seccomp vs bcc for syscall interception

Question

how can I use seccomp and prctl syscall vs bcc to interception syscalls? Is there another way to achieve this goal with bcc ??

I know that it is possible with pure ebpf code in C but it is too difficult to understand and use and I want to use bcc for it.

Answer 1

BCC is about observability (mostly), it will help you trace and inspect the system calls but won't allow you to block them like seccomp does. If this is what you're after, eBPF can do that on recent kernels, but you want to search for the eBPF-based LSM (see kernel's documentation on the topic).

A few additional pointers:

• Kernel's doc for seccomp.
• https://ebpf.io/ to better understand what eBPF is and does.