In this lesson, you will learn how to use Seccomp (Secure Computing Mode) to shrink the "attack surface" of a binary by restricting the specific system calls it is allowed to make.
What is Seccomp?
When a program runs, it constantly talks to the Linux kernel via system calls (syscalls). Whether it needs to read a file, open a network connection, or allocate memory, it asks the kernel to perform these actions. Often, a specific application only needs a tiny fraction of the hundreds of available syscalls. Seccomp acts as a security filter, allowing you to tell the kernel: "Only let this binary perform these specific actions, and kill it if it tries to do anything else."
Implementing a Filter
By applying a Seccomp filter, you are enforcing the Principle of Least Privilege at the kernel level. Even if an attacker finds a vulnerability in your application and attempts to inject code, they will be unable to execute dangerous syscalls (like execve to launch a shell) if your filter hasn't explicitly allowed them.
For example, imagine a simple calculator binary that should never need to change file permissions. Using a tool like libseccomp or standard container runtimes (which apply these filters for you), you can define a "whitelist." If the process tries to call chmod, the kernel will intercept the request and immediately terminate the process:
// Conceptually, you define a list of allowed calls:
scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL); // Default: Kill on forbidden
seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit), 0);
seccomp_load(ctx);
Why This Matters
Traditional permissions (UGO) and ACLs control what a user can access, but they don't stop a compromised binary from abusing the kernel's functions. By restricting the syscall interface, you ensure that even a successful exploit is "caged." The process is prevented from reaching out to parts of the system it has no business touching, significantly raising the bar for any potential attacker.
Key Takeaway: Seccomp enforces security at the kernel-binary interface by explicitly whitelisting the system calls an application is permitted to use, effectively silencing the rest of the kernel's capabilities.