Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
seccomp
open-in-new
<h2 id="history">History</h2> <p>seccomp was first devised by Andrea Arcangeli in January 2005 for use in public <a href="/facts/Grid_computing/2GQhzN5l">grid computing</a> and was originally intended as a means of safely running <a href="/facts/Untrusted_code/WEm2u7oG">untrusted</a> compute-bound programs. It was merged into the <a href="/facts/Linux_kernel_mainline/dlkduHuA">Linux kernel mainline</a> in kernel version 2.6.12, which was released on March 8, 2005.<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> </p> <h2 id="software-using-seccomp-or-seccomp-bpf">Software using seccomp or seccomp-bpf</h2> <ul><li><a href="/facts/Android_(operating_system)/nNyHb0xz">Android</a> uses a seccomp-bpf filter in the zygote since <a href="/facts/Android_8.0/U81uHjf5">Android 8.0</a> Oreo.<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a></li> <li><a href="/facts/Systemd/zls5HoVh">systemd</a>'s <a href="/facts/Sandbox_(computer_security)/WEm2u7oG">sandboxing</a> options are based on seccomp.<a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a></li> <li><a href="/facts/QEMU/s6utqULJ">QEMU</a>, the Quick Emulator, the core component to the modern virtualization together with <a href="/facts/Kernel_Virtual_Machine/d6eSuTuK">KVM</a> uses seccomp on the parameter --sandbox<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a></li> <li><a href="/facts/Docker_(software)/7IvvsMug">Docker</a> – software that allows applications to run inside of isolated containers. Docker can associate a seccomp profile with the container using the --security-opt parameter.</li> <li>Arcangeli's CPUShare was the only known user of seccomp for a while.<a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a> Writing in February 2009, <a href="/facts/Linus_Torvalds/EdDKP534">Linus Torvalds</a> expresses doubt whether seccomp is actually used by anyone.<a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a> However, a <a href="/facts/Google/GT9Sugza">Google</a> engineer replied that Google is exploring using seccomp for <a href="/facts/Sandbox_(computer_security)/WEm2u7oG">sandboxing</a> its <a href="/facts/Google_Chrome/4INfWq37">Chrome</a> web browser.<a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a><a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a></li> <li><a href="/facts/Firejail/QqCTzPJh">Firejail</a> is an open source Linux sandbox program that utilizes <a href="/facts/Linux_namespaces/1ljlDGT0">Linux namespaces</a>, Seccomp, and other kernel-level security features to sandbox Linux and <a href="/facts/Wine_(software)/JF0wHs7y">Wine</a> applications.<a class="footnote-ref" id="fnref:19" href="#fn:19"><sup>19</sup></a></li> <li>As of Chrome version 20, seccomp-bpf is used to sandbox <a href="/facts/Adobe_Flash_Player/IvnaoU7v">Adobe Flash Player</a>.<a class="footnote-ref" id="fnref:20" href="#fn:20"><sup>20</sup></a></li> <li>As of Chrome version 23, seccomp-bpf is used to sandbox the renderers.<a class="footnote-ref" id="fnref:21" href="#fn:21"><sup>21</sup></a></li> <li><a href="/facts/Snap_(software)/X4wsC7Tp">Snap</a> specify the shape of their application sandbox using "interfaces" which snapd translates to seccomp, <a href="/facts/AppArmor/8uBuL9gJ">AppArmor</a> and other security constructs<a class="footnote-ref" id="fnref:22" href="#fn:22"><sup>22</sup></a></li> <li><a href="/facts/Vsftpd/Ttf6deV6">vsftpd</a> uses seccomp-bpf sandboxing as of version 3.0.0.<a class="footnote-ref" id="fnref:23" href="#fn:23"><sup>23</sup></a></li> <li><a href="/facts/OpenSSH/2qxJ3Fe7">OpenSSH</a> has supported seccomp-bpf since version 6.0.<a class="footnote-ref" id="fnref:24" href="#fn:24"><sup>24</sup></a></li> <li>Mbox uses <a href="/facts/Ptrace/lct1NzSQ">ptrace</a> along with seccomp-bpf to create a secure sandbox with less overhead than ptrace alone.