--- title: seccomp — Unsafe at any speed | daily.dev description: seccomp() is fundamentally broken as a syscall filtering mechanism due to three core problems: syscalls change depending on libc version and architecture... canonical: https://daily.dev/posts/seccomp-unsafe-at-any-speed-rcohswsdt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: seccomp — Unsafe at any speed | daily.dev og:description: seccomp() is fundamentally broken as a syscall filtering mechanism due to three core problems: syscalls change depending on libc version and architecture... og:url: https://daily.dev/posts/seccomp-unsafe-at-any-speed-rcohswsdt og:image: https://api.daily.dev/og/posts/rcOHSwsdT.png og:image:alt: seccomp — Unsafe at any speed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # seccomp — Unsafe at any speed **[Lobsters](https://daily.dev/sources/lobsters)** · 4 min read · 0 upvotes · 0 comments ## Summary seccomp() is fundamentally broken as a syscall filtering mechanism due to three core problems: syscalls change depending on libc version and architecture without recompilation, library functions make surprising and order-dependent syscalls (e.g. printf() calling newfstatat), and there's no way to express high-level intent like 'only use already-open file descriptors' without enumerating dozens of low-level syscalls that can change at any time. The author argues OpenBSD's pledge() and unveil() are the correct approach, expressing capability groups rather than individual syscalls. For Linux, Landlock is mentioned as a future possibility, with unshare() as a current imperfect alternative. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Software sandboxing: The basics \(2025\)](https://daily.dev/posts/software-sandboxing-the-basics-2025--auazxdqh6) · Lobsters · 0 upvotes · 0 comments - [Capsicum vs seccomp: Process Sandboxing — Vivian Voss](https://daily.dev/posts/capsicum-vs-seccomp-process-sandboxing-vivian-voss-9qyb6kgrk) · Hacker News · 0 upvotes · 0 comments - [Linux Sandboxes And Fil-C](https://daily.dev/posts/linux-sandboxes-and-fil-c-ebbudmjjn) · Hacker News · 0 upvotes · 0 comments - [How to Sandbox a Linux Process with Landlock, No Root Required](https://daily.dev/posts/how-to-sandbox-a-linux-process-with-landlock-no-root-required-0q4org4xy) · freeCodeCamp · 3 upvotes · 1 comments - [Calling a function in C without naming it](https://daily.dev/posts/calling-a-function-in-c-without-naming-it-kxojpx3bs) · Lobsters · 4 upvotes · 1 comments --- [View this post on daily.dev](https://daily.dev/posts/seccomp-unsafe-at-any-speed-rcohswsdt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"seccomp — Unsafe at any speed","url":"https://daily.dev/posts/seccomp-unsafe-at-any-speed-rcohswsdt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/seccomp-unsafe-at-any-speed-rcohswsdt"},"datePublished":"2026-03-10T13:47:45.156Z","dateModified":"2026-03-10T13:48:09.050Z","description":"seccomp() is fundamentally broken as a syscall filtering mechanism due to three core problems: syscalls change depending on libc version and architecture...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/seccomp-unsafe-at-any-speed-rcohswsdt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"seccomp — Unsafe at any speed"}]} ```