Seccomp (Secure Computing Mode) is a Linux kernel feature that restricts the system calls available to a process. This guide covers Java-based Seccomp integration, policy management, and comprehensive application sandboxing.
Dependencies and Setup
1. Maven Dependencies
<properties>
<jnr-unixsocket.version>0.38.19</jnr-unixsocket.version>
<jna.version>5.13.0</jna.version>
<jackson.version>2.15.2</jackson.version>
</properties>
<dependencies>
<!-- JNR for native system calls -->
<dependency>
<groupId>com.github.jnr</groupId>
<artifactId>jnr-unixsocket</artifactId>
<version>${jnr-unixsocket.version}</version>
</dependency>
<!-- JNA for native access -->
<dependency>
<groupId>net.java.dev.jna</groupId>
<artifactId>jna</artifactId>
<version>${jna.version}</version>
</dependency>
<!-- JSON Processing -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${jackson.version}</version>
</dependency>
<!-- YAML Processing -->
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-yaml</artifactId>
<version>${jackson.version}</version>
</dependency>
<!-- Logging -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>2.0.7</version>
</dependency>
</dependencies>
Core Seccomp Integration
1. Native Seccomp Interface
package com.example.seccomp.native;
import com.sun.jna.*;
import com.sun.jna.ptr.PointerByReference;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public interface SeccompLib extends Library {
SeccompLib INSTANCE = Native.load("seccomp", SeccompLib.class);
// Seccomp actions
int SCMP_ACT_KILL = 0x00000000;
int SCMP_ACT_TRAP = 0x00030000;
int SCMP_ACT_ERRNO(int errno) {
return 0x00050000 | (errno & 0x0000FFFF);
}
int SCMP_ACT_TRACE(int msg) {
return 0x7FF00000 | (msg & 0x0000FFFF);
}
int SCMP_ACT_ALLOW = 0x7FFF0000;
int SCMP_ACT_LOG = 0x7FFC0000;
// Filter attributes
int SCMP_FLTATR_ACT_DEFAULT = 0;
int SCMP_FLTATR_ACT_BADARCH = 1;
int SCMP_FLTATR_CTL_NNP = 2;
int SCMP_FLTATR_CTL_TSYNC = 3;
int SCMP_FLTATR_API_SYSRAWRC = 4;
// Architecture definitions
int SCMP_ARCH_NATIVE = 0;
int SCMP_ARCH_X86 = 3;
int SCMP_ARCH_X86_64 = 4;
int SCMP_ARCH_ARM = 1;
int SCMP_ARCH_AARCH64 = 2;
int SCMP_ARCH_MIPS = 5;
int SCMP_ARCH_MIPS64 = 6;
int SCMP_ARCH_MIPS64N32 = 7;
int SCMP_ARCH_MIPSEL = 8;
int SCMP_ARCH_MIPSEL64 = 9;
int SCMP_ARCH_MIPSEL64N32 = 10;
int SCMP_ARCH_PPC = 11;
int SCMP_ARCH_PPC64 = 12;
int SCMP_ARCH_PPC64LE = 13;
int SCMP_ARCH_S390 = 14;
int SCMP_ARCH_S390X = 15;
// Comparison operators
int SCMP_CMP_NE = 1;
int SCMP_CMP_LT = 2;
int SCMP_CMP_LE = 3;
int SCMP_CMP_EQ = 4;
int SCMP_CMP_GE = 5;
int SCMP_CMP_GT = 6;
int SCMP_CMP_MASKED_EQ = 7;
// Functions
int seccomp_init(int def_action);
int seccomp_reset(Pointer ctx, int def_action);
int seccomp_rule_add(Pointer ctx, int action, int syscall, int arg_cnt, Object... args);
int seccomp_rule_add_exact(Pointer ctx, int action, int syscall, int arg_cnt, Object... args);
int seccomp_rule_add_array(Pointer ctx, int action, int syscall, int arg_cnt, Pointer rule_arr);
int seccomp_syscall_resolve_name(Pointer ctx, String name);
int seccomp_syscall_resolve_name_arch(int arch_token, String name);
int seccomp_syscall_resolve_num_arch(int arch_token, int num);
int seccomp_arch_add(Pointer ctx, int arch_token);
int seccomp_arch_remove(Pointer ctx, int arch_token);
int seccomp_arch_exist(Pointer ctx, int arch_token);
int seccomp_attr_set(Pointer ctx, int attr, int value);
