Defense-in-Depth and Linux Capabilities: A Study on Seccomp Filters
This study examines defense-in-depth through Linux capabilities and seccomp filters, illustrating how security layers can effectively integrate.
Defense-in-depth emphasizes the layered nature of security controls. However, the assumption that these controls stack like Lego bricks is flawed. This analysis explores how Linux capabilities and seccomp filters can effectively work together. It uses the example of the CAP_AUDIT_WRITE capability and demonstrates how a process can restrict its privileges and system call access using seccomp.