Virtualization · Cluster
Sandboxing
Syscall filtering and kernel isolation.
- 01 What a Seccomp Filter Can See of a Syscall The fixed 64-byte record a seccomp filter receives, why the architecture field decides whether the syscall numbers mean anything, and what the filter cost buys.
- 02 Action Precedence When Seccomp Filters Stack How the kernel combines verdicts from multiple attached filters, why the winning action is chosen by a documented ranking rather than by numeric order, and how thread synchronization decides which filters exist at all.
- 03 Why a Seccomp Filter Cannot Inspect Syscall Arguments in Memory The pointer-versus-contents problem in syscall filtering, the race that makes dereferencing unsafe even if it were allowed, and the mechanisms that recover argument-aware policy without it.
- 04 What a Namespace Isolates and What It Leaves Shared The eight namespace types, the resources each one partitions, and the state that stays global no matter how many namespaces a process joins.
- 05 How Capability Sets Split Root Authority The five capability sets a Linux process carries, the transitions between them at exec, and why dropping a capability is not the same as dropping a file permission.
- 06 Landlock Rulesets: Path Hierarchies and Access Masks How Landlock binds access rights to directory hierarchies instead of syscalls, how the handled-access mask determines what a ruleset can enforce, and where the model stops.
- 07 Supervising Syscalls with Seccomp User Notification How a filter can suspend a syscall and hand the decision to another process, what the notification structure carries, and why descriptor injection avoids the race that memory inspection cannot.
- 08 Escaping a Chroot Through Retained Directory Descriptors Why changing a process root does not confine a process that holds an open descriptor above it, how the classic escapes work, and what pivot_root and mount namespaces do differently.
- 09 Unprivileged User Namespaces and the Attack Surface They Open Why allowing any process to create a user namespace turns privileged kernel code paths into reachable ones, which subsystems are most exposed, and how the trade is bounded in practice.
- 10 Enforcing Sandbox Policy at BPF LSM Hooks How an eBPF program attached to a kernel LSM hook can decide a security question with access to kernel objects, and why the hook it chooses determines what it can express.