Why does running a container as an unprivileged non-root user (e.g. UID 1000) not protect against kernel exploits without Seccomp-BPF?

A non-root user inside a Linux container is restricted by discretionary access controls (DAC) on files and directories, but still shares the host Linux kernel directly with all other processes. Linux exposes over 450 system calls to userspace. Many kernel vulnerabilities (such as local privilege escalation in eBPF, io_uring, user namespaces, keyrings, or perf_event_open) can be triggered by completely unprivileged user accounts. If an attacker discovers a kernel flaw, they can execute a malicious syscall directly from UID 1000 and gain ring-0 kernel control. Seccomp-BPF (Secure Computing Mode with Berkeley Packet Filter) intercepts every system call before it enters the kernel, dropping unauthorized syscalls with SECCOMP_RET_KILL_PROCESS or SECCOMP_RET_ERRNO, rendering entire classes of kernel exploits unreachable.

Why is verifying the architecture (AUDIT_ARCH) the mandatory first instruction in every Seccomp-BPF filter?

On x86_64 systems, the Linux kernel supports multiple ABI personalities: standard 64-bit x86_64 (AUDIT_ARCH_X86_64), legacy 32-bit i386 (AUDIT_ARCH_I386), and the x32 ABI. Because syscall numbers differ completely across architectures (for example, syscall #11 is munmap on x86_64, but execve on i386!), an attacker could issue a 32-bit int 0x80 syscall to execute arbitrary programs if the filter only inspected the syscall number without verifying the architecture. A compliant Seccomp-BPF filter MUST load the architecture field from struct seccomp_data (offset 4) and immediately abort or kill the process if it does not match the expected native architecture.

Why is the Linux capability CAP_SYS_ADMIN widely considered equivalent to full host root access?

Historically, UNIX divided privileges into root (UID 0) and unprivileged users. Linux Capabilities (POSIX 1003.1e) partitioned root into distinct privileges (CAP_NET_BIND_SERVICE, CAP_CHOWN, etc.). However, CAP_SYS_ADMIN became the catch-all "junk drawer" for every privileged kernel operation that did not have its own dedicated capability. CAP_SYS_ADMIN permits mounting and remounting filesystems, configuring cgroups v1/v2, loading non-isolated eBPF programs, altering namespaces, manipulating device nodes, and altering IPC namespaces. In container environments (Docker, Kubernetes), granting CAP_SYS_ADMIN almost invariably enables trivial container escapes through cgroup release_agent execution, device node creation, or kernel memory corruption.

How does SECCOMP_RET_USER_NOTIF enable rootless containers and unprivileged system virtualization?

Introduced in Linux 5.0, SECCOMP_RET_USER_NOTIF transforms seccomp from a passive filter into an active userspace proxy. When a process issues a restricted syscall (such as mount, mknod, or bpf), instead of killing the process or returning EPERM, the kernel pauses the thread and dispatches a notification event down a UNIX domain socket or file descriptor to a privileged userspace supervisor daemon (such as runc or crun). The supervisor inspects the target memory, emulates or performs the operation securely on behalf of the container in a virtualized or rootless context, and injects the return value back into the kernel, allowing unprivileged containers to perform pseudo-privileged operations safely.

What is Landlock LSM and how does it differ fundamentally from Seccomp-BPF?

Seccomp-BPF operates strictly at the system call boundary: it inspects syscall numbers and raw register arguments, but cannot inspect pointers to strings or file paths (doing so would introduce Time-of-Check to Time-of-Use [TOCTOU] race conditions in multiprocessor systems). Landlock (introduced in Linux 5.13) is an unprivileged Linux Security Module (LSM) that operates within the kernel VFS (Virtual Filesystem) layer. Landlock allows any unprivileged application to self-restrict its own filesystem access (e.g. permitting read-only access to /usr/lib and read-write to /tmp/scratch, while denying all access to ~/.ssh or /etc). Unlike SELinux or AppArmor, Landlock requires zero root privileges or administrative policies to configure.

Why must prctl(PR_SET_NO_NEW_PRIVS, 1) be executed before loading unprivileged seccomp or Landlock filters?

The no_new_privs bit (set via prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) guarantees that neither the current process nor any of its descendants can ever acquire additional privileges, even through setuid or setgid binaries (such as sudo or ping). The Linux kernel enforces this check to prevent an unprivileged user from installing a seccomp filter that subtly alters the execution environment of a setuid-root program (for instance, causing a setuid binary's setuid() call to fail with EPERM while continuing execution as root). Once no_new_privs is enabled, it is permanent and cannot be unset by any process or privilege level.

