately intervenes, preventing potential exploitation of vulnerabilities in rarely used or complex syscall interfaces.
Enforcement
When launching a container, you pass this JSON file to the container runtime (like runc). The runtime parses your JSON, generates the corresponding BPF code, and applies the filter to the container's initial process. Because this happens before the process starts, the sandbox is effectively "locked down" before the application ever gains execution control.
This declarative approach allows you to version-control your security policies alongside your code, ensuring that the privilege level of your processes is consistent, audited, and strictly enforced across environments.
Key Takeaway: Secure Computing Profiles transform complex syscall filtering into declarative, auditable JSON policies, ensuring that containers operate only within a strictly defined, minimal set of kernel permissions.