---
title: "Seccomp"
description: "1 posts about Seccomp, summarised, each linking to the original."
---

# Seccomp
> 1 posts about Seccomp, summarised, each linking to the original.

## Articles

### [Applying Seccomp Filters at Runtime for Go Binaries](https://yomu.fyi/post/applying-seccomp-filters-at-runtime-for-go-binaries.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: chris le roy
- Published: Aug 29, 2018
- Type: Tutorial

Seccomp filters let a Linux process restrict its available system calls, reducing the process attack surface beyond the Dyno’s existing restrictions. This tutorial builds a Go binary that creates /tmp/moo, uses strace -c to identify its runtime syscalls, and configures a whitelist with libseccomp-golang. The filter starts with libseccomp.ActErrno returning EPERM for unlisted calls, then adds ActAllow rules for named calls before loading the filter at runtime; the example also checks kernel support and installs libseccomp-dev. With the listed calls enabled, the program creates the folder successfully, while a later syscall.Exec attempt to run ls -l cannot perform unlisted ioctl, getdents, and statfs operations and reports “Operation not permitted.” The post then describes deploying the dependency with Govendor or Godeps on Heroku.