---
title: "Applying Seccomp Filters at Runtime for Go Binaries"
description: "Seccomp filters let a Linux process restrict its available system calls, reducing the process attack surface beyond the Dyno’s existing restrictions. This tutorial builds a Go binary that creates /tmp/moo, uses strace -c to identify its runtime syscalls, and configures a whitelist with libseccomp-golang. The filter starts with libseccomp.ActErrno returning EPERM for unlisted calls, then adds ActAllow rules for named calls before loading the filter at runtime; the example also checks kernel support and installs libseccomp-dev. With the listed calls enabled, the program creates the folder successfully, while a later syscall.Exec attempt to run ls -l cannot perform unlisted ioctl, getdents, and statfs operations and reports “Operation not permitted.” The post then describes deploying the dependency with Govendor or Godeps on Heroku."
---

# Applying Seccomp Filters at Runtime for Go Binaries

[Heroku](https://yomu.fyi/company/heroku) · chris le roy · Aug 29, 2018

**Type:** Tutorial

## Summary

Seccomp filters let a Linux process restrict its available system calls, reducing the process attack surface beyond the Dyno’s existing restrictions. This tutorial builds a Go binary that creates /tmp/moo, uses strace -c to identify its runtime syscalls, and configures a whitelist with libseccomp-golang. The filter starts with libseccomp.ActErrno returning EPERM for unlisted calls, then adds ActAllow rules for named calls before loading the filter at runtime; the example also checks kernel support and installs libseccomp-dev. With the listed calls enabled, the program creates the folder successfully, while a later syscall.Exec attempt to run ls -l cannot perform unlisted ioctl, getdents, and statfs operations and reports “Operation not permitted.” The post then describes deploying the dependency with Govendor or Godeps on Heroku.

## Context

A Dyno already restricts processes with seccomp filters, but a process may still have access to syscalls it does not need. The post presents narrowing that access to reduce the process attack surface and limit what a compromised or modified program can do.

## Approach / What changed

The example uses strace to identify the Go binary’s syscalls, then applies a runtime whitelist with libseccomp-golang. It creates a deny-all filter that returns EPERM, adds ActAllow rules for selected syscall names, loads the filter, and deploys the dependency with Govendor or Godeps on Heroku.

## Takeaways

- strace -c is used to identify the syscalls made by the Go program that creates /tmp/moo.
- libseccomp-golang starts with an EPERM action for unlisted syscalls and adds ActAllow rules for the whitelist before loading the filter.
- When the modified program runs ls -l through syscall.Exec, unlisted ioctl, getdents, and statfs calls are blocked with “Operation not permitted.”

**Tags:** [Go](https://yomu.fyi/topic/go), [Linux](https://yomu.fyi/topic/linux), [Seccomp](https://yomu.fyi/topic/seccomp)

- Source: [Heroku](https://www.heroku.com/blog/applying-seccomp-filters-on-go-binaries)
- Source URL: https://www.heroku.com/blog/applying-seccomp-filters-on-go-binaries
- Ingested by Yomu: 2026-09-09T14:26:48.302Z

[Read original post](https://www.heroku.com/blog/applying-seccomp-filters-on-go-binaries)