> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/web2-ctf/pwn.college/sandboxing/seccomp.md).

# seccomp

## Lecture

{% embed url="<https://youtu.be/hrT1xvxGKS4>" %}
seccomp
{% endembed %}

## Syscall Filtering

Unlike chroot, **seccomp** allows developers to write **complex rules** to:

* **whitelist** certain syscalls.
* **blacklsit** certain syscalls.
* whitelist/blacklist syscalls based on **argument variables**.

{% hint style="info" %}
seccomp rules are inherited by children processes!
{% endhint %}

To learn more about seccomp, you can read the [documentation](https://man7.org/linux/man-pages/man3/seccomp_rule_add.3.html). Here we learn how it works through an example.

## How does seccomp work?

seccomp uses the kernel functionality **eBPF (e**xtended **B**erkeley **P**acket **F**ilter). eBPFs are programs that run in an in-kernel, **"provably-safe"** virtual machine. It is used with `seccomp()` to apply syscall filters to processes.

**My comment:**

Interestingly enough, ZDI recently published a blog post on **CVE-2021-31440**, which is a bug that bypassed the eBPF verification and resulted in an out-of-bounds (OOB) access in the Linux kernel. You can read more about it here:

{% embed url="<https://www.zerodayinitiative.com/blog/2021/5/26/cve-2021-31440-an-incorrect-bounds-calculation-in-the-linux-kernel-ebpf-verifier>" %}
CVE-2021-31440 Walkthrough by ZDI
{% endembed %}