Security Limits via Seccomp

In this lesson, you will learn how to shrink a process's attack surface by strictly filtering which system calls it is allowed to make using Seccomp.

What is Seccomp?

Seccomp (short for Secure Computing mode) is a security facility in the Linux kernel that acts as a gatekeeper for system calls. Normally, any process can request hundreds of different services from the kernel—like opening files, creating network connections, or changing process priorities. However, most programs only ever need a tiny fraction of these capabilities. If a process is compromised, an attacker will try to use these "extra" system calls to execute malicious code or escalate privileges.

Seccomp allows you to define a "filter" for a specific process. When the process tries to execute a system call, the kernel checks it against your rules. If the call isn't on the "allow" list, the kernel can terminate the process immediately or return an error, effectively neutralizing the threat.

How it Works in Practice

Think of a simple web server. It needs to read files and handle network traffic, but it should never need to change system time or mount new file systems. By applying a Seccomp filter, you "sandbox" the process:

// Conceptual filter logic
struct sock_filter filter[] = {
    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (offsetof(struct seccomp_data, nr))),
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_read, 0, 1), // Allow read
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),         // Kill if anything else
};

In this example, the kernel checks the system call number (nr). If the call is read, it proceeds; otherwise, it kills the process. By forcing a process to operate within a constrained environment, you ensure that even if an attacker gains control, they are trapped within a sandbox where their most powerful tools are disabled. This significantly reduces the kernel attack surface, as it limits the number of entry points an attacker can exploit.

Key Takeaway: Seccomp enforces a "least privilege" model at the kernel interface level by explicitly blocking unnecessary system calls, transforming a generic process into a specialized, hardened entity.