Seccomp filters: inspect syscall arguments without inventing pathname knowledge

The kernel supplies the syscall number, architecture identifier, instruction pointer, and argument values through seccomp_data. A filter can compare values such as a descriptor number, flags, or an operation selector. It cannot dereference the pathname pointer passed to openat or inspect an arbitrary structure behind another pointer. Equal pointer addresses also do not imply equal contents across calls. A rule saying that raw seccomp BPF permits only a particular path string therefore claims information the filter does not possess.

Interpret syscall numbers within the correct architecture and calling convention. Compat ABIs, multiplexed calls, argument widths, sign extension, and kernel truncation can change the meaning of the same numeric bits. Check the architecture and supported ABI path explicitly before matching a native syscall table. A descriptor-number rule is also not permanent object authorization: descriptor three can be closed and reused for a different object. A policy fragment must state whether that identity can change and what other calls the workload may perform.

Installing an unprivileged filter normally requires no_new_privs; the documented alternative is the appropriate capability in the relevant user namespace. Filters are inherited across allowed fork/clone and exec paths. Existing sibling threads are not automatically covered by changing only one thread; use the runtime's correct installation sequence or supported synchronization mechanism and verify its success. A setup failure must not silently fall back to running an unfiltered process merely because the application still starts.

Stacked filters are combined by documented action precedence, not by letting the newest allow override an earlier deny. Distinguish returning an errno, trapping, terminating a thread, and terminating a process. A kill action reports SIGSYS under the documented contract, which differs from a generic SIGKILL diagnosis. Userspace notification is a separate mechanism with a trusted supervisor and its own race and object-handling requirements. Checking mutable tracee memory and then continuing a syscall unchanged can introduce TOCTOU issues; it does not make ordinary BPF capable of dereferencing memory.

Build policy evidence from application behavior across startup, steady work, shutdown, error paths, architecture variants, and library changes. A trace collected only after warmup can miss allocation, dynamic loading, resolver, or crash-reporting calls. Keep a deny test for a deliberately excluded operation and check the actual resulting errno or signal. Logging can help explain a rejection but does not itself deny it. File permissions, LSM policy, namespaces, and device controls still determine resource access for calls the filter allows.

Use the probability lab only for a hypothetical coverage exercise. Reset, explicitly set p=0.10 and n=10, predict the zero-detection bar, then Play or Step. For a separate run Reset and explicitly set p=0.10 and n=20. Assume independent equal-probability detection of a missing policy path; real executions need not satisfy that assumption. The diagram neither executes syscalls nor evaluates BPF, architecture tags, pointer arguments, or action precedence. A passing sample is not proof that every permitted syscall behavior is safe.