Linux Security Summit North America 2019

The Linux Kernel's seccomp feature can restrict the syscalls available to a
given process, thus reducing the attack surface available to untrusted and
potentially malicious programs. It is a critical building block for
containers and process isolation in general. However, writing a seccomp
filter by hand is error prone and difficult to maintain.

In this tutorial session, Paul Moore and Tom Hromatka (the libseccomp
maintainers) will explain how libseccomp makes this process much easier and
will guide you through making your own seccomp filter using libseccomp.