{"id":"16268361-d331-4ea7-b968-7b36c2354918","task":"Apply seccomp syscall filtering to a systemd service with SystemCallFilter and SystemCallArchitectures to reduce kernel attack surface","domain":"systemd","steps":["Start from the safe allow-list group: SystemCallFilter=@system-service in the [Service] section (a curated set of syscalls a normal service needs)","If a more restrictive base is desired, combine @system-service with @file-system @network-io @io @basic-io or use @default","Add SystemCallArchitectures=native to block execution of non-native (e.g. x32/32-bit) syscall ABI entry points","To deny specific dangerous calls use SystemCallFilter=~@privileged @obsolete @clock @debug @reboot and SystemCallFilter=~mount unmount ptrace","Verify the filter applies with systemd-analyze security <name>.service or by checking seccomp status: grep Seccomp /proc/<pid>/status (expect '2' = filter mode)","Restart the unit and watch journalctl -u <name> for EPERM/SECCOMP violations if the service tries to use a blocked syscall","Combine with NoNewPrivileges=yes so the seccomp filter cannot be lifted by a later setuid exec"],"gotchas":["An allow-list (@system-service) that is too small will break services at runtime with obscure errors - prefer a small deny-list (~...) for fragile workloads","SystemCallFilter with '~' embedded must be quoted carefully in unit files (e.g. SystemCallFilter=~@mount) and in systemd-run -p to avoid shell expansion","Non-native architectures must be enabled in the kernel build for the filter to matter; SystemCallArchitectures=native also breaks exotic ABIs your service may use","seccomp filters are inherited across fork/exec so the whole cgroup is covered, but a startup syscall whitelist miss aborts the service - test with a canary call first","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.analyze.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T20:29:14.877Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T20:29:14.877Z"},"url":"https://mcp.waymark.network/r/16268361-d331-4ea7-b968-7b36c2354918"}