Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Seccomp is a Linux kernel feature that limits which system calls a process can make. A filter can allow a call, reject it with an error, log or trap it, terminate the caller, or send it to a userspace listener. It reduces the kernel interface available to an application, but it does not by itself make the application a complete sandbox.
What does seccomp restrict?
Linux system calls are the main route from an application in user space to kernel services. A seccomp filter evaluates information about a system call as the process attempts to make it, then tells the kernel what to do. Depending on the filter, it can distinguish calls by syscall number, syscall architecture, instruction pointer, and values in the syscall argument registers. Linux kernel documentation describes the filter interface and its constraints.
As an Amazon Associate I earn from qualifying purchases.
A filter does not inspect arbitrary application data. In particular, its BPF program cannot follow a pointer argument and read the data it points to. This limits what a filter can express, but also avoids a class of time-of-check/time-of-use problems that could arise if a policy inspected mutable data through pointers.
How does a seccomp filter work?
Install the filter
In filter mode, the process installs a small BPF program using either prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, ...) or the seccomp() system call. Installation requires the process to have set no_new_privs or to have CAP_SYS_ADMIN in its user namespace. These interfaces and requirements are documented in the Linux kernel seccomp filter documentation.
#1 Best Overall
Evaluate each call
When the process makes a syscall, the kernel runs the filter against the syscall metadata and register arguments. The filter’s result selects an action; it is not necessarily a simple yes-or-no decision. The kernel supports actions including:
SECCOMP_RET_ALLOW: permit the syscall.SECCOMP_RET_ERRNO: reject it and return an error.SECCOMP_RET_TRAP: raiseSIGSYS.- Kill actions: terminate the calling thread or process.
SECCOMP_RET_LOG: allow the call while requesting that it be logged.SECCOMP_RET_TRACE: notify a ptrace tracer.SECCOMP_RET_USER_NOTIF: send a notification to a userspace listener.
If filters are stacked, the kernel applies action precedence to their results. A later filter can further narrow what is permitted, but stacking does not turn seccomp into a general-purpose policy language. See the kernel documentation on filter actions.
Pass restrictions to child processes
Eligible child processes inherit their parent’s filters. If the relevant process-creation and execution calls remain available, restrictions continue across fork, clone, and execve. This helps keep a process tree within the same syscall limits. Installing a filter does not automatically grant a process a broader set of permissions later.
Why syscall architecture checks matter
A filter should check the syscall architecture as well as the syscall number. Different syscall invocation conventions can assign different meanings to overlapping numbers, so a policy that checks numbers alone may allow an unintended call. The Linux kernel documentation calls this the biggest pitfall to avoid when filtering by syscall number. The kernel’s guidance explains the architecture check and related caveats.
Testing can also be surprising because some functions may run through the vDSO in userspace on one system but fall back to a kernel syscall on another. A test that exercises a function successfully on one machine may not show how the filter behaves on a different kernel, architecture, or execution path.
Is seccomp a sandbox?
No. The Linux kernel documentation states, “System call filtering isn’t a sandbox.” Seccomp reduces the kernel surface an application can reach, but it does not on its own define filesystem access, network policy, information flow, or application-level behavior. The kernel documentation recommends treating syscall filtering as a mechanism for reducing exposed kernel functionality.
Use seccomp alongside controls that address other parts of the threat model, such as namespaces, Linux capabilities, and an appropriate Linux Security Module (LSM) policy. Each control governs a different boundary; a syscall allowlist cannot substitute for the others.
What does a seccomp profile mean in Docker?
Docker says containers use its default seccomp profile unless an operator overrides it. The documented default is an allowlist: calls are denied by default, with specific calls allowed. Docker currently describes the profile as disabling around 44 system calls out of 300+. That is Docker’s documented, version-sensitive characterization—not a universal count for Linux or a guarantee that every Docker release, architecture, and kernel behaves identically. Docker’s seccomp profile documentation includes the profile, argument-specific rules, and configuration details.
An operator can supply a JSON profile with --security-opt seccomp=.... Docker recommends retaining the default profile in ordinary cases rather than replacing it without a need. The documented rules and caveats include behavior involving AF_ALG, AF_VSOCK, and 32-bit socketcall; the actual effect depends on the installed Docker and kernel environment.
Rank #4
What are the seccomp options in Kubernetes?
Kubernetes supports seccomp settings at the Pod or individual-container level. The profile choice determines who supplies the rules and how much responsibility the operator has for maintaining them:
| Setting | Who supplies the profile? | Practical implication |
|---|---|---|
RuntimeDefault |
The installed container runtime. | Uses that runtime’s default profile; exact rules can vary by runtime and version. |
Localhost |
The operator, using a profile installed on the node. | Offers a custom policy, but the profile must be distributed and maintained on nodes. |
Unconfined |
No seccomp profile is applied. | Does not restrict syscalls through seccomp. |
Kubernetes notes that a privileged container runs unconfined. Its seccomp documentation also explains the available profile types and their configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
RuntimeDefault is not one universal profile
RuntimeDefault delegates the policy to the container runtime. Profiles can differ between CRI-O and containerd, and between their versions; kernel, architecture, and runtime support also matter. Kubernetes made the kubelet’s seccompDefault feature stable in v1.27, but an operator must enable it on a node. When enabled, workloads without an explicit profile use RuntimeDefault; that does not mean every Kubernetes cluster has the setting enabled. Kubernetes documents the setting and its behavior.
Best Value
How to choose and maintain a profile
Runtime defaults are a practical starting point for many workloads. A custom profile can further reduce exposed syscalls, but tighter rules may break an application when its behavior changes or it takes a previously untested path. Kubernetes warns that custom profiles can leave allowed syscalls exploitable and can become difficult to manage at scale. Its guidance on Linux kernel security constraints recommends testing workloads and considering the operational costs.
- Check which runtime, runtime version, kernel, and architecture will execute the workload.
- Exercise the application’s relevant paths, including startup, normal operation, maintenance, and failure handling.
- Monitor for denied calls and compatibility problems before rolling out a restrictive profile broadly.
- Re-test after application, runtime, or node updates; syscall needs and default rules can change.
- For a node-managed Kubernetes
Localhostprofile, keep the profile consistent wherever the workload may be scheduled.
When userspace notification is appropriate
SECCOMP_RET_USER_NOTIF can forward selected syscall events to a userspace listener, allowing a supervisor to participate in handling them. It is an advanced mechanism, not a general safe way to implement security policy. The Linux man-pages caution that notifications can be interrupted and that reading data from a tracee’s memory requires care. The seccomp_unotify(2) manual page describes the interface and its limitations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
