seccomp — Unsafe at any speed
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
seccomp() is fundamentally broken as a syscall filtering mechanism due to three core problems: syscalls change depending on libc version and architecture without recompilation, library functions make surprising and order-dependent syscalls (e.g. printf() calling newfstatat), and there's no way to express high-level intent like 'only use already-open file descriptors' without enumerating dozens of low-level syscalls that can change at any time. The author argues OpenBSD's pledge() and unveil() are the correct approach, expressing capability groups rather than individual syscalls. For Linux, Landlock is mentioned as a future possibility, with unshare() as a current imperfect alternative.
Table of contents
seccomp , briefly1. Syscalls change. Sometimes without even recompiling2. Surprising syscalls3. (hinting at the solution): There’s no groupingThe solutionBut what about Linux?LinksSort: