Mental model
Traditional Linux security treats root (UID 0) as an all-powerful superuser. POSIX Capabilities partition root privileges into fine-grained permissions. Seccomp (Secure Computing Mode) acts as a kernel firewall for system calls, intercepting and blocking dangerous syscalls before execution.
Process invokes System Call (e.g. ptrace)
Kernel passes Syscall number through Seccomp BPF Filter
Match Allowed List -> Execute Syscall
Match Denied List -> Return EPERM or SIGSYS signal
Process drops unneeded POSIX Capabilities
Theory
- POSIX Capabilities:
CAP_NET_ADMIN: Perform network configuration tasks.CAP_SYS_ADMIN: Overly permissive legacy root capability (mount, cgroups, eBPF).CAP_NET_BIND_SERVICE: Bind sockets to privileged ports (< 1024).
- Seccomp BPF: Uses BPF filters attached to
prctl(PR_SET_SECCOMP)to audit system call numbers and arguments. Default Docker/Kubernetes seccomp profiles block ~40 dangerous syscalls (e.g.reboot,kexec_load,ptrace).
json(11 lines)
1{
2 "defaultAction": "SCMP_ACT_ERRNO",
3 "architectures": ["SCMP_ARCH_X86_64"],
4 "syscalls": [
5 {
6 "names": ["read", "write", "exit", "sigreturn", "epoll_wait", "futex"],
7 "action": "SCMP_ACT_ALLOW"
8 }
9 ]
10}
bash(3 lines)
1# Drop all capabilities in Docker container and add back only NET_BIND_SERVICE
2docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE --security-opt seccomp=default_profile.json my_app:latest
Alternatives and trade-offs
- Running Unrestricted Container Root: High security risk; a container breakout compromises the host kernel.
- Capabilities Drop + Seccomp BPF: Strict principle of least privilege; restricts process execution capability even if an attacker gains root code execution.
Failure modes and misconceptions
- Granting
--privilegedFlag in Docker: Passing--privilegeddisables all seccomp filters, grants ALL capabilities, and disables AppArmor/SELinux protection, completely invalidating container isolation boundaries. - Blocking Required Syscalls: Overly restrictive custom seccomp profiles blocking syscalls like
epoll_createorfutexcause applications to crash instantly withSIGSYSorEPERMerrors on startup.
Reflect before revealing the guide
Decision scenario
Enforce --cap-drop=ALL and attach restrictive Seccomp BPF profiles to all containerized workloads to enforce the principle of least privilege in production.
Learning outcomes
- Drop unneeded root capabilities using POSIX Capabilities.
- Build custom Seccomp BPF profiles to block dangerous system calls.
- Prevent container breakout vulnerabilities by eliminating
--privilegedflags.
Trade-offs
Capabilities and Seccomp provide robust process sandbox hardening, but require auditing application system call dependencies to avoid blocking required syscalls.