int seccomp_attr_get(Pointer ctx, int attr, IntByReference value);
int seccomp_load(Pointer ctx);
void seccomp_release(Pointer ctx);
String seccomp_version();
int seccomp_export_bpf(Pointer ctx, int fd);
int seccomp_export_pfc(Pointer ctx, int fd);
}
2. Java Seccomp Wrapper
package com.example.seccomp.core;
import com.example.seccomp.native.SeccompLib;
import com.sun.jna.Pointer;
import com.sun.jna.ptr.IntByReference;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.FileDescriptor;
import java.io.FileOutputStream;
import java.io.IOException;
import java.util.*;
public class SeccompFilter {
private static final Logger logger = LoggerFactory.getLogger(SeccompFilter.class);
private final Pointer ctx;
private final Map<String, Integer> syscallCache;
private boolean loaded = false;
public SeccompFilter(int defaultAction) {
this.ctx = SeccompLib.INSTANCE.seccomp_init(defaultAction);
if (ctx == null) {
throw new SeccompException("Failed to initialize seccomp context");
}
this.syscallCache = new HashMap<>();
logger.debug("Initialized seccomp filter with default action: 0x{}",
Integer.toHexString(defaultAction));
}
public SeccompFilter() {
this(SeccompLib.INSTANCE.SCMP_ACT_ALLOW); // Default: allow all
}
public void addRule(String syscallName, int action, SeccompArg... args) {
int syscall = resolveSyscall(syscallName);
if (syscall < 0) {
logger.warn("Unknown syscall: {}", syscallName);
return;
}
int result;
if (args == null || args.length == 0) {
result = SeccompLib.INSTANCE.seccomp_rule_add(ctx, action, syscall, 0);
} else {
// Convert args to native format
List<Object> nativeArgs = new ArrayList<>();
for (SeccompArg arg : args) {
nativeArgs.add(arg.toNative());
}
result = SeccompLib.INSTANCE.seccomp_rule_add(ctx, action, syscall, args.length,
nativeArgs.toArray());
}
if (result < 0) {
throw new SeccompException("Failed to add rule for syscall: " + syscallName +
", error: " + result);
}
logger.debug("Added rule: {} -> 0x{}", syscallName, Integer.toHexString(action));
}
public void addExactRule(String syscallName, int action, SeccompArg... args) {
int syscall = resolveSyscall(syscallName);
if (syscall < 0) {
logger.warn("Unknown syscall: {}", syscallName);
return;
}
int result;
if (args == null || args.length == 0) {
result = SeccompLib.INSTANCE.seccomp_rule_add_exact(ctx, action, syscall, 0);
} else {
List<Object> nativeArgs = new ArrayList<>();
for (SeccompArg arg : args) {
nativeArgs.add(arg.toNative());
}
result = SeccompLib.INSTANCE.seccomp_rule_add_exact(ctx, action, syscall,
args.length, nativeArgs.toArray());
}
if (result < 0) {
throw new SeccompException("Failed to add exact rule for syscall: " + syscallName);
}
logger.debug("Added exact rule: {} -> 0x{}", syscallName, Integer.toHexString(action));
}
public void allowSyscall(String syscallName) {
addRule(syscallName, SeccompLib.INSTANCE.SCMP_ACT_ALLOW);
}
public void killSyscall(String syscallName) {
addRule(syscallName, SeccompLib.INSTANCE.SCMP_ACT_KILL);
}
public void trapSyscall(String syscallName) {
addRule(syscallName, SeccompLib.INSTANCE.SCMP_ACT_TRAP);
}
public void errnoSyscall(String syscallName, int errno) {
addRule(syscallName, SeccompLib.INSTANCE.SCMP_ACT_ERRNO(errno));
}
public void logSyscall(String syscallName) {
addRule(syscallName, SeccompLib.INSTANCE.SCMP_ACT_LOG);
}
public void addArchitecture(int arch) {