<a class="footnote-ref" id="fnref:25" href="#fn:25"><sup>25</sup></a></li> <li>LXD, a <a href="/facts/Ubuntu_(operating_system)/0WDd7hkb">Ubuntu</a> "<a href="/facts/Hypervisor/3gX9fKlH">hypervisor</a>" for containers<a class="footnote-ref" id="fnref:26" href="#fn:26"><sup>26</sup></a><a class="footnote-ref" id="fnref:27" href="#fn:27"><sup>27</sup></a></li> <li><a href="/facts/Firefox/xez2zv8H">Firefox</a> and <a href="/facts/Firefox_OS/pBLG4suy">Firefox OS</a>, which use seccomp-bpf<a class="footnote-ref" id="fnref:28" href="#fn:28"><sup>28</sup></a><a class="footnote-ref" id="fnref:29" href="#fn:29"><sup>29</sup></a></li> <li><a href="/facts/Tor_(anonymity_network)/Wj6jjkx1">Tor</a> supports seccomp since 0.2.5.1-alpha<a class="footnote-ref" id="fnref:30" href="#fn:30"><sup>30</sup></a></li> <li>Lepton, a <a href="/facts/JPEG/HQ8QS3uB">JPEG</a> compression tool developed by <a href="/facts/Dropbox_(service)/1WHn5C7p">Dropbox</a> uses seccomp<a class="footnote-ref" id="fnref:31" href="#fn:31"><sup>31</sup></a></li> <li>Kafel is a configuration language, which converts readable policies into seccompb-bpf <a href="/facts/Bytecode/EPkMFR7M">bytecode</a><a class="footnote-ref" id="fnref:32" href="#fn:32"><sup>32</sup></a></li> <li><a href="/facts/Subgraph_(operating_system)/XIDlun02">Subgraph OS</a> uses seccomp-bpf<a class="footnote-ref" id="fnref:33" href="#fn:33"><sup>33</sup></a><a class="footnote-ref" id="fnref:34" href="#fn:34"><sup>34</sup></a></li> <li><a href="/facts/Flatpak/JQfzpAGG">Flatpak</a> uses seccomp for <a href="/facts/Process_isolation/LflCRbKJ">process isolation</a><a class="footnote-ref" id="fnref:35" href="#fn:35"><sup>35</sup></a></li> <li>Bubblewrap is a lightweight sandbox application developed from <a href="/facts/Flatpak/JQfzpAGG">Flatpak</a><a class="footnote-ref" id="fnref:36" href="#fn:36"><sup>36</sup></a></li> <li>minijail<a class="footnote-ref" id="fnref:37" href="#fn:37"><sup>37</sup></a> uses seccomp for process isolation<a class="footnote-ref" id="fnref:38" href="#fn:38"><sup>38</sup></a></li> <li>SydBox uses seccomp-bpf<a class="footnote-ref" id="fnref:39" href="#fn:39"><sup>39</sup></a> to improve the runtime and security of the ptrace sandboxing used to sandbox package builds on Exherbo Linux distribution.</li> <li>File, a Unix program to determine filetypes, uses seccomp to restrict its runtime environment<a class="footnote-ref" id="fnref:40" href="#fn:40"><sup>40</sup></a></li> <li><a href="/facts/Zathura_(document_viewer)/Hgy9nyFf">Zathura</a>, a minimalistic document viewer, uses seccomp filter to implement different sandbox modes<a class="footnote-ref" id="fnref:41" href="#fn:41"><sup>41</sup></a></li> <li><a href="/facts/Tracker_(search_software)/LQWpykcw">Tracker</a>, a indexing and preview application for the GNOME desktop environment, uses seccomp to prevent automatic exploitation of parsing vulnerabilities in media files<a class="footnote-ref" id="fnref:42" href="#fn:42"><sup>42</sup></a></li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="https://code.google.com/archive/p/seccompsandbox/wikis/overview.wiki">Official website (Archived)</a></li> <li><a href="https://lwn.net/Articles/347547/">Google's Chromium sandbox</a>, <a href="/facts/LWN.net/8uTsltvM">LWN.net</a>, August 2009, by Jake Edge</li> <li><a href="https://web.archive.org/web/20110106145629/http://chdir.org/~nico/seccomp-nurse/">seccomp-nurse</a>, a sandboxing framework based on seccomp</li> <li><a href="https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt">Documentation/prctl/seccomp_filter.txt</a>, part of the <a href="/facts/Linux_kernel/dlkduHuA">Linux kernel</a> documentation</li> <li><a href="https://www.cr0.org/paper/jt-ce-sid_linux.pdf">Security In-Depth for Linux Software: Preventing and Mitigating Security Bugs</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>seccomp(2): "The seccomp() system call operates on the Secure Computing (seccomp) state" – Linux Programmer's Manual – System Calls <a href="https://manned.org/seccomp.2" target="_blank">https://manned.org/seccomp.2</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Corbet, Jonathan (2015-09-02). "A seccomp overview". lwn. Retrieved 2017-10-05. <a href="https://lwn.net/Articles/656307/" target="_blank">https://lwn.net/Articles/656307/</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>"Documentation/prctl/seccomp_filter.txt". Retrieved 