Using seccomp to limit the Linux kernel attack service - Michael Kerrisk - NDC Security 2023

The Linux seccomp (Secure Computing) facility allows developers to limit the set of system calls that an application can make. This can be used, for example, to prevent exploited code from executing arbitrary system calls. Seccomp is used in wide array of software including containers (Docker, Podman, etc.), web browsers, Firejail, Flatpak, and even strace. This presentation provides an introduction to the use of seccomp, looks at some some productivity aids to speed development of seccomp filters, and considers some caveats around the use of seccomp. Check out our new channel: NDC Clips: ‪@ndcclips‬ Check out more of our featured speakers and talks at https://ndcconferences.com/ https://ndc-security.com/