Scalability of progressive Seccomp filter development

Determine whether the progressive, iterative method of building Seccomp filters—incrementally adding a few rules at a time, running the application, and refining the filter—remains effective and practical for larger, more complex Linux applications.

Background

During the paper, developers commonly adopted a progressive workflow: they added a small number of Seccomp rules, ran the program, observed failures, and refined the filter iteratively. This approach helped them cope with uncertainty and expected mistakes in the filter design.

The authors explicitly note uncertainty about whether this progressive approach scales to larger programs, highlighting a gap in knowledge regarding its effectiveness and practicality beyond small, simple applications.