Linux seccomp Notification Splits Syscall Entry From Supervisor Response

Thu, 17 Sep 2026 00:00:00 +0000

A seccomp filter can stop a task at syscall entry and turn that event into a message for another process. With SECCOMP_RET_USER_NOTIF, the kernel does not immediately execute the selected syscall. It creates a notification for a listener, blocks the calling task, and waits for a response that can supply a return value, inject a file descriptor, or permit the syscall to continue.

That boundary is narrower than general syscall emulation. The notification carries syscall metadata and register argument values, while memory referenced by pointer arguments remains in the target process. The target can also disappear or have its notification invalidated while a supervisor is making a decision. Those properties make identity, memory ownership, and response timing part of the interface contract.

Seccomp Filters Reduce Syscall Surface Without Forming a Complete Sandbox

Thu, 17 Sep 2026 00:00:00 +0000

Seccomp Filters Reduce Syscall Surface Without Forming a Complete Sandbox

A service can run with a short seccomp allowlist and still retain broad authority through file descriptors, filesystem permissions, network endpoints, and credentials. The filter may sharply reduce the kernel interfaces reachable through system calls, yet the process can remain capable of damaging actions through operations that are explicitly allowed. This is the central boundary of seccomp: it filters syscall attempts; it does not define the full security policy of a process.

Seccomp on Nalar

Linux seccomp Notification Splits Syscall Entry From Supervisor Response

Seccomp Filters Reduce Syscall Surface Without Forming a Complete Sandbox

Seccomp Filters Reduce Syscall Surface Without Forming a Complete Sandbox