# Install libseccomp with Homebrew

Interface to the Linux Kernel's syscall filtering mechanism. Version 2.6.1 via Homebrew; verified from local package data.

## Install

```sh
sudo av install brew:libseccomp
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install libseccomp
```

  Evidence: provider-native install command

## Package facts

- **Package key:** brew:libseccomp
- **Package manager:** Homebrew
- **Version:** 2.6.1
- **Source summary:** Interface to the Linux Kernel's syscall filtering mechanism
- **Homepage:** <https://github.com/seccomp/libseccomp>
- **Repository:** <https://github.com/seccomp/libseccomp>
- **Generated:** 2026-08-03T00:40:33+00:00

## Executables

- scmp_sys_resolver (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 2.6.1
## Project history and usage

libseccomp is the userspace helper library for Linux seccomp syscall filtering. It gives applications and container runtimes a portable API for generating BPF-based syscall filters instead of hand-writing architecture-specific filter programs.

### Project history

The Linux kernel documentation frames seccomp filtering as a way for a process to reduce exposed kernel syscall surface by installing a BPF program over syscall metadata. The libseccomp README describes the library as an easy-to-use, platform-independent interface to that filtering mechanism, abstracting the BPF language behind a conventional function-call API.

The libseccomp tag history shows v0.1.0 and v1.0.0 tags in January 2013, followed by a long 2.x series. The README also documents architecture support, manpage-based documentation, regression tests, release signing, and Go bindings in the separate libseccomp-golang repository.

### Adoption history

libseccomp became important because seccomp-BPF moved from a kernel primitive into ordinary application sandboxing and container security workflows. Its supported-architecture list and release process reflect use by distributions and runtimes that need consistent syscall-filter generation across Linux ABIs.

### How it is used

Applications initialize a filter context, add syscall rules, load the resulting filter into the kernel, and optionally use tools such as scmp_sys_resolver while developing policies. The library docs emphasize tests that can run even on systems without seccomp-BPF, plus live tests for systems with kernel support.

### Why package nerds care

libseccomp is one of those packages whose installed files look small but whose consequences are large: container profiles, browser sandboxes, service hardening, and low-level Linux security tooling all prefer a stable API over handwritten BPF filters.

### Timeline

- 2013: v0.1.0 and v1.0.0 tags were made in January.
- 2015: v2.2.x releases expanded the 2.x line.
- 2019: v2.4.0 was published in March.
- 2020: v2.5.0 was published in July.
- 2025: v2.6.0 was published in January.

### Related projects

- Related projects include the Linux kernel seccomp-BPF interface, libseccomp-golang, container runtimes, browser sandboxes, and Linux service-hardening tools.

### Sources

- <https://api.github.com/repos/seccomp/libseccomp/releases?per_page=100>
- <https://github.com/seccomp/libseccomp>
- <https://github.com/seccomp/libseccomp/tree/main/doc>
- <https://www.kernel.org/doc/html/latest/userspace-api/seccomp_filter.html>


## Security Notes

library-like package without higher-risk signals.

- **Geiger risk:** green / low
- library-like package without higher-risk signals


## Combined YAML source

View the package source record on GitHub. [combined/libseccomp.yml](https://github.com/automic-vault/db/blob/main/combined/libseccomp.yml)


## Sources

- Nucleus package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation