seccomp
also: Secure Computing Mode, seccomp-bpf, seccomp filter
Secure Computing Mode (seccomp) is a Linux kernel feature that restricts the system calls a process can make, limiting its capabilities to only what it needs.
seccomp allows you to sandbox processes by filtering system calls at the kernel level. A process running under seccomp can only execute an approved whitelist of system calls; any attempt to use a blocked call results in the process being terminated or receiving a signal.
There are two modes: strict mode (seccomp) only allows read(), write(), exit(), and sigreturn() calls; filter mode (seccomp-bpf) uses Berkeley Packet Filter rules to define custom policies for which calls are permitted.
Example: Docker containers use seccomp profiles to prevent processes from calling dangerous system calls like reboot() or mount(). A web server could be confined to only the system calls it legitimately needs, reducing the damage from a successful exploit.