seccomp-engineering

Implement minimal seccomp filters to reduce Linux kernel attack surface.

Updated Dec 4, 2025

Search Tags:#linux #bpf #sandboxing #container-security #policy-design #seccomp #system-call-filter

Ready to run

npx skills add https://github.com/jamieadams-nerd/umrs-project --skill seccomp-engineering

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: seccomp-engineering
Source: https://github.com/jamieadams-nerd/umrs-project/tree/main/.claude/skills/seccomp-engineering
Command: npx skills add https://github.com/jamieadams-nerd/umrs-project --skill seccomp-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Seccomp-based kernel surface minimization reduces the attack surface of Linux processes by restricting syscalls to only what's necessary, helping prevent privilege escalation and unexpected behavior.

Core Features & Use Cases

Policy design with minimal allowlists and default-deny posture.
Arch-aware filtering with deterministic failure modes and argument filtering.
Use cases: hardening services, containers, and daemons; auditing existing policies; integrating with container runtimes and systemd.

Quick Start

Profile a target binary with strace to enumerate required syscalls, then craft a minimal allowlist and apply it via prctl or systemd's SystemCallFilter.

Frequently Asked Questions about seccomp-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create a minimal seccomp filter to reduce the Linux kernel attack surface?▼

To create a minimal seccomp filter, profile your target binary with strace to enumerate required syscalls, then craft an allowlist and apply it via prctl or systemd's SystemCallFilter to enforce a default-deny posture.

Does seccomp filtering work with SELinux and namespaces for container security?▼

Yes, seccomp filtering works alongside SELinux and namespaces. You can apply runtime hardening for services and container runtimes to minimize the kernel attack surface while maintaining existing namespace isolation.

How do I design architecture-aware seccomp policies with argument filtering?▼

Architecture-aware seccomp policies are designed by building deterministic failure modes into your allowlists. You apply argument filtering to restrict syscall parameters while documenting high-risk syscalls that require careful evaluation.

What is the best way to audit existing seccomp policies for daemons and systemd units?▼

The best way to audit existing seccomp policies is to verify they enforce a deny-by-default posture. Check that systemd units and daemons use minimal allowlists and apply argument filtering to restrict high-risk syscalls.

Can I use seccomp to enforce a default-deny syscall policy in container runtimes?▼

Yes, you can enforce a default-deny syscall policy in container runtimes using seccomp. This reduces the kernel attack surface by ensuring processes can only execute the minimal set of explicitly allowed system calls.