seccomp
A secure computing mode provided by the Linux kernel that filters the system calls a process may execute. It is often combined with namespaces and cgroups to achieve operating-system-level sandbox isolation.
Core Facts
Mainstream sandbox solutions are typically based on container (e.g., Docker) or micro-virtual machine (e.g., Firecracker) technologies; containers start faster but offer relatively weaker isolation, while micro-virtual machines provide higher security but greater cold-start latency.
seccomp is a system call filtering mechanism provided by the Linux kernel, and the seccomp-bpf extension allows fine-grained inspection of system call parameters using BPF programs.
Timeline (last 90 days)
Kernel-level restrictions typically use mechanisms such as seccomp, Landlock, and cgroup to intercept system calls by whitelist or rules when they enter the kernel, making them harder to bypass than application-layer hooks.
Process isolation can be combined with container seccomp, read-only file systems and non-root execution to limit the command execution surface after a successful RCE.
OpenShell's sandbox continuously intercepts and adjudicates the system calls and tool calls initiated by agents at runtime, similar to combining kernel-level interception mechanisms such as eBPF or seccomp with a user-space policy engine.
Common engineering measures for runtime isolation include: configuring the file system and network accessible to the process under the principle of least privilege; restricting system calls with mechanisms such as seccomp and AppArmor; isolating the execution environment with containers or sandboxes; and rejecting unauthorized calls at the framework level through tool whitelists/blacklists.
Classic implementations of runtime enforcement include Linux's seccomp, SELinux's mandatory access control (MAC), and runtime application self-protection (RASP) in web applications.
Operating-system-level sandboxes on Linux use seccomp to filter system calls, combined with namespaces to isolate mount and network views, and then cgroups to limit resources.
Linux security modules such as seccomp and AppArmor can further tighten permissions at the system call level.
Mainstream sandbox solutions are typically based on container (e.g., Docker) or micro-virtual machine (e.g., Firecracker) technologies; containers start faster but offer relatively weaker isolation, while micro-virtual machines provide higher security but greater cold-start latency.
Common OS sandbox implementation approaches include Linux namespaces and cgroups, seccomp, chroot, as well as Python-level subprocess privilege reduction and tools such as firejail.
Codex uses OS-level sandboxing: Seatbelt on macOS, seccomp on Linux, and native sandbox or WSL on Windows.
8 more timeline events
All Facts (19)
Mainstream sandbox solutions are typically based on container (e.g., Docker) or micro-virtual machine (e.g., Firecracker) technologies; containers start faster but offer relatively weaker isolation, while micro-virtual machines provide higher security but greater cold-start latency.
75%Verifiedseccomp is a system call filtering mechanism provided by the Linux kernel, and the seccomp-bpf extension allows fine-grained inspection of system call parameters using BPF programs.
65%UnverifiedKernel-level restrictions typically use mechanisms such as seccomp, Landlock, and cgroup to intercept system calls by whitelist or rules when they enter the kernel, making them harder to bypass than application-layer hooks.
50%UnverifiedProcess isolation can be combined with container seccomp, read-only file systems and non-root execution to limit the command execution surface after a successful RCE.
50%UnverifiedOpenShell's sandbox continuously intercepts and adjudicates the system calls and tool calls initiated by agents at runtime, similar to combining kernel-level interception mechanisms such as eBPF or seccomp with a user-space policy engine.
50%UnverifiedCommon engineering measures for runtime isolation include: configuring the file system and network accessible to the process under the principle of least privilege; restricting system calls with mechanisms such as seccomp and AppArmor; isolating the execution environment with containers or sandboxes; and rejecting unauthorized calls at the framework level through tool whitelists/blacklists.
50%UnverifiedClassic implementations of runtime enforcement include Linux's seccomp, SELinux's mandatory access control (MAC), and runtime application self-protection (RASP) in web applications.
50%UnverifiedOperating-system-level sandboxes on Linux use seccomp to filter system calls, combined with namespaces to isolate mount and network views, and then cgroups to limit resources.
50%UnverifiedLinux security modules such as seccomp and AppArmor can further tighten permissions at the system call level.
50%UnverifiedCommon OS sandbox implementation approaches include Linux namespaces and cgroups, seccomp, chroot, as well as Python-level subprocess privilege reduction and tools such as firejail.
50%UnverifiedCodex uses OS-level sandboxing: Seatbelt on macOS, seccomp on Linux, and native sandbox or WSL on Windows.
50%UnverifiedSecurity hardening measures for Agent sandboxes include running as a non-root user, mounting read-only file systems, disabling the network or restricting egress IP whitelists, setting execution timeouts, and using seccomp to filter dangerous system calls.
50%UnverifiedOn Linux, Agent sandboxing is typically implemented through kernel mechanisms such as namespaces, cgroups, and seccomp.
50%UnverifiedLinux has more than 300 system calls, and most containers only need about 50 of them.
50%UnverifiedCommon sandbox implementations include Docker containers, WebAssembly (Wasm) runtimes, and OS-level seccomp and AppArmor policies.
50%Unverified将推理引擎运行在严格隔离的沙箱环境中（容器隔离、seccomp、最小权限）是防御此类威胁的直接方案
50%Unverified将推理引擎运行在严格隔离的沙箱环境中，结合容器隔离、seccomp和最小权限运行，可在引擎被攻破时限制攻击者控制宿主机
50%Unverifiedseccomp是Linux内核提供的安全机制，允许进程声明只使用哪些系统调用，内核会拒绝所有未声明的系统调用
50%UnverifiedAgent执行沙箱主流实现分为进程级隔离（seccomp、namespace）、容器级隔离（Docker、gVisor）、虚拟机级隔离（Firecracker、Kata Containers）三个层次
50%