Applying Seccomp Filters at Runtime for Go Binaries

Summary

Seccomp filters let a Linux process restrict its available system calls, reducing the process attack surface beyond the Dyno’s existing restrictions. This tutorial builds a Go binary that creates /tmp/moo, uses strace -c to identify its runtime syscalls, and configures a whitelist with libseccomp-golang. The filter starts with libseccomp.ActErrno returning EPERM for unlisted calls, then adds ActAllow rules for named calls before loading the filter at runtime; the example also checks kernel support and installs libseccomp-dev. With the listed calls enabled, the program creates the folder successfully, while a later syscall.Exec attempt to run ls -l cannot perform unlisted ioctl, getdents, and statfs operations and reports “Operation not permitted.” The post then describes deploying the dependency with Govendor or Godeps on Heroku.

Takeaways

1. 1

   strace -c is used to identify the syscalls made by the Go program that creates /tmp/moo.

2. 2

   libseccomp-golang starts with an EPERM action for unlisted syscalls and adds ActAllow rules for the whitelist before loading the filter.

3. 3

   When the modified program runs ls -l through syscall.Exec, unlisted ioctl, getdents, and statfs calls are blocked with “Operation not permitted.”