{"id":"bfb63daa-5ec8-4fb1-a71c-c9ad6cd4c2e6","task":"Apply a compiled seccomp-BPF syscall filter to a bwrap sandbox with --seccomp and --add-seccomp-fd","domain":"github.com/containers/bubblewrap","steps":["Requirements / auth: No credentials. Requires bubblewrap, unprivileged user namespaces, and a toolchain able to compile a cBPF seccomp filter (libseccomp).","Generate the filter outside bwrap — bwrap does not compile policies. Use libseccomp (e.g. Python `seccomp` bindings or a small C program) to build a filter and export it with `seccomp_export_bpf()`; the rules must be in the form of a compiled cBPF program.","Write the compiled cBPF blob to a file and open it as a file descriptor for bwrap, for example in bash: `exec 9< /path/to/filter.bpf`.","Pass the descriptor with `--seccomp 9`. bwrap loads and uses the seccomp rules from that FD.","To layer several policies (a base policy plus a workload-specific one), use `--add-seccomp-fd FD` instead — it can be repeated, and the filters are evaluated in reverse order.","Include a TIOCSTI ioctl denial in your filter if you are not using `--new-session`; upstream documents that without TIOCSTI filtering, `--new-session` is required to stop the sandbox injecting commands into the controlling terminal (CVE-2017-5226).","Test the filter with a deliberately blocked syscall before shipping it, and confirm the failure mode you configured (EPERM vs SIGSYS) is the one your caller can distinguish.","Official documentation: https://manpages.debian.org/unstable/bubblewrap/bwrap.1.en.html | https://github.com/containers/bubblewrap/blob/main/README.md"],"gotchas":["bwrap accepts only pre-compiled cBPF. Passing a libseccomp policy file, a JSON profile (Docker/Podman style), or human-readable rules will fail — the conversion is your job.","`--add-seccomp-fd` filters are evaluated in reverse order. If you assume first-added-wins you will get the opposite precedence from the one you designed.","The file descriptor must be open and readable in the bwrap process at exec time. Redirect it with `exec N< file` in the parent shell; a path passed where an FD number is expected is a common and confusing failure.","A syscall filter can break the sandboxed program's own sandboxing. Upstream notes that applications deploying their own sandboxing may be restricted by bubblewrap's syscall limitations — Chromium-style nested sandboxes are the classic case.","Seccomp filters are inherited by every descendant and cannot be relaxed later. Test against the full workload, not just the entry-point binary, or you will discover the gap in production."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T07:08:47.666Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T07:08:47.666Z"},"url":"https://mcp.waymark.network/r/bfb63daa-5ec8-4fb1-a71c-c9ad6cd4c2e6"}