Software sandboxing: The basics (2025)
A technical write-up presents composable seccomp-BPF syscall allowlist policies for sandboxing unprivileged Linux applications, inspired by Docker, systemd, and OpenBSD pledge.
The article explains the basics of software sandboxing on Linux through syscall allowlists implemented as seccomp BPF programs, organized into composable categories such as BasicIo, CRuntime, Debug, Filesystem, and Credentials. The design draws on Docker's default profile, systemd's seccomp filter sets, and OpenBSD's pledge promises, while avoiding root-only and fingerprinting-friendly syscalls to reduce overhead. It also discusses compat quirks for x86, Wine, and 32-bit emulation, and points to Landlock for granular filesystem restrictions akin to pledge's rpath/wpath split.
- Composable syscall allowlist policies (Aio, BasicIo, CRuntime, Debug, Filesystem) for seccomp BPF
- Inspired by Docker default profiles, systemd seccomp sets, and OpenBSD pledge promises
- Avoids root-only and fingerprinting-prone syscalls to shrink BPF programs and overhead
- Split FileIo from Filesystem so processes can use already-open files and memfds
- Suggests Landlock for granular filesystem access mirroring pledge's rpath/wpath design
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | acce2f71779c54086962fefce3833d886c655f62 | has clone2, but // ia64 doesn't implement seccomp. c.f. // acce2f71779c54086962fefce3833d886c655f62 in the kernel. clone, clone3, execve, execveat, fork, getpg |
From the original article
6 min read at blog.emilua.org// These policies are heavily influenced by Docker's default profile. Further // - Avoid syscalls that need root anyway. The policies here are mostly meant to // be used by unprivileged users (not containers with root inside).
By blog.emilua.org by vinipsmaker · blog.emilua.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.