Admit an AI worker’s seccomp thread and ABI coverage

Ask which execution contexts the installation covers

A preprocessing service assigns one authorized ordinary note I-A to a trusted fixed native worker W-A. An operator reports “seccomp enabled.” That statement leaves important questions open: which threads received which policy, which syscall convention it recognizes, and what the installation actually returned.

The no-new-privileges worksheet concerns an exec transition; the descriptor worksheet concerns inherited resources. This guide adds a different admission record for filter F-A and exclusively owned thread group G-A. It neither launches a worker nor supplies filter bytecode.

Freeze one synchronized filter profile

The manual is Linux man-pages 6.19, dated 5 June 2026. Our profile requires independently supported kernel configuration, an already-unprivileged worker and its no_new_privs prerequisite. Do not acquire additional capability to make this plan work.

Select SECCOMP_SET_MODE_FILTER with SECCOMP_FILTER_FLAG_TSYNC only, and a supported pointer to the reviewed filter program. Exclude listener, tracing, user-notification, speculation-mitigation exceptions and alternate installation APIs. Actual kernel, userspace adapter and filter support are unknown here; intended flags do not prove them.

Before processing I-A, require exclusive ownership of G-A, a supported complete thread inventory and coordinated admission barrier. Every intended thread must remain within this profile. Require a reviewed initial filter-tree state and prohibit unreviewed policy changes, thread/process creation or exec transitions throughout this attempt. These are application prerequisites, not synchronization or lifecycle machinery supplied by this article.

Record success without misclassifying synchronization failure

The manual distinguishes TSYNC’s shared filter tree from separately installed identical filters. An unsynchronizable thread prevents the new attachment. Success is zero; synchronization failure can return a positive thread ID, while other errors return −1 with errno.

Consequently, a future adapter must classify the selected result exactly, rather than reuse a generic “not −1 means success” test. Our TSYNC-only selection excludes TSYNC_ESRCH. No raw result was collected or decoded here.

Propose record R-A linking G-A, W-A, complete initial tree revision, F-A, ABI policy, supported installation result and processing interval. Unknown association blocks the positive. On failure, withhold I-A and retain a setup-failure disposition. Do not infer that earlier controls disappeared, retry per-thread or substitute a separately repeated installation.

Give the operator an actionable hold category: unsupported setup, unresolved coverage, incompatible policy or independently denied input. Preserve the same job and policy references across review. A status dashboard must not collapse those categories into “protected” merely because the intended configuration looks correct. These are proposed reporting rules, not observations from a worker.

Bind syscall interpretation and the complete tree

The ABI discussion requires more than arch alone for x86-64/x32 discrimination, including syscall-number-bit handling, and warns about argument widths. Our worksheet selects reviewed native x86-64 handling and independently established Linux 5.4-or-newer applicability. Exclude x32, other conventions and older-kernel compatibility.

F-A needs an independently reviewed allowlist, width interpretation and nonzero-error denial policy outside its supported domain. This worksheet supplies no numeric syscall table, instruction sequence, compiler or complete policy proof. A familiar function name cannot substitute for the actual reviewed binary/runtime paths.

Filters combine by action precedence; ALLOW is not an override, and ERRNO prevents the syscall. Select only these direct outcomes. Require complete effective-tree review before making compatibility claims.

Keep F-A’s allowed-operation set distinct from the authorized-work description. The former belongs to the reviewed implementation contract; the latter explains why this note may be processed now. Neither an operator’s approval of the job nor a model’s explanation can fill a missing filter review. An implementation revision invalidates R-A’s old association until independently reconciled.

Keep the useful positive smaller than object authorization

The unversioned kernel explanation says filters observe syscall metadata and arguments but cannot dereference pointers. It explicitly distinguishes syscall filtering from a sandbox.

For I-A, the ordinary positive needs separately supported input ownership, bounded content admission, minimized OS authority and complete allowed-resource inventory. A filter allowing a read operation does not identify the application object behind an already held resource. Nor can a rule inspect arbitrary pointed-to pathname text as though it were a trusted object-access service.

Only after all prerequisites and R-A match could the application admit this narrow filter plan for the authorized note. Actual filter construction, group coordination, installation adapter and resource ownership remain unimplemented or unknown here, so no real worker qualifies. Later output stays quarantined until ordinary completeness, content and current-rights gates pass.

Walk eight inert coverage cards

All cards are PROPOSED_UNRUN. Symbolic records are not observed threads, syscall arguments or kernel outcomes.

No candidate syscall, filter, thread, descriptor, kernel state, host configuration or runtime was inspected or exercised. No model or API experiment occurred. Documentation and editorial work are the only evidence here. Boundary remains prelaunch with planned request-path checks, not a shipped seccomp manager; its mock policy evidence establishes different behavior.