int result = SeccompLib.INSTANCE.seccomp_arch_add(ctx, arch);
if (result < 0) {
throw new SeccompException("Failed to add architecture: " + arch);
}
logger.debug("Added architecture: {}", arch);
}
public void removeArchitecture(int arch) {
int result = SeccompLib.INSTANCE.seccomp_arch_remove(ctx, arch);
if (result < 0) {
throw new SeccompException("Failed to remove architecture: " + arch);
}
logger.debug("Removed architecture: {}", arch);
}
public boolean hasArchitecture(int arch) {
int result = SeccompLib.INSTANCE.seccomp_arch_exist(ctx, arch);
return result == 0;
}
public void setAttribute(int attribute, int value) {
int result = SeccompLib.INSTANCE.seccomp_attr_set(ctx, attribute, value);
if (result < 0) {
throw new SeccompException("Failed to set attribute: " + attribute + " = " + value);
}
logger.debug("Set attribute {} = {}", attribute, value);
}
public int getAttribute(int attribute) {
IntByReference value = new IntByReference();
int result = SeccompLib.INSTANCE.seccomp_attr_get(ctx, attribute, value);
if (result < 0) {
throw new SeccompException("Failed to get attribute: " + attribute);
}
return value.getValue();
}
public void load() {
if (loaded) {
throw new IllegalStateException("Seccomp filter already loaded");
}
int result = SeccompLib.INSTANCE.seccomp_load(ctx);
if (result < 0) {
throw new SeccompException("Failed to load seccomp filter, error: " + result);
}
loaded = true;
logger.info("Seccomp filter loaded successfully");
}
public void exportBpf(FileOutputStream fos) throws IOException {
FileDescriptor fd = fos.getFD();
int result = SeccompLib.INSTANCE.seccomp_export_bpf(ctx, getFdInt(fd));
if (result < 0) {
throw new SeccompException("Failed to export BPF, error: " + result);
}
logger.debug("Exported BPF to file descriptor: {}", getFdInt(fd));
}
public void exportPfc(FileOutputStream fos) throws IOException {
FileDescriptor fd = fos.getFD();
int result = SeccompLib.INSTANCE.seccomp_export_pfc(ctx, getFdInt(fd));
if (result < 0) {
throw new SeccompException("Failed to export PFC, error: " + result);
}
logger.debug("Exported PFC to file descriptor: {}", getFdInt(fd));
}
public String getVersion() {
return SeccompLib.INSTANCE.seccomp_version();
}
public void reset(int defaultAction) {
int result = SeccompLib.INSTANCE.seccomp_reset(ctx, defaultAction);
if (result < 0) {
throw new SeccompException("Failed to reset seccomp filter");
}
syscallCache.clear();
loaded = false;
logger.debug("Reset seccomp filter with default action: 0x{}",
Integer.toHexString(defaultAction));
}
public void release() {
if (ctx != null) {
SeccompLib.INSTANCE.seccomp_release(ctx);
logger.debug("Released seccomp context");
}
}
private int resolveSyscall(String syscallName) {
return syscallCache.computeIfAbsent(syscallName, name -> {
int syscall = SeccompLib.INSTANCE.seccomp_syscall_resolve_name(ctx, name);
if (syscall < 0) {
logger.warn("Failed to resolve syscall: {}", name);
}
return syscall;
});
}
private int getFdInt(FileDescriptor fd) {
try {
return (int) FileDescriptor.class.getDeclaredField("fd").get(fd);
} catch (Exception e) {
throw new SeccompException("Failed to get file descriptor integer", e);
}
}
public boolean isLoaded() {
return loaded;
}
@Override
protected void finalize() throws Throwable {
try {
release();
} finally {
super.finalize();
}
}
}
package com.example.seccomp.core;
import com.sun.jna.Structure;
