Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Linux have seccomp feature which be used to filter syscalls according to a special program.

There is even dropper.c demo that allows to start programs with one syscall returning the given error.

Is there already implemented by somebody any non-demo, more usable seccomp wrapper that allow me to execute a program with a whitelist of syscalls? Expecting something like this:

# limit_syscalls  access brk close connect dup \
      execve exit_group fcntl64 fstat64 getsockname \
      getuid32 mmap2 mprotect munmap open read set_thread_area \
      setuid32 socket write -- /bin/ping
share|improve this question
up vote 1 down vote accepted

Implemented myself using libseccomp.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.