seccomp.

A Linux kernel facility that restricts which system calls a process can make, with the modern seccomp-BPF/eBPF mode enabling fine-grained per-syscall filters. It belongs to the Cryptography category of cybersecurity.

A Linux kernel facility that restricts which system calls a process can make, with the modern seccomp-BPF/eBPF mode enabling fine-grained per-syscall filters.

seccomp (secure computing mode) was added to Linux 2.6.12 in 2005 as a coarse 'strict' mode that limits a process to read, write, exit, and sigreturn. The modern seccomp-BPF mode, available since Linux 3.5 (2012), lets a process install a classic BPF program (or, more recently, eBPF) that inspects each system-call number and arguments and returns ALLOW, ERRNO, TRAP, KILL, or USER_NOTIF. Filters are inherited across fork/execve, cannot be relaxed once installed, and require either CAP_SYS_ADMIN or PR_SET_NO_NEW_PRIVS. seccomp is the syscall-filtering backbone of Docker, containerd, Kubernetes, systemd, Chrome and Firefox sandboxes, Android Zygote, OpenSSH privsep, and Linux microVMs such as Firecracker.

Defences for seccomp typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: seccomp-BPF, secure computing mode.