Reduce kernel attack surface with stricter system call filter #36

New Issue

ophestra · 2026-03-31T19:36:46+09:00

ophestra commented

2026-03-31 19:36:46 +09:00

The current system call filter is kept compatible with Flatpak, with sections made configurable. This is a block list, which is considered fundamentally less secure than an allow list. Additionally, it opens up a great amount of attack surface and fails to block many obviously dubious kernel APIs that are generally never used by desktop applications. This is remedied by various project-specific extensions to the filter, made configurable at runtime.

Current plans are to introduce additional filter sections as need for them arise, and transition to an allow list in the long term, with a configuration option to fall back to Flatpak-compatible filter sections. This ticket aims to keep track of progress regarding allowed system calls, and the compatibility test suite.

The current system call filter is kept compatible with Flatpak, with sections made configurable. This is a block list, which is considered fundamentally less secure than an allow list. Additionally, it opens up a great amount of attack surface and fails to block many obviously dubious kernel APIs that are generally never used by desktop applications. This is remedied by various project-specific extensions to the filter, made configurable at runtime. Current plans are to introduce additional filter sections as need for them arise, and transition to an allow list in the long term, with a configuration option to fall back to Flatpak-compatible filter sections. This ticket aims to keep track of progress regarding allowed system calls, and the compatibility test suite.

👍 1 ❤️ 1

ophestra added the

labels 2026-03-31 19:36:47 +09:00

ophestra added a new dependency 2026-03-31 19:52:49 +09:00

#37 Block family `NETLINK_KOBJECT_UEVENT` of `AF_NETLINK` socket

ophestra added the