seccomp A Turing complete eBPF program watches your program Who watches the watcher? seccomp program is stored elsewhere Easy to get desyncronized either program is updated eBPF watcher has no real idea what the program under observation is doing...