@Structure.FieldOrder({"k", "op", "datum_a", "datum_b"})
public class SeccompArg extends Structure {
public int k;
public int op;
public long datum_a;
public long datum_b;
public SeccompArg(int argIndex, int operator, long valueA, long valueB) {
this.k = argIndex;
this.op = operator;
this.datum_a = valueA;
this.datum_b = valueB;
}
public static SeccompArg eq(int argIndex, long value) {
return new SeccompArg(argIndex, 4, value, 0); // SCMP_CMP_EQ = 4
}
public static SeccompArg ne(int argIndex, long value) {
return new SeccompArg(argIndex, 1, value, 0); // SCMP_CMP_NE = 1
}
public static SeccompArg lt(int argIndex, long value) {
return new SeccompArg(argIndex, 2, value, 0); // SCMP_CMP_LT = 2
}
public static SeccompArg le(int argIndex, long value) {
return new SeccompArg(argIndex, 3, value, 0); // SCMP_CMP_LE = 3
}
public static SeccompArg ge(int argIndex, long value) {
return new SeccompArg(argIndex, 5, value, 0); // SCMP_CMP_GE = 5
}
public static SeccompArg gt(int argIndex, long value) {
return new SeccompArg(argIndex, 6, value, 0); // SCMP_CMP_GT = 6
}
public static SeccompArg maskedEq(int argIndex, long mask, long value) {
return new SeccompArg(argIndex, 7, value, mask); // SCMP_CMP_MASKED_EQ = 7
}
public Object toNative() {
return this.getPointer();
}
}
package com.example.seccomp.core;
public class SeccompException extends RuntimeException {
public SeccompException(String message) {
super(message);
}
public SeccompException(String message, Throwable cause) {
super(message, cause);
}
}
3. Seccomp Policy Manager
```java
package com.example.seccomp.policy;
import com.example.seccomp.core.SeccompFilter;
import com.example.seccomp.core.SeccompArg;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.; import java.util.;
public class SeccompPolicyManager {
private static final Logger logger = LoggerFactory.getLogger(SeccompPolicyManager.class);
private final ObjectMapper objectMapper;
private final ObjectMapper yamlMapper;
private final Map<String, SeccompPolicy> policies;
private SeccompFilter currentFilter;
public SeccompPolicyManager() {
this.objectMapper = new ObjectMapper();
this.yamlMapper = new ObjectMapper(new YAMLFactory());
this.policies = new HashMap<>();
}
public SeccompPolicy loadPolicy(String name, File policyFile) throws IOException {
SeccompPolicy policy;
if (policyFile.getName().endsWith(".json")) {
policy = objectMapper.readValue(policyFile, SeccompPolicy.class);
} else if (policyFile.getName().endsWith(".yaml") || policyFile.getName().endsWith(".yml")) {
policy = yamlMapper.readValue(policyFile, SeccompPolicy.class);
} else {
throw new IllegalArgumentException("Unsupported policy file format: " + policyFile.getName());
}
policy.setName(name);
policies.put(name, policy);
logger.info("Loaded seccomp policy: {} from {}", name, policyFile.getAbsolutePath());
return policy;
}
public SeccompPolicy createPolicy(String name, PolicyConfig config) {
SeccompPolicy policy = new SeccompPolicy();
policy.setName(name);
policy.setDefaultAction(config.getDefaultAction());
policy.setArchitectures(config.getArchitectures());
policy.setSyscalls(new ArrayList<>());
// Add default syscalls based on profile
if (config.getProfile() != null) {
applyProfile(policy, config.getProfile());
}
// Add custom syscalls
if (config.getAdditionalSyscalls() != null) {
config.getAdditionalSyscalls().forEach((syscall, action) ->
