安全与凭据
45 syscalls
add_key(2)
arch_prctl(2)
capget(2)
capset(2)
getegid(2)
getegid32(2)
geteuid(2)
geteuid32(2)
getgid(2)
getgid32(2)
getgroups(2)
getgroups32(2)
getresgid(2)
getresgid32(2)
getresuid(2)
getresuid32(2)
getuid(2)
getuid32(2)
keyctl(2)
landlock_add_rule(2)
landlock_create_ruleset(2)
landlock_restrict_self(2)
prctl(2)
Process-control multiplexer: configure a hundred per-process knobs — name, capabilities, no-new-privs, seccomp install, dumpable, and more.
request_key(2)
seccomp(2)
Install a BPF-based syscall filter for the calling thread — the backbone of container sandboxing on Linux.
setdomainname(2)
setfsgid(2)
setfsgid32(2)
setfsuid(2)
setfsuid32(2)
setgid(2)
setgid32(2)
setgroups(2)
setgroups32(2)
sethostname(2)
setregid(2)
setregid32(2)
setresgid(2)
setresgid32(2)
setresuid(2)
setresuid32(2)
setreuid(2)
setreuid32(2)
setuid(2)
Set the calling process's user ID — the canonical privilege-dropping primitive.
setuid32(2)