2017-10-05. <a href="https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt" target="_blank">https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>"Linux kernel 3.17, Section 11. Security". kernelnewbies.org. 2013-10-05. Retrieved 2015-03-31. <a href="http://kernelnewbies.org/Linux_3.17#head-6fd84937bbba3b384979760008858881c99e4a53" target="_blank">http://kernelnewbies.org/Linux_3.17#head-6fd84937bbba3b384979760008858881c99e4a53</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>"seccomp: add "seccomp" syscall". kernel/git/torvalds/linux.git - Linux kernel source tree. kernel.org. 2014-06-25. Retrieved 2014-08-22. <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=48dc92b9fc3926844257316e75ba11eb5c742b2c" target="_blank">https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=48dc92b9fc3926844257316e75ba11eb5c742b2c</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>Arcangeli, Andrea (2007-06-14). "[PATCH 1 of 2] move seccomp from /proc to a prctl". Retrieved 2013-08-02. <a href="http://lkml.indiana.edu/hypermail/linux/kernel/0706.1/2525.html" target="_blank">http://lkml.indiana.edu/hypermail/linux/kernel/0706.1/2525.html</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Tinnes, Julien (2009-05-28). "Time-stamp counter disabling oddities in the Linux kernel". cr0 blog. Retrieved 2013-08-02. <a href="http://blog.cr0.org/2009/05/time-stamp-counter-disabling-oddities.html" target="_blank">http://blog.cr0.org/2009/05/time-stamp-counter-disabling-oddities.html</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Corbet, Jonathan (2012-01-11). "Yet another new approach to seccomp". lwn. Retrieved 2013-08-02. <a href="https://lwn.net/Articles/475043/" target="_blank">https://lwn.net/Articles/475043/</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>"Openssh 6.0 release notes". Retrieved 2013-10-14. <a href="https://www.openssh.com/txt/release-6.0" target="_blank">https://www.openssh.com/txt/release-6.0</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>Tinnes, Julien (2012-11-19). "A safer playground for your Linux and Chrome OS renderers". The Chromium Blog. Retrieved 2013-08-02. <a href="https://blog.chromium.org/2012/11/a-safer-playground-for-your-linux-and.html" target="_blank">https://blog.chromium.org/2012/11/a-safer-playground-for-your-linux-and.html</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>"[PATCH] seccomp: secure computing support". Linux kernel history. Kernel.org git repositories. 2005-03-08. Archived from the original on 2013-04-15. Retrieved 2013-08-02. <a href="https://archive.today/20130415050745/http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commit;h=d949d0ec9c601f2b148bed3cdb5f87c052968554" target="_blank">https://archive.today/20130415050745/http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commit;h=d949d0ec9c601f2b148bed3cdb5f87c052968554</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>"Seccomp filter in Android O". Android Developers Blog. <a href="https://android-developers.googleblog.com/2017/07/seccomp-filter-in-android-o.html" target="_blank">https://android-developers.googleblog.com/2017/07/seccomp-filter-in-android-o.html</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>"systemd.exec — Execution environment configuration". freedesktop.org. Retrieved 2017-10-14. <a href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html" target="_blank">https://www.freedesktop.org/software/systemd/man/systemd.exec.html</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>Otubo, Eduardo (2017-09-15). "QEMU Sandboxing new model pull request". qemu-devel mailing list archive. <a href="https://lists.gnu.org/archive/html/qemu-devel/2017-09/msg04072.html" target="_blank">https://lists.gnu.org/archive/html/qemu-devel/2017-09/msg04072.html</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>van de Ven, Arjan (2009-02-28). "Re: [stable] [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole". Linux Kernel Mailing List. Retrieved 2013-08-02. <a