Re: [PATCH RESEND 0/2] seccomp: Allow using `SECCOMP_MODE_STRICT` with `SECCOMP_MODE_FILTER`

[Kees Cook <kees@kernel.org>]

On Mon, Jun 15, 2026 at 03:38:35PM -0700, Kees Cook wrote:
> On Mon, Jun 15, 2026 at 05:23:53PM +0100, Jamie Hill-Daniel wrote:
> > On Sat, Jun 13, 2026 at 5:14 AM Kees Cook <kees@kernel.org> wrote:
> > > On Tue, May 26, 2026 at 04:32:14PM +0100, Jamie Hill-Daniel wrote:
> > > > Link: https://github.com/moby/moby/issues/42082
> > >
> > > This doesn't show any particular application, just a demo program.
> > >
> > > I'd *really* prefer to only add complexity to seccomp if it is
> > > absolutely needed.
> > 
> > When I filed the original issue it was attempting a minimised
> > reproduction; I was trying to run some legacy binary in a container
> > that I unfortunately don't have the context for any more.
> > I've submitted another series that should hopefully address some of
> > the concerns raised here, including complexity.
> 
> Right, I think I'd prefer the legacy binary be adjusted instead. And not
> adding complexity to seccomp given the issue isn't actually a problem
> any more. :)

And here's a wrapper, if there's no source for the binary:
https://github.com/kees/kernel-tools/blob/trunk/seccomp/strict_launcher.c

(This could probably be improved...)

-Kees

-- 
Kees Cook