policy.addSyscall(new SyscallRule(syscall, action)));
}
policies.put(name, policy);
logger.info("Created seccomp policy: {}", name);
return policy;
}
public void applyPolicy(String policyName) {
SeccompPolicy policy = policies.get(policyName);
if (policy == null) {
throw new IllegalArgumentException("Policy not found: " + policyName);
}
applyPolicy(policy);
}
public void applyPolicy(SeccompPolicy policy) {
if (currentFilter != null && currentFilter.isLoaded()) {
logger.warn("Seccomp filter already loaded, creating new filter");
}
// Create new filter
currentFilter = new SeccompFilter(policy.getDefaultAction());
// Add architectures
if (policy.getArchitectures() != null) {
for (String arch : policy.getArchitectures()) {
int archToken = mapArchitecture(arch);
currentFilter.addArchitecture(archToken);
}
}
// Add syscall rules
if (policy.getSyscalls() != null) {
for (SyscallRule rule : policy.getSyscalls()) {
applySyscallRule(currentFilter, rule);
}
}
// Set attributes
if (policy.getAttributes() != null) {
policy.getAttributes().forEach((attr, value) ->
currentFilter.setAttribute(mapAttribute(attr), value));
}
// Load the filter
currentFilter.load();
logger.info("Applied seccomp policy: {}", policy.getName());
}
public void savePolicy(String policyName, File outputFile) throws IOException {
SeccompPolicy policy = policies.get(policyName);
if (policy == null) {
throw new IllegalArgumentException("Policy not found: " + policyName);
}
if (outputFile.getName().endsWith(".json")) {
objectMapper.writerWithDefaultPrettyPrinter().writeValue(outputFile, policy);
} else if (outputFile.getName().endsWith(".yaml") || outputFile.getName().endsWith(".yml")) {
yamlMapper.writerWithDefaultPrettyPrinter().writeValue(outputFile, policy);
} else {
throw new IllegalArgumentException("Unsupported output format: " + outputFile.getName());
}
logger.info("Saved policy {} to {}", policyName, outputFile.getAbsolutePath());
}
public void exportCurrentFilter(File bpfFile, File pfcFile) throws IOException {
if (currentFilter == null || !currentFilter.isLoaded()) {
throw new IllegalStateException("No seccomp filter loaded");
}
if (bpfFile != null) {
try (FileOutputStream fos = new FileOutputStream(bpfFile)) {
currentFilter.exportBpf(fos);
logger.debug("Exported BPF to: {}", bpfFile.getAbsolutePath());
}
}
if (pfcFile != null) {
try (FileOutputStream fos = new FileOutputStream(pfcFile)) {
currentFilter.exportPfc(fos);
logger.debug("Exported PFC to: {}", pfcFile.getAbsolutePath());
}
}
}
public SeccompPolicy getPolicy(String name) {
return policies.get(name);
}
public Map<String, SeccompPolicy> getAllPolicies() {
return new HashMap<>(policies);
}
public void removePolicy(String name) {
policies.remove(name);
logger.info("Removed policy: {}", name);
}
public String getCurrentFilterVersion() {
if (currentFilter == null) {
return "No filter loaded";
}
return currentFilter.getVersion();
}
private void applyProfile(SeccompPolicy policy, SecurityProfile profile) {
switch (profile) {
case RESTRICTED:
applyRestrictedProfile(policy);
break;
case BASELINE:
applyBaselineProfile(policy);
break;
case PRIVILEGED:
applyPrivilegedProfile(policy);
break;
case DOCKER_DEFAULT:
applyDockerDefaultProfile(policy);
break;
default:
logger.warn("Unknown profile: {}", profile);
}
}
private void applyRestrictedProfile(SeccompPolicy policy) {
