Tag
bpf
- Dec 29, 2025 Enforcing Sandbox Policy at BPF LSM Hooks How an eBPF program attached to a kernel LSM hook can decide a security question with access to kernel objects, and why the hook it chooses determines what it can express. virtualization
- May 25, 2025 seccomp-BPF and the Filtering of System Calls How a BPF program attached to a process inspects syscall numbers and arguments before dispatch, why argument filtering cannot dereference pointers, and what the return actions cost. operating systems
- Jun 10, 2024 Seccomp Filters and the Cost of Interception How a classic BPF program attached to a thread filters system calls, what it can and cannot inspect, and why tracing every call changes latency by orders of magnitude. operating systems
- Jun 1, 2023 What a Seccomp Filter Can See of a Syscall The fixed 64-byte record a seccomp filter receives, why the architecture field decides whether the syscall numbers mean anything, and what the filter cost buys. virtualization
- Oct 4, 2022 Action Precedence When Seccomp Filters Stack How the kernel combines verdicts from multiple attached filters, why the winning action is chosen by a documented ranking rather than by numeric order, and how thread synchronization decides which filters exist at all. virtualization