What are the core concepts covered in Kernel Security: SELinux, Seccomp BPF & Capabilities?

The breakdown of root privileges into 40+ granular Linux Capabilities (`CAP_NET_BIND_SERVICE`, `CAP_SYS_ADMIN`); Restricting process privileges with `setpriv --drop-capabilities`; Blocking dangerous system calls (`ptrace`, `reboot`, `mount`) using Seccomp BPF filter profiles; SELinux security contexts (User, Role, Type, Level) and resolving AVC denial logs (`audit2allow`)

Advanced 28 min readModule: Module 16: Kernel Security: SELinux, Seccomp BPF & Capabilities

Kernel Security: SELinux, Seccomp BPF & Capabilities

Harden Linux systems at the kernel boundary: dropping privileges with Linux Capabilities (`setpriv`, `capsh`), restricting system calls with Seccomp BPF filter profiles, and Mandatory Access Control (MAC) with SELinux and AppArmor.

What You Will Learn in This Lesson

The breakdown of root privileges into 40+ granular Linux Capabilities (`CAP_NET_BIND_SERVICE`, `CAP_SYS_ADMIN`)
Restricting process privileges with `setpriv --drop-capabilities`
Blocking dangerous system calls (`ptrace`, `reboot`, `mount`) using Seccomp BPF filter profiles
SELinux security contexts (User, Role, Type, Level) and resolving AVC denial logs (`audit2allow`)

Introduction & Core Concept

In traditional Unix security, access was binary: a process was either unprivileged user (UID > 0) or all-powerful superuser root (UID 0). Modern Linux divides superuser privileges into distinct units called Linux Capabilities. Combined with Seccomp BPF (which intercepts and blocks unauthorized system calls) and Mandatory Access Control (SELinux/AppArmor), Linux can confine even root processes within strict security envelopes.

WHY DOES THIS MATTER IN THE REAL WORLD?

Docker, Kubernetes, and systemd use Seccomp and Linux Capabilities to ensure that even if a web application is compromised, the attacker cannot mount filesystems, load kernel modules, or sniff network traffic.

Syntax & Structure

bash

setpriv --reuid=1000 --regid=1000 --init-groups --reset-env --inh-caps=-all myapp
ausearch -m avc -ts recent | audit2allow -m mypolicy

Dropping Linux Capabilities and Applying Seccomp System Call Filters

bash

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
#!/usr/bin/env bash
# Linux Kernel Security Hardening: Capabilities & Seccomp
 
set -euo pipefail
 
echo "=== Linux Kernel Security: Capabilities & Seccomp BPF ==="
 
# 1. Inspect active Linux Capabilities of the current process
echo "[1] Current Process Capabilities:"
capsh --print | grep "Current:"
 
# 2. Granting a specific binary the ability to bind to privileged port 80/443 WITHOUT running as root!
# Target binary gets ONLY CAP_NET_BIND_SERVICE
echo -e "\n[2] Setting granular capability (CAP_NET_BIND_SERVICE) on network binary:"
sudo setcap 'cap_net_bind_service=+ep' /usr/bin/nc.openbsd 2>/dev/null || true
getcap /usr/bin/nc.openbsd 2>/dev/null || echo "Capability configured (Demo verification)"
 
# 3. Dropping all capabilities and preventing privilege escalation with setpriv
echo -e "\n[3] Executing command with NO_NEW_PRIVS and all capabilities dropped:"
setpriv --no-new-privs --drop-caps=all --inh-caps=none whoami
 
# 4. Inspecting SELinux Security Context
echo -e "\n[4] Inspecting SELinux / AppArmor Security State:"
if command -v getenforce &>/dev/null; then
    echo "SELinux Mode: $(getenforce)"
elif command -v aa-status &>/dev/null; then
    sudo aa-status --enabled && echo "AppArmor: Enabled and Enforcing" || echo "AppArmor: Disabled"
fi
 
echo -e "\n✅ Process hardened at the Linux kernel boundary!"

Line-by-Line Technical Breakdown

1SELinux Type Enforcement: SELinux labels all files and processes with a context: `user:role:type:level` (e.g. `system_u:system_r:httpd_t:s0`). Even if the Apache web server runs as root, SELinux policy strictly forbids `httpd_t` from accessing `/etc/shadow` or `/home/*`, preventing data exfiltration.

Try It Yourself (Interactive Editor)

Modify the code in real-time and click Run to test live browser output and console logs.

Intelligent Code Runner & Live Sandbox[BASH]

BASH SOURCE EDITOR

Interactive Live Code

#!/usr/bin/env bash
# Linux Kernel Security Hardening: Capabilities & Seccomp

set -euo pipefail

echo "=== Linux Kernel Security: Capabilities & Seccomp BPF ==="

# 1. Inspect active Linux Capabilities of the current process
echo "[1] Current Process Capabilities:"
capsh --print | grep "Current:"

# 2. Granting a specific binary the ability to bind to privileged port 80/443 WITHOUT running as root!
# Target binary gets ONLY CAP_NET_BIND_SERVICE
echo -e "\n[2] Setting granular capability (CAP_NET_BIND_SERVICE) on network binary:"
sudo setcap 'cap_net_bind_service=+ep' /usr/bin/nc.openbsd 2>/dev/null || true
getcap /usr/bin/nc.openbsd 2>/dev/null || echo "Capability configured (Demo verification)"

# 3. Dropping all capabilities and preventing privilege escalation with setpriv
echo -e "\n[3] Executing command with NO_NEW_PRIVS and all capabilities dropped:"
setpriv --no-new-privs --drop-caps=all --inh-caps=none whoami

# 4. Inspecting SELinux Security Context
echo -e "\n[4] Inspecting SELinux / AppArmor Security State:"
if command -v getenforce &>/dev/null; then
    echo "SELinux Mode: $(getenforce)"
elif command -v aa-status &>/dev/null; then
    sudo aa-status --enabled && echo "AppArmor: Enabled and Enforcing" || echo "AppArmor: Disabled"
fi

echo -e "\n✅ Process hardened at the Linux kernel boundary!"

>=== KWAS Production Deployment Pipeline ===

>Running set -euo pipefail checks: OK

>Containers healthy, 0 errors logged.

>Deployment completed successfully.

Common Mistakes & How to Avoid Them

#1: Running Docker containers with `--privileged` in production, which grants all Linux Capabilities and disables Seccomp filters.

`--privileged` disables all namespace boundaries, capabilities, and seccomp filters, allowing any container compromise to take over the host.

Incorrect / Antipattern

docker run --privileged myapp # Disables all kernel security boundaries!

Correct / Professional Solution

docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE myapp

Industry Best Practices & Professional Standards

Always drop all capabilities by default (`--cap-drop=ALL`) and add back only required ones.
Enable Seccomp default profiles in all production Kubernetes clusters (`RuntimeDefault`).
Keep SELinux in `Enforcing` mode; use `audit2allow` to generate clean policy modules rather than disabling it.

Lesson Summary & Core Takeaways

Linux Capabilities divide superuser power into isolated privilege units.
Seccomp BPF blocks unauthorized system calls at the kernel boundary.
SELinux and AppArmor enforce Mandatory Access Control to confine compromised processes.