Capsicum vs seccomp: Process Sandboxing — Vivian Voss

A deep comparison of two process sandboxing philosophies: FreeBSD's Capsicum and Linux's seccomp-bpf. Capsicum uses capability mode via cap_enter() to structurally remove access to global namespaces, leaving a process with only explicitly granted file descriptors. seccomp-bpf uses BPF filters to allowlist or blocklist syscalls at runtime. The key architectural difference is subtraction vs filtration: Capsicum removes what isn't needed, while seccomp restricts what is dangerous. The comparison uses Chromium's renderer sandboxing on both platforms as a concrete example, and CVE-2022-30594 (a seccomp bypass via PTRACE_SEIZE) to illustrate why structural removal is more robust than filter-based enforcement. FreeBSD base tools like tcpdump, dhclient, and OpenSSH already use Capsicum in production.