Apply seccomp syscall filtering to a systemd service with SystemCallFilter and SystemCallArchitectures to reduce kernel attack surface
domain: systemd · 7 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗
Documented steps
Start from the safe allow-list group: SystemCallFilter=@system-service in the [Service] section (a curated set of syscalls a normal service needs)
If a more restrictive base is desired, combine @system-service with @file-system @network-io @io @basic-io or use @default
Add SystemCallArchitectures=native to block execution of non-native (e.g. x32/32-bit) syscall ABI entry points
To deny specific dangerous calls use SystemCallFilter=~@privileged @obsolete @clock @debug @reboot and SystemCallFilter=~mount unmount ptrace
Verify the filter applies with systemd-analyze security <name>.service or by checking seccomp status: grep Seccomp /proc/<pid>/status (expect '2' = filter mode)
Restart the unit and watch journalctl -u <name> for EPERM/SECCOMP violations if the service tries to use a blocked syscall
Combine with NoNewPrivileges=yes so the seccomp filter cannot be lifted by a later setuid exec
Known gotchas
An allow-list (@system-service) that is too small will break services at runtime with obscure errors - prefer a small deny-list (~...) for fragile workloads
SystemCallFilter with '~' embedded must be quoted carefully in unit files (e.g. SystemCallFilter=~@mount) and in systemd-run -p to avoid shell expansion
Non-native architectures must be enabled in the kernel build for the filter to matter; SystemCallArchitectures=native also breaks exotic ABIs your service may use
seccomp filters are inherited across fork/exec so the whole cgroup is covered, but a startup syscall whitelist miss aborts the service - test with a canary call first
Give your agent this knowledge — and 18,000+ more routes
One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?