seccomp, or secure computing, is a Linux syscall that aims to improve system security. By using seccomp, a process can limit the system calls available to itself.

seccomp server a similar purpose to the pledge syscall available on OpenBSD and Serenity OS.

Modes

There are two seccomp modes with different trade-offs, these are called Strict Mode and Filter Mode.

Strict mode

Strict mode is the original seccomp mode that was available before the introduction of filter mode. In strict mode, the only system calls that a process is permitted to make are read, write, exit and sigreturn. Attempting to perform any other system call results in the process getting terminated with a SIGKILL.

Filter mode

Filter mode allows more granular control of system calls by checking every syscall through a BPF program.