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Linux Kernel 6.x / BPF POSIX 1003.1e Capabilities Landlock LSM (Linux 5.13+) Zero-Trust Sandbox

Linux Seccomp-BPF, Landlock & Linux Capabilities Sandbox Studio

An engineering studio and interactive policy synthesizer for Linux container isolation and kernel sandboxing. Generate raw Seccomp-BPF assembly filters, audit system call allowlists against container escape vectors, decompose root UID 0 into fine-grained Linux Capabilities, configure Landlock unprivileged filesystem rules, and synthesize production Docker, C (libseccomp), and Go configurations.

452 Syscalls

Linux x86_64 Kernel ABI

44 Blocked

Docker Default Denylist

14 / 41 Caps

Container Default Caps

RET_KILL_PROCESS

Default Seccomp Action

ENFORCED

PR_SET_NO_NEW_PRIVS

Interactive Seccomp-BPF Assembly Filter Synthesizer

Seccomp-BPF compiles a system call filter into classical BPF instructions executed by the kernel on every single syscall. Choose an isolation posture, select required syscall categories, and generate ready-to-compile C macro filters or Docker OCI JSON profiles.

Filter Policy Model

Target Architecture

Default Fallback Action

PERMITTED SYSCALL FUNCTIONAL GROUPS

Core I/O (read, write, close, openat) Memory (mmap, mprotect, brk) Process (exit_group, futex, nanosleep) Network Sockets (socket, connect, bind) Execution (execve, execveat) Event Loops (epoll_create1, epoll_ctl)

Generated Classical BPF Instructions (struct sock_filter[])

Generating BPF assembly...

POSIX 1003.1e Linux Capabilities Decomposition

Linux replaces the all-or-nothing root model by splitting privileges into 41 distinct capability bits. Click chips to toggle capability sets and analyze the resulting container attack surface.

Selected Capabilities & Risk Audit

Click preset buttons above or toggle individual chips to evaluate privilege escalation risk.

Docker Compose / Kubernetes SecurityContext Syntax

Landlock LSM: Unprivileged Filesystem Sandboxing (Linux 5.13+)

Unlike AppArmor or SELinux which require root privileges and complex policy files, Landlock allows any unprivileged application to sandbox its own filesystem access at runtime.

Read-Only Directory Paths (Colon-Separated)

Read-Write Directory Paths (Colon-Separated)

Production C Landlock Initialization Code

Top 5 Container Escape Vectors & Kernel Mitigations

Analysis of real-world container escapes and how Seccomp-BPF and Capability pruning prevent them.

Attack Vector	Exploited Mechanism	Required Privilege	Definitive Mitigation
cgroups release_agent Escape	Writes host executable script into cgroup `release_agent` and triggers empty cgroup notification.	`CAP_SYS_ADMIN` + root mount access	Drop `CAP_SYS_ADMIN`. Block `mount` and `pivot_root` via Seccomp.
Kernel Exploitation via eBPF	Unprivileged eBPF verifier bugs or JIT spraying causing ring-0 arbitrary memory write.	Unrestricted `bpf()` syscall	Seccomp block `bpf()` syscall. Set `kernel.unprivileged_bpf_disabled = 1`.
userfaultfd Kernel Race Exploits	Using `userfaultfd` to pause page faults and win kernel race conditions (e.g. Dirty COW variants).	Unrestricted `userfaultfd()`	Seccomp block `userfaultfd()`. Set `vm.unprivileged_userfaultfd = 0`.
ptrace Process Injection	Attaching ptrace to host-namespaced processes or shared PID namespace containers.	`CAP_SYS_PTRACE` + shared PID ns	Drop `CAP_SYS_PTRACE`. Enforce isolated PID namespaces. Block `ptrace` in Seccomp.
Raw Socket Sniffing / Spoofing	Crafting raw IP packets or sniffing ARP/DHCP traffic across the host bridge.	`CAP_NET_RAW`	Drop `CAP_NET_RAW` in container security context.

Production Sandboxing Blueprints & Profiles

Production-ready implementations in Docker OCI JSON, C (libseccomp), Go, and Systemd security directives.

Linux Seccomp-BPF, Landlock & Linux Capabilities Sandbox Studio

Interactive Seccomp-BPF Assembly Filter Synthesizer

PERMITTED SYSCALL FUNCTIONAL GROUPS

POSIX 1003.1e Linux Capabilities Decomposition

Selected Capabilities & Risk Audit

Landlock LSM: Unprivileged Filesystem Sandboxing (Linux 5.13+)

Top 5 Container Escape Vectors & Kernel Mitigations

Production Sandboxing Blueprints & Profiles

🔍 Companion Workbenches & Verification Tools

Free Cookie Policy Generator & Consent Banner Suite (GDPR & CCPA)

FROST Threshold Schnorr Signatures Studio | RFC 9591 & Distributed Key Generation

Private Information Retrieval (PIR) & Spiral Cryptography Studio

OAuth 2.0 & OIDC Flow Playground, Token Inspector & PKCE Studio

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions