RELIABLE SYSTEM CALL INTERCEPTION

Summary from the TLDR InfoSec newsletter

Traditionally, ptrace is used for system call monitoring, modifying, and faking but this mechanism suffers from being very slow as it requires two traps for each system call. The author presents an alternative mechanism that uses seccomp user notify and BPF filters to replace this functionality. The author notes that this technique suffers from time-of-check to time-of-use attacks and should not be used for security-critical decisions.