// Very restrictive profile - only essential syscalls
String[] allowedSyscalls = {
"read", "write", "close", "fstat", "lseek", "mmap", "mprotect",
"munmap", "brk", "rt_sigaction", "rt_sigprocmask", "rt_sigreturn",
"ioctl", "pread64", "pwrite64", "readv", "writev", "access",
"pipe", "select", "dup", "dup2", "getpid", "socketcall",
"fcntl", "fsync", "fdatasync", "truncate", "ftruncate",
"getcwd", "chdir", "fchdir", "rename", "mkdir", "rmdir",
"creat", "link", "unlink", "symlink", "readlink", "chmod",
"fchmod", "chown", "fchown", "lchown", "umask", "gettimeofday",
"getrlimit", "getrusage", "sysinfo", "times", "ptrace",
"getuid", "syscall", "exit", "exit_group", "wait4", "kill",
"uname", "semget", "semop", "semctl", "shmdt", "msgrcv",
"msgsnd", "msgctl", "fcntl64", "getdents", "getdents64",
"gettid", "time", "futex", "sched_setaffinity", "sched_getaffinity",
"set_thread_area", "exit_group", "epoll_wait", "epoll_ctl",
"tgkill", "utimes", "vserver", "open", "openat"
};
for (String syscall : allowedSyscalls) {
policy.addSyscall(new SyscallRule(syscall, "ALLOW"));
}
// Deny dangerous syscalls
String[] deniedSyscalls = {
"execve", "fork", "vfork", "clone", "kill", "ptrace",
"capset", "setuid", "setgid", "setgroups", "setreuid",
"setregid", "setresuid", "setresgid", "setfsuid", "setfsgid",
"acct", "chroot", "personality", "setpriority", "sched_setscheduler",
"iopl", "ioperm", "create_module", "init_module", "delete_module",
"quotactl", "nfsservctl", "mount", "umount2", "swapon", "swapoff",
"syslog", "reboot", "sethostname", "setdomainname"
};
for (String syscall : deniedSyscalls) {
policy.addSyscall(new SyscallRule(syscall, "KILL"));
}
policy.setDefaultAction("ERRNO(EPERM)");
}
private void applyBaselineProfile(SeccompPolicy policy) {
// Baseline profile - common syscalls for typical applications
applyRestrictedProfile(policy); // Start with restricted
// Additional allowed syscalls
String[] additionalAllowed = {
"execve", "fork", "clone", "waitpid", "wait4",
"getppid", "getpgrp", "setsid", "setpgid", "getsid",
"prctl", "arch_prctl", "set_tid_address", "set_robust_list",
"get_robust_list", "setrlimit", "chroot", "sync", "fsync",
"fdatasync", "truncate", "ftruncate", "getdents", "getdents64",
"getcwd", "chdir", "fchdir", "rename", "mkdir", "rmdir",
"creat", "link", "unlink", "symlink", "readlink", "chmod",
"fchmod", "chown", "fchown", "lchown", "umask", "gettimeofday",
"getrlimit", "getrusage", "sysinfo", "times", "ptrace",
"getuid", "syscall", "exit", "exit_group", "wait4", "kill"
};
for (String syscall : additionalAllowed) {
policy.addSyscall(new SyscallRule(syscall, "ALLOW"));
}
policy.setDefaultAction("ALLOW");
}
private void applyPrivilegedProfile(SeccompPolicy policy) {
// Privileged profile - allow most syscalls (for trusted applications)
policy.setDefaultAction("ALLOW");
// Only block the most dangerous syscalls
String[] blockedSyscalls = {
"keyctl", "add_key", "request_key", "iopl", "ioperm",
"sysctl", "nfsservctl", "quotactl", "swapon", "swapoff",
"syslog", "reboot"
};
for (String syscall : blockedSyscalls) {
policy.addSyscall(new SyscallRule(syscall, "KILL"));
}
}
private void applyDockerDefaultProfile(SeccompPolicy policy) {
// Docker's default seccomp profile (simplified)
String[] allowedSyscalls = {
"accept", "accept4", "access", "alarm", "bind", "brk", "capget",
"capset", "chdir", "chmod", "chown", "chown32", "clock_getres",
