Live briefing
Everything about Seccomp
Sandbox facility for Linux kernel
seccomp is a computer security facility in the Linux kernel. seccomp allows a process to make a one-way transition into a "secure" state where it cannot make any system calls except exit , sigreturn , read and write to already-open file descriptors. Should it attempt any other system calls, the kernel will either just log the event or terminate the process with SIGKILL or SIGSYS. In this sense, it does not virtualize the system's resources but isolates the process from them entirely. Wikipedia →
🧠Start here: a 6-step reading path
- Read the overview: SeccompA 5-minute orientation
- Read the landmark paper: The devil is in the detail: Generating system call whitelist for Linux seccompCited 11 times
- Go sideways: Io uringA closely related topic
- Go sideways: Sandbox (computer security)A closely related topic
đź“– Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
đź“š Books worth reading
Open Library didn't respond; try again in a moment.
đź”— Related topics
- Io uring Computer programming portal Linux portal io_uring is a Linux kernel system call interface for storage device asynchronous I/O operations. It addresses…
- Sandbox (computer security) In computer security, a sandbox is a security mechanism for separating running programs, usually in an effort to mitigate system failures and/or software…
- GVisor gVisor is an open-source container sandbox developed by Google that focuses on security, efficiency, and ease of use. It provides virtualization-like isolation…
- Flatpak Flatpak (formerly xdg-app) is a software packaging and deployment system made for Linux. It provides a sandbox environment in which users can run application…
- LXC Linux Containers (LXC) is an operating system-level virtualization method for running multiple isolated Linux systems (containers) on a control host using…
- Berkeley Packet Filter The Berkeley Packet Filter (BPF; also BSD Packet Filter, classic BPF or cBPF) is a network tap mechanism and packet filter which permits computer network…
- EBPF eBPF is a technology that can run programs in a privileged context such as the operating system kernel. It is the successor to the Berkeley Packet Filter…
- Snap (software) Snap is a software packaging and deployment system developed by Canonical for operating systems that use the Linux kernel and the systemd init system.…