How to check if a seccomp filter is applied in Linux

Introduction

In this lab, you will learn how to check if a seccomp filter is applied in Linux. Seccomp is a security feature that restricts the system calls a process can make.

You will explore three methods to verify seccomp status: examining the /proc/self/status file to check the process's seccomp state, inspecting kernel messages using dmesg for seccomp-related events, and checking the /sys/kernel/security directory for seccomp configuration information. These steps will provide you with practical skills for understanding and verifying seccomp application in a Linux environment.

Skills Graph

Check seccomp status with cat /proc/self/status

In this step, we will explore how to check the seccomp status of a process in Linux. Seccomp (Secure Computing) is a security feature that allows a process to restrict the system calls it can make. This can help to mitigate the impact of security vulnerabilities.

We can check the seccomp status of the current process by examining the /proc/self/status file. This file contains various status information about the process.

Open your terminal if it's not already open. You can do this by clicking the Xfce Terminal icon on the left side of the desktop.

Now, type the following command and press Enter:

cat /proc/self/status

This command will display the contents of the /proc/self/status file. Scroll through the output and look for a line that starts with Seccomp:.

You should see output similar to this:

Name:   zsh
Umask:  0002
State:  R (running)
Tgid:   ...
Ngid:   0
Pid:    ...
PPid:   ...
TracerPid:      0
Uid:    ...
Gid:    ...
FDSize: 64
Groups: ...
NStgid: ...
NSpid:  ...
NSpgid: ...
NSsid:  ...
VmPeak: ... kB
VmSize: ... kB
VmLck:  0 kB
VmPin:  0 kB
VmHWM:  ... kB
VmRSS:  ... kB
RssAnon:        ... kB
RssFile:        ... kB
RssShmem:       ... kB
VmData: ... kB
VmStk:  ... kB
VmExe:  ... kB
VmLib:  ... kB
VmPTE:  ... kB
VmSwap: 0 kB
HugetlbPages:   0 kB
CoreDumpFilter: 00000000
Threads:        1
SigQ:   .../...
SigPnd: 0000000000000000
ShdPnd: 0000000000000000
voluntary_ctxt_switches:        ...
nonvoluntary_ctxt_switches:     ...
Seccomp:        0

The Seccomp: line indicates the seccomp status. The value 0 means that seccomp is not enabled for this process. Other possible values indicate different seccomp modes.

Understanding the output of /proc/self/status is a fundamental skill for inspecting process information in Linux.

Click Continue to proceed to the next step.

Verify seccomp in dmesg

In this step, we will learn how to check kernel messages related to seccomp using the dmesg command. dmesg is a command that displays the kernel ring buffer messages. These messages contain information about hardware, device drivers, and other kernel-level events, including security-related events like seccomp actions.

When seccomp is active and blocks a system call, the kernel often logs a message to the ring buffer. We can use dmesg to view these messages and filter for ones related to seccomp.

Open your terminal if it's not already open.

Now, type the following command and press Enter:

dmesg | grep seccomp

Let's break down this command:

• dmesg: This command displays the kernel messages.
• |: This is a pipe. It takes the output of the command on the left (dmesg) and sends it as input to the command on the right (grep).
• grep seccomp: This command searches for lines containing the word "seccomp" in the input it receives.

The output of this command will show any kernel messages that include the term "seccomp". In a typical environment where seccomp is used by some system processes or containers, you might see output similar to this:

[ ... ] audit: type=1326 audit(...): auid=... uid=... gid=... ses=... subj=unconfined seccomp=0 pid=... comm="..." exe="..." sig=0 arch=c000003e syscall=... compat=0 ip=... code=0x...
[ ... ] audit: type=1326 audit(...): auid=... uid=... gid=... ses=... subj=unconfined seccomp=2 pid=... comm="..." exe="..." sig=0 arch=c000003e syscall=... compat=0 ip=... code=0x...

These messages indicate that the kernel's auditing system is logging seccomp-related events. The seccomp= field in the audit message shows the seccomp mode for the process at the time of the event.

If you don't see any output, it might mean that no seccomp-related events have been logged recently in this specific environment. This is also normal and depends on the system's activity.

Using dmesg with grep is a powerful way to filter kernel messages and diagnose issues or observe security events.

Click Continue to move to the next step.

Inspect seccomp in /sys/kernel/security

In this final step, we will explore the /sys/kernel/security directory, which provides an interface to various kernel security modules, including seccomp. This directory allows us to inspect and sometimes configure security-related aspects of the kernel.

Open your terminal if it's not already open.

First, let's navigate to the /sys/kernel/security directory. We can use the cd command for this:

cd /sys/kernel/security

Now that we are in the /sys/kernel/security directory, let's list its contents using the ls command:

ls

You should see a list of directories and files related to different security modules. Look for a directory or file related to seccomp. The output might look something like this (the exact contents can vary depending on the system):

apparmor  cap  device_cgroup  lockdown  lsm  selinux  seccomp  smack  tomoyo

You should see a directory named seccomp. This directory contains files that provide information about the seccomp configuration and status at the kernel level.

Let's navigate into the seccomp directory:

cd seccomp

Now, list the contents of the seccomp directory:

ls

You might see files like policy or other files depending on the kernel version and configuration. These files can provide more detailed information about the seccomp policies that are loaded or available on the system.

For example, you might try to view the content of a file like policy if it exists (the file name might be different):

cat policy

The output of cat policy would depend on whether a seccomp policy is active system-wide or if this file provides other information. In many standard configurations, this file might not contain extensive human-readable policy details directly, but its presence indicates seccomp is a recognized security module.

Exploring the /sys filesystem, particularly the /sys/kernel/security path, is a key way to understand the security features enabled and configured in your Linux kernel.

You have now learned three different ways to check for seccomp status and related information in a Linux environment.

Click Continue to complete the lab.

Summary

In this lab, we learned how to check if a seccomp filter is applied in Linux. We explored three methods: checking the /proc/self/status file to see the Seccomp: status of a process, verifying seccomp-related messages in the kernel log using dmesg, and inspecting the seccomp status through the /sys/kernel/security filesystem.

These steps provided practical ways to determine the seccomp status of processes and understand how seccomp is reported by the Linux kernel, which is crucial for security analysis and troubleshooting.