Skip to content
seccomp-ruby

Native CRuby bindings for libseccomp

Give your
process
boundaries.

Decide which system calls your Ruby process can make. Write the policy in Ruby. Let the Linux kernel enforce it.

Get started Read the docs

Linux only. Ruby-friendly by design.

policy.rb Define & inspect 
require "libseccomp"

filter = Seccomp.filter(default: :kill_process) do
  no_new_privs true
  allow :read, :write
  allow :exit, :exit_group, :rt_sigreturn
  deny :ptrace, errno: Errno::EPERM
end

puts filter.to_pfc
filter.close
System callPolicy decision
read, writeallow ptraceEPERM unlisted callskill process
Illustrative policy, not a complete Ruby allowlist. This example only inspects the filter; it does not load it.
Platform
Linux
Runtime
CRuby 3.1+
Native library
libseccomp 2.5+
License
MIT

Small rules.
Precise control.

Start with a readable filter DSL. Match individual arguments, inspect the generated policy, or work directly with the libseccomp API.

Go beyond the syscall name.

Compare file descriptors, flags, and other arguments. This rule returns EBADF when a process tries to close standard error.

filter.deny(
  :close,
  filter.arg(0).eq(2),
  errno: Errno::EBADF
)
Explore argument filtering

Inspect before you load

Export human-readable pseudo filter code or BPF. Review the policy before applying it to a process.

Supervise from Ruby

Receive syscall notifications with Ruby IO waiting and timeouts. Respond through the user-notification API.

Reach the native API

Use Seccomp::LowLevel for direct bindings. RBS signatures describe the public API; feature checks expose optional library support.

Your first policy
starts here.

Use a Linux environment with CRuby, libseccomp development headers, and a C compiler.

Browse runnable examples

  1. 1 Install system dependencies

    On Debian or Ubuntu:

    sudo apt-get install libseccomp-dev build-essential

  2. 2 Add to your Gemfile

    gem "seccomp-ruby"

  3. 3 Install the gem

    bundle install