Playing with prctl and seccomp

I have been playing with low-level Linux security features, such as prctl no new privs and seccomp . These tools allow you to reduce the harm a process can do to your system. They're typically deployed as part of systemd, although the default settings in many distros are yet to be ideal . This is partly because it's hard to confirm what a service actually needs, and partly because many services…