Topic · 21 articles
Sandboxing & Privilege
Every daemon you run can make every syscall the kernel exposes, open every path its uid can reach, and exec whatever it likes. That's the default, and it's insane. Sandboxing is the process telling the kernel, ahead of time, what it will never need, so the kernel can refuse it when the process gets owned.
OpenBSD made this one call per daemon with pledge(2) and unveil(2). Linux got there in pieces: seccomp-BPF for syscalls, Landlock for paths and ports, openat2 for path resolution, prctl and capabilities for privilege. Start with the filter, then the filesystem, then the privilege model, then go read how the BSD people did it in a fraction of the code.
Start here
Read these first, in this order.
- 01
Tip · 2026-08-24
Your process doesn't need 400 syscalls. seccomp-BPF lets you say so.
seccomp-BPF loads a classic BPF filter into the kernel that runs on every syscall your process makes. Give it a whitelist, everything else gets EPERM or SIGKILL. Here's how the filter model works, how libseccomp makes it tolerable, and how to audit what a real binary actually needs.
- 02
Tip · 2026-08-29
landlock: sandbox your process without root
Since Linux 5.13, landlock lets an unprivileged process restrict its own filesystem and network access using three new syscalls. No SELinux policy, no AppArmor profile, no root. Chrome uses it for renderer isolation. Here is how to wire it up.
- 03
Tip · 2026-09-12
openat2(2): path resolution you can actually trust
Linux 5.6 shipped openat2(2) with RESOLVE_BENEATH and RESOLVE_IN_ROOT. You can now open files inside a directory tree without root, without chroot, and without the symlink races that have been eating archive extractors for thirty years.
- 04
Tip · 2026-09-19
prctl: the per-process security levers worth knowing
PR_SET_NO_NEW_PRIVS prevents exec from granting new privileges regardless of the binary's setuid bits. PR_SET_DUMPABLE locks /proc/PID from outside readers. PR_SET_PDEATHSIG cleans up orphans when a supervisor dies. Three prctl calls that belong in every daemon that drops privileges.
- 05
Tip · 2026-09-20
Linux capabilities: what the five sets actually do
Linux capabilities split root privilege into 40-odd discrete bits organized across five per-thread sets. Most guides explain the names. This one explains the exec transformation rules, why ambient capabilities (Linux 4.3) matter, and how to drop caps correctly so they stay dropped.
- 06
Tip · 2026-09-13
pledge(2) and unveil(2): what OpenBSD figured out that Linux is still catching up to
OpenBSD shipped two syscalls in 2016 and 2018 that let any unprivileged daemon sandbox itself down to exactly the filesystem paths and syscall categories it needs. Linux got there eventually, with seccomp-bpf in 2012, Landlock in 2021, and namespaces throughout. Compare and decide which one you'd rather write.
The syscalls underneath
Version introduced, sourced from the man page. Full cards in the syscall reference, or check your kernel.
| Interface | Since | What it does |
|---|---|---|
| seccomp(2) | Linux 3.17 | Set the thread's seccomp state: strict mode or a BPF filter on every syscall. |
| landlock_create_ruleset(2) | Linux 5.13 | Create a Landlock ruleset fd, step one of unprivileged filesystem/network sandboxing. |
| openat2(2) | Linux 5.6 | Open a file with kernel-enforced path-resolution constraints (RESOLVE_* flags). |
| prctl(2) | Linux 2.1.57 | Per-process/thread control knobs: no_new_privs, dumpable, parent-death signal, VMA names and more. |
| capset(2) | Linux 2.2 | Raw syscall to set a thread's permitted, effective and inheritable capability sets. |
| pledge(2) | OpenBSD 5.9 | Restrict the process to named groups of system operations; violations kill it with SIGABRT. |
| unveil(2) | OpenBSD 6.4 | Hide the whole filesystem except the paths you name, with per-path r/w/x/c permissions. |
| jail(2) | FreeBSD 4.0 | Create a FreeBSD jail and lock the current process into it (jail_set/jail_attach for more). |
| pkey_alloc / pkey_mprotect(2) | Linux 4.8 | Allocate a memory protection key and use it to gate access to a memory region via a per-thread register, without a syscall per permission switch. |
More console tips (4)
- pkey_mprotect: in-process memory isolation without a syscall
- io_uring's attack surface and IORING_REGISTER_RESTRICTIONS
- The kernel keyring has been in Linux since 2.6.10 and you have never used it
- ZFS boot environments + jails will do 90% of what you're using Docker for, and the other 10% is the part you don't actually need
MOTD (11)
- OpenBSD 7.10: pledge coverage, a W^X gap closed, and DES finally gone
- GCC 14 has -fhardened. Stop writing out those nine flags by hand.
- mseal() landed in Linux 6.10. Browsers wanted it. You can use it too.
- The eBPF verifier is 30,000 lines of C, and it has the privilege-escalation CVEs to show for it
- Landlock has been in the Linux kernel for five years. The adoption numbers are embarrassing.
- io_uring shipped in 2019 to eliminate syscall overhead. It also became the most reliably exploited surface in the kernel. Production fleets are disabling it.
- `sudo` wrote its last heap overflow in C. The Rust rewrite shipped.
- pledge() turns 10. Linux still doesn't have anything half as clean.
- systemd wants to replace sudo. I hate that they're not wrong about why.
- Unprivileged eBPF is getting locked out by default. It's five years overdue.
- The scary FreeBSD advisory this week isn't an RCE; it's a privilege check that slipped