https://lesitedefrancois.be/en/tags/syscall/Recent content in Syscall on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/seccomp/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/seccomp/<p><strong>seccomp (Secure Computing Mode)</strong> is a Linux kernel facility, activated by the <code>seccomp(2)</code> syscall, that restricts which system calls a process may subsequently invoke. In its original <code>SECCOMP_SET_MODE_STRICT</code> form (2005) it was a blunt instrument: the process could call only <code>read</code>, <code>write</code>, <code>_exit</code>, and <code>sigreturn</code>. The operationally useful form is <code>SECCOMP_SET_MODE_FILTER</code>, introduced in kernel 3.5 (2012), which accepts a <strong>BPF</strong> (classic BPF, predating eBPF) filter program that receives each syscall&rsquo;s number and arguments and returns one of several verdicts: <code>ALLOW</code> (continue normally), <code>ERRNO</code> (return a specified error to the process), <code>KILL_PROCESS</code> or <code>KILL_THREAD</code> (terminate immediately without giving the process a chance to handle signals), <code>TRAP</code> (deliver <code>SIGSYS</code>), or <code>TRACE</code> (notify a ptracer). Once installed, a seccomp filter cannot be removed, and child processes created by <code>fork()</code> or threads created by <code>clone()</code> inherit it. Filters may only add restrictions, never loosen them — so a chain of filters is the intersection of all their allowlists. The filter runs entirely in the kernel, in BPF bytecode verified for safety, before the syscall implementation is entered, making it extremely low-overhead relative to the security it provides.</p>