IT lexicon Security seccomp

seccomp

Security På svenska → Updated: 2026-05-24

Linux mechanism for whitelisting which syscalls a process is allowed to make — anything off the list kills the process (or returns EPERM).

The modern form, seccomp-bpf (2012), lets you write a BPF filter that inspects syscall numbers and arguments. Docker, Kubernetes, Chromium, systemd and Firefox all run with seccomp profiles by default — Docker's default profile blocks about 40 of ~330 syscalls (mount, kexec, reboot, ptrace, etc.).

Solid defense-in-depth against kernel exploits: even if an attacker RCEs your process, they can't reach syscalls not on the whitelist. Pair with capability-based privilege control and user namespaces.

← Back to the lexicon