seccomp-engineering

What problem does it solve?

Seccomp-based kernel surface minimization reduces the attack surface of Linux processes by restricting syscalls to only what's necessary, helping prevent privilege escalation and unexpected behavior.

Core Features & Use Cases

• Policy design with minimal allowlists and default-deny posture.
• Arch-aware filtering with deterministic failure modes and argument filtering.
• Use cases: hardening services, containers, and daemons; auditing existing policies; integrating with container runtimes and systemd.

Quick Start

Profile a target binary with strace to enumerate required syscalls, then craft a minimal allowlist and apply it via prctl or systemd's SystemCallFilter.