Linux Security

Cybersecurity 17 Sep 2026 7 min read

Seccomp Filters Reduce Syscall Surface Without Forming a Complete Sandbox

Seccomp Filters Reduce Syscall Surface Without Forming a Complete Sandbox A service can run with a short seccomp allowlist and still retain broad authority through file descriptors, filesystem permissions, network endpoints, and credentials. The filter may sharply reduce the kernel interfaces reachable through system calls, yet the process can remain capable of damaging actions through operations that are explicitly allowed. This is the central boundary of seccomp: it filters syscall attempts; it does not define the full security policy of a process.

Cybersecurity Linux Security

Cybersecurity 17 Sep 2026 6 min read

Memfd Seals Turn Shared Memory Into Monotonic File Policy

Memfd Seals Turn Shared Memory Into Monotonic File Policy A process prepares a binary object in memory, passes its file descriptor to another process, and expects the bytes to remain stable after validation. Ordinary shared memory does not provide that property by itself: another holder of writable authority can change the object after a check, resize it, or keep a writable mapping alive. Linux file seals provide a narrower contract. They remove selected mutation operations from a sealable file, and successfully added seals cannot later be removed.

Cybersecurity Linux Security

Cybersecurity 17 Sep 2026 7 min read

Landlock Rulesets Restrict Future Path Access, Not Open File Authority

Landlock Rulesets Restrict Future Path Access, Not Open File Authority A process opens a writable configuration file, installs a restrictive Landlock ruleset, and then continues running code that should have access only to a small working directory. The later policy can block a fresh attempt to open that configuration path, yet the descriptor obtained before confinement remains usable. The filesystem view has narrowed, but authority already materialized as an open file has not vanished.

Cybersecurity Linux Security