href="https://lkml.org/lkml/2009/2/28/141" target="_blank">https://lkml.org/lkml/2009/2/28/141</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>Torvalds, Linus (2009-02-28). "Re: [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole". Linux Kernel Mailing List. Retrieved 2013-08-02. <a href="https://lkml.org/lkml/2009/2/28/129" target="_blank">https://lkml.org/lkml/2009/2/28/129</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>Gutschke, Markus (2009-05-06). "Re: [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole". Retrieved 2013-08-02. <a href="http://article.gmane.org/gmane.linux.ports.sparc/11622" target="_blank">http://article.gmane.org/gmane.linux.ports.sparc/11622</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> <li id="fn:18"><p>Gutschke, Markus (2009-05-06). "Re: [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole". Linux Kernel Mailing List. Retrieved 2013-08-02. <a href="https://lkml.org/lkml/2009/5/6/365" target="_blank">https://lkml.org/lkml/2009/5/6/365</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li> <li id="fn:19"><p>"Firejail". Firejail. Retrieved 2016-11-26. <a href="https://firejail.wordpress.com/" target="_blank">https://firejail.wordpress.com/</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></p></li> <li id="fn:20"><p>Evans, Chris (2012-07-04). "Chrome 20 on Linux and Flash sandboxing". Retrieved 2013-08-02. <a href="http://scarybeastsecurity.blogspot.com/2012/07/chrome-20-on-linux-and-flash-sandboxing.html" target="_blank">http://scarybeastsecurity.blogspot.com/2012/07/chrome-20-on-linux-and-flash-sandboxing.html</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></p></li> <li id="fn:21"><p>Tinnes, Julien (2012-09-06). "Introducing Chrome's next-generation Linux sandbox". cr0 blog. Retrieved 2013-08-02. <a href="http://blog.cr0.org/2012/09/introducing-chromes-next-generation.html" target="_blank">http://blog.cr0.org/2012/09/introducing-chromes-next-generation.html</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></p></li> <li id="fn:22"><p>"Snap security policy". Archived from the original on 2017-02-04. Retrieved 2017-02-03. <a href="https://web.archive.org/web/20170204012221/https://developer.ubuntu.com/en/snappy/guides/security/" target="_blank">https://web.archive.org/web/20170204012221/https://developer.ubuntu.com/en/snappy/guides/security/</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></p></li> <li id="fn:23"><p>Evans, Chris (2012-04-09). "vsftpd-3.0.0 and seccomp filter sandboxing is here!". Retrieved 2013-08-02. <a href="http://scarybeastsecurity.blogspot.de/2012/04/vsftpd-300-and-seccomp-filter.html" target="_blank">http://scarybeastsecurity.blogspot.de/2012/04/vsftpd-300-and-seccomp-filter.html</a> <a href="#fnref:23" class="footnote-back-ref">↩</a></p></li> <li id="fn:24"><p>"Openssh 6.0 release notes". Retrieved 2013-10-14. <a href="https://www.openssh.com/txt/release-6.0" target="_blank">https://www.openssh.com/txt/release-6.0</a> <a href="#fnref:24" class="footnote-back-ref">↩</a></p></li> <li id="fn:25"><p>"MBOX". Retrieved 2014-05-20. <a href="http://pdos.csail.mit.edu/mbox/" target="_blank">http://pdos.csail.mit.edu/mbox/</a> <a href="#fnref:25" class="footnote-back-ref">↩</a></p></li> <li id="fn:26"><p>"LXD an "hypervisor" for containers (based on liblxc)". 4 November 2014. Retrieved 2014-11-08. <a href="https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-November/010817.html" target="_blank">https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-November/010817.html</a> <a href="#fnref:26" class="footnote-back-ref">↩</a></p></li> <li id="fn:27"><p>"Where We're Going With LXD". Retrieved 2014-11-08. <a href="http://blog.dustinkirkland.com/2014/11/where-were-going-with-lxd.html" target="_blank">http://blog.dustinkirkland.com/2014/11/where-were-going-with-lxd.html</a> <a href="#fnref:27" class="footnote-back-ref">↩</a></p></li> <li id="fn:28"><p>Destuynder, Guillaume (2012-09-13). "Firefox Seccomp sandbox". Mozilla Bugzilla. Retrieved 2015-01-13. <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=790923" target="_blank">https://bugzilla.mozilla.org/show_bug.cgi?id=790923</a> <a