https://linuxtransfer.com/tags/seccomp/Recent content in Seccomp on Linux SecurityHugoenSat, 25 Mar 2023 00:00:00 +0000https://linuxtransfer.com/post/seccomp/Sat, 25 Mar 2023 00:00:00 +0000https://linuxtransfer.com/post/seccomp/<h3 id="introduction-understanding-seccomp">Introduction: Understanding Seccomp</h3> <p>Seccomp is a Linux kernel feature that enables administrators to restrict the actions that a process can perform, thus providing an additional layer of security. It stands for &ldquo;secure computing mode&rdquo; and was first introduced in the 2.6.12 kernel. Seccomp is a powerful tool for enhancing the security of a Linux system, as it helps to mitigate the risks of exploitation from untrusted code and malware.</p> <h3 id="how-seccomp-works">How Seccomp Works</h3> <p>Seccomp works by limiting the system calls that a process can make. It does this by providing a list of allowed system calls that a process can make, and any system call not on this list is blocked. This list is often referred to as a &ldquo;filter.&rdquo; Seccomp operates in two modes: strict mode and filter mode. In strict mode, all system calls except for a whitelist of explicitly allowed ones are blocked. In filter mode, only the system calls explicitly listed in the filter are allowed, with all others being blocked.</p>