Tag
seccomp
- Sep 26, 2026 The Shared Kernel Boundary and What Containers Cannot Isolate Why container isolation is a partition of kernel state rather than a hardware boundary, which attack surfaces remain, and how the layers of defence are composed. virtualization
- Jul 29, 2026 Supervising Syscalls with Seccomp User Notification How a filter can suspend a syscall and hand the decision to another process, what the notification structure carries, and why descriptor injection avoids the race that memory inspection cannot. virtualization
- Jun 3, 2026 Syscall Filtering and the Process as a Security Boundary How seccomp filters restrict a process to a fixed set of system calls, why argument inspection is limited by the kernel interface, and where the remaining escape routes lie. language runtimes
- May 25, 2025 seccomp-BPF and the Filtering of System Calls How a BPF program attached to a process inspects syscall numbers and arguments before dispatch, why argument filtering cannot dereference pointers, and what the return actions cost. operating systems
- Jul 20, 2024 Why a Seccomp Filter Cannot Inspect Syscall Arguments in Memory The pointer-versus-contents problem in syscall filtering, the race that makes dereferencing unsafe even if it were allowed, and the mechanisms that recover argument-aware policy without it. virtualization
- Jun 10, 2024 Seccomp Filters and the Cost of Interception How a classic BPF program attached to a thread filters system calls, what it can and cannot inspect, and why tracing every call changes latency by orders of magnitude. operating systems
- Jun 1, 2023 What a Seccomp Filter Can See of a Syscall The fixed 64-byte record a seccomp filter receives, why the architecture field decides whether the syscall numbers mean anything, and what the filter cost buys. virtualization
- Oct 4, 2022 Action Precedence When Seccomp Filters Stack How the kernel combines verdicts from multiple attached filters, why the winning action is chosen by a documented ranking rather than by numeric order, and how thread synchronization decides which filters exist at all. virtualization