"clock_gettime", "clock_nanosleep", "close", "connect", "copy_file_range",
"creat", "dup", "dup2", "dup3", "epoll_create", "epoll_create1",
"epoll_ctl", "epoll_ctl_old", "epoll_pwait", "epoll_wait", "epoll_wait_old",
"eventfd", "eventfd2", "execve", "execveat", "exit", "exit_group",
"faccessat", "fadvise64", "fadvise64_64", "fallocate", "fanotify_mark",
"fchdir", "fchmod", "fchmodat", "fchown", "fchown32", "fchownat",
"fcntl", "fcntl64", "fdatasync", "fgetxattr", "flistxattr", "flock",
"fork", "fremovexattr", "fsetxattr", "fstat", "fstat64", "fstatat64",
"fstatfs", "fstatfs64", "fsync", "ftruncate", "ftruncate64", "futex",
"futimesat", "getcpu", "getcwd", "getdents", "getdents64", "getegid",
"getegid32", "geteuid", "geteuid32", "getgid", "getgid32", "getgroups",
"getgroups32", "getitimer", "getpeername", "getpgid", "getpgrp",
"getpid", "getppid", "getpriority", "getrandom", "getresgid",
"getresgid32", "getresuid", "getresuid32", "getrlimit", "get_robust_list",
"getrusage", "getsid", "getsockname", "getsockopt", "get_thread_area",
"gettid", "gettimeofday", "getuid", "getuid32", "getxattr", "inotify_add_watch",
"inotify_init", "inotify_init1", "inotify_rm_watch", "io_cancel", "ioctl",
"io_destroy", "io_getevents", "ioprio_get", "ioprio_set", "io_setup",
"io_submit", "ipc", "kill", "lchown", "lchown32", "lgetxattr", "link",
"linkat", "listen", "listxattr", "llistxattr", "lremovexattr", "lseek",
"lsetxattr", "lstat", "lstat64", "madvise", "memfd_create", "mincore",
"mkdir", "mkdirat", "mknod", "mknodat", "mlock", "mlock2", "mlockall",
"mmap", "mmap2", "mprotect", "mq_getsetattr", "mq_notify", "mq_open",
"mq_timedreceive", "mq_timedsend", "mq_unlink", "mremap", "msgctl",
"msgget", "msgrcv", "msgsnd", "msync", "munlock", "munlockall",
"munmap", "nanosleep", "newfstatat", "_newselect", "open", "openat",
"pause", "pipe", "pipe2", "poll", "ppoll", "prctl", "pread64",
"preadv", "preadv2", "prlimit64", "pselect6", "ptrace", "pwrite64",
"pwritev", "pwritev2", "read", "readahead", "readlink", "readlinkat",
"readv", "recv", "recvfrom", "recvmmsg", "recvmsg", "remap_file_pages",
"removexattr", "rename", "renameat", "renameat2", "restart_syscall",
"rmdir", "rt_sigaction", "rt_sigpending", "rt_sigprocmask", "rt_sigqueueinfo",
"rt_sigreturn", "rt_sigsuspend", "rt_sigtimedwait", "rt_tgsigqueueinfo",
"sched_getaffinity", "sched_getattr", "sched_getparam", "sched_get_priority_max",
"sched_get_priority_min", "sched_getscheduler", "sched_rr_get_interval",
"sched_setaffinity", "sched_setattr", "sched_setparam", "sched_setscheduler",
"sched_yield", "seccomp", "select", "semctl", "semget", "semop", "semtimedop",
"send", "sendfile", "sendfile64", "sendmmsg", "sendmsg", "sendto", "setfsgid",
"setfsgid32", "setfsuid", "setfsuid32", "setgid", "setgid32", "setgroups",
"setgroups32", "setitimer", "setpgid", "setpriority", "setregid", "setregid32",
"setresgid", "setresgid32", "setresuid", "setresuid32", "setreuid",
"setreuid32", "setrlimit", "set_robust_list", "setsid", "setsockopt",
"set_thread_area", "set_tid_address", "setuid", "setuid32", "setxattr",
"shmat", "shmctl", "shmdt", "shmget", "shutdown", "sigaltstack", "signalfd",
"signalfd4", "sigprocmask", "sigreturn", "socket", "socketcall", "socketpair",
"splice", "stat", "stat64", "statfs", "statfs64", "statx", "symlink",
