AFAIK one can filter on the syscall's arguments. https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/samples/seccomp/bpf-fancy.c https://git.k

AFAIK one can filter on the syscall's arguments. https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/samples/seccomp/bpf-fancy.c https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.... I think it's quite readable and one could modify it easily to whitelist open on "/dev/null".