href="#fnref:28" class="footnote-back-ref">↩</a></p></li> <li id="fn:29"><p>Destuynder, Guillaume (2012-09-13). "Firefox Seccomp sandbox". Mozilla Wiki. Retrieved 2015-01-13. <a href="https://wiki.mozilla.org/Security/Sandbox/Seccomp" target="_blank">https://wiki.mozilla.org/Security/Sandbox/Seccomp</a> <a href="#fnref:29" class="footnote-back-ref">↩</a></p></li> <li id="fn:30"><p>"Tor ChangeLog". <a href="https://gitweb.torproject.org/tor.git/plain/ChangeLog" target="_blank">https://gitweb.torproject.org/tor.git/plain/ChangeLog</a> <a href="#fnref:30" class="footnote-back-ref">↩</a></p></li> <li id="fn:31"><p>"Lepton image compression: saving 22% losslessly from images at 15MB/s". Dropbox Tech Blog. Retrieved 2016-07-15. <a href="https://blogs.dropbox.com/tech/2016/07/lepton-image-compression-saving-22-losslessly-from-images-at-15mbs/" target="_blank">https://blogs.dropbox.com/tech/2016/07/lepton-image-compression-saving-22-losslessly-from-images-at-15mbs/</a> <a href="#fnref:31" class="footnote-back-ref">↩</a></p></li> <li id="fn:32"><p>"Kafel: A language and library for specifying syscall filtering policies". <a href="https://google.github.io/kafel/" target="_blank">https://google.github.io/kafel/</a> <a href="#fnref:32" class="footnote-back-ref">↩</a></p></li> <li id="fn:33"><p>"Subgraph OS". Subgraph. Retrieved 2016-12-18. <a href="https://subgraph.com/" target="_blank">https://subgraph.com/</a> <a href="#fnref:33" class="footnote-back-ref">↩</a></p></li> <li id="fn:34"><p>"LoganCIJ16: Future of OS". YouTube. Archived from the original on 2021-12-21. Retrieved 2016-12-18. <a href="https://www.youtube.com/watch?v=Nol8kKoB-co&t=48m56s" target="_blank">https://www.youtube.com/watch?v=Nol8kKoB-co&t=48m56s</a> <a href="#fnref:34" class="footnote-back-ref">↩</a></p></li> <li id="fn:35"><p>"The flatpak security model – part 1: The basics". Retrieved 2017-01-21. <a href="https://blogs.gnome.org/alexl/2017/01/18/the-flatpak-security-model-part-1-the-basics/" target="_blank">https://blogs.gnome.org/alexl/2017/01/18/the-flatpak-security-model-part-1-the-basics/</a> <a href="#fnref:35" class="footnote-back-ref">↩</a></p></li> <li id="fn:36"><p>"bubblewrap". Retrieved 2018-04-14. <a href="https://wiki.archlinux.org/index.php/Bubblewrap" target="_blank">https://wiki.archlinux.org/index.php/Bubblewrap</a> <a href="#fnref:36" class="footnote-back-ref">↩</a></p></li> <li id="fn:37"><p>"Chromium OS Sandboxing - the Chromium Projects". <a href="https://www.chromium.org/chromium-os/developer-guide/chromium-os-sandboxing" target="_blank">https://www.chromium.org/chromium-os/developer-guide/chromium-os-sandboxing</a> <a href="#fnref:37" class="footnote-back-ref">↩</a></p></li> <li id="fn:38"><p>"Minijail [LWN.net]". lwn.net. Retrieved 2017-04-11. <a href="https://lwn.net/Articles/700557/" target="_blank">https://lwn.net/Articles/700557/</a> <a href="#fnref:38" class="footnote-back-ref">↩</a></p></li> <li id="fn:39"><p>"core/trace/use_seccomp". dev.exherbo.org. Retrieved 2021-05-31. <a href="https://dev.exherbo.org/~alip/sydbox/sydbox.html" target="_blank">https://dev.exherbo.org/~alip/sydbox/sydbox.html</a> <a href="#fnref:39" class="footnote-back-ref">↩</a></p></li> <li id="fn:40"><p>"File application Sandboxing". GitHub. <a href="https://github.com/file/file/blob/master/src/seccomp.c" target="_blank">https://github.com/file/file/blob/master/src/seccomp.c</a> <a href="#fnref:40" class="footnote-back-ref">↩</a></p></li> <li id="fn:41"><p>"Zathura seccomp implementation". <a href="https://github.com/pwmt/zathura/blob/develop/zathura/seccomp-filters.c" target="_blank">https://github.com/pwmt/zathura/blob/develop/zathura/seccomp-filters.c</a> <a href="#fnref:41" class="footnote-back-ref">↩</a></p></li> <li id="fn:42"><p>"Gnome tracker seccomp implementation". <a href="https://gitlab.gnome.org/GNOME/tracker-miners/-/blob/master/src/libtracker-miners-common/tracker-seccomp.c" target="_blank">https://gitlab.gnome.org/GNOME/tracker-miners/-/blob/master/src/libtracker-miners-common/tracker-seccomp.c</a> <a href="#fnref:42" class="footnote-back-ref">↩</a></p></li> </ol>