"symlinkat", "sync", "sync_file_range", "syncfs", "sysinfo", "tee", "tgkill",
"time", "timer_create", "timer_delete", "timer_getoverrun", "timer_gettime",
"timer_settime", "timerfd_create", "timerfd_gettime", "timerfd_settime",
"times", "tkill", "truncate", "truncate64", "ugetrlimit", "umask", "uname",
"unlink", "unlinkat", "utime", "utimensat", "utimes", "vfork", "vmsplice",
"wait4", "waitid", "waitpid", "write", "writev"
};
for (String syscall : allowedSyscalls) {
policy.addSyscall(new SyscallRule(syscall, "ALLOW"));
}
policy.setDefaultAction("SCMP_ACT_ERRNO(EPERM)");
Advanced Java Container Security, Sandboxing & Trusted Runtime Environments
https://macronepal.com/blog/sandboxing-java-applications-implementing-landlock-lsm-for-enhanced-container-security/
Explains using Linux Landlock LSM to sandbox Java applications by restricting file system and resource access without root privileges, improving application-level isolation and reducing attack surface.
https://macronepal.com/blog/gvisor-sandbox-integration-in-java-complete-guide/
Explains integrating gVisor with Java to provide a user-space kernel sandbox that intercepts system calls and isolates applications from the host operating system for stronger security.
https://macronepal.com/blog/selinux-for-java-mandatory-access-control-for-jvm-applications/
Explains how SELinux enforces Mandatory Access Control (MAC) policies on Java applications, strictly limiting what files, processes, and network resources the JVM can access.
https://macronepal.com/java/a-comprehensive-guide-to-intel-sgx-sdk-integration-in-java/
Explains Intel SGX integration in Java, allowing sensitive code and data to run inside secure hardware enclaves that remain protected even if the OS is compromised.
https://macronepal.com/blog/building-a-microvm-runtime-with-aws-firecracker-in-java-a-comprehensive-guide/
Explains using AWS Firecracker microVMs with Java to run workloads in lightweight virtual machines that provide strong isolation with near-container performance efficiency.
https://macronepal.com/blog/enforcing-mandatory-access-control-implementing-apparmor-for-java-applications/
Explains AppArmor security profiles for Java applications, enforcing rules that restrict file access, execution rights, and system-level permissions.
https://macronepal.com/blog/rootless-containers-in-java-secure-container-operations-without-root/
Explains running Java applications in rootless containers using Linux user namespaces so containers operate securely without requiring root privileges.
https://macronepal.com/blog/unlocking-container-security-harnessing-user-namespaces-in-java/
Explains Linux user namespaces, which isolate user and group IDs inside containers to improve privilege separation and enhance container security for Java workloads.
https://macronepal.com/blog/secure-bootstrapping-in-java-comprehensive-trust-establishment-framework/
Explains secure bootstrapping in Java, focusing on how systems establish trust during startup using secure key management, identity verification, and trusted configuration loading.
https://macronepal.com/blog/securing-java-applications-with-chainguard-wolfi-a-comprehensive-guide-2/
Explains using Chainguard/Wolfi minimal container images to secure Java applications by reducing unnecessary packages, minimizing vulnerabilities, and providing a hardened runtime environment.