Seccomp: Shrinking the Syscall Surface

Seccomp-bpf filters syscalls per thread. A denied call returns an error (or kills the process), which removes entire exploit primitives: mount, ptrace, bpf, unshare, raw sockets.

How it is used

• Container runtimes apply a default profile (Docker's is permissive but blocks the worst calls).
• Runtimes for untrusted code (gVisor, browsers) use tight allowlists.
• no_new_privs should accompany the filter so setuid binaries cannot regain privileges.

Practical guidance

1. Trace the workload's syscalls, then build an allowlist with argument filtering where possible.
2. Expect breakage on upgrades: new library versions may add syscalls.
3. Log denials during rollout, then enforce.
4. Combine with seccomp's SCMP_ACT_ERRNO rather than kill for easier debugging.

Limits

Seccomp filters syscalls, not their arguments in all cases, and does not stop logic bugs inside allowed calls. It reduces blast radius; it is not a sandbox by itself.

Takeaway: a syscall allowlist is one of the cheapest hardening steps for containerized workloads. Trace, allowlist, then enforce.