�������ǂނɂ́A�R�����g�̗��p�K���ɓ��ӂ��u�A�C�e�B���f�B�AID�v�����сuITmedia �r�W�l�X�I�����C���ʐM�v�̓o�^���K�v�ł�
Seccomp-BPF as a filterSeccomp-BPF lets you attach a Berkeley Packet Filter program that decides which syscalls a process is allowed to make. You can deny dangerous syscalls like process tracing, filesystem manipulation, kernel extension loading, and performance monitoring.
，这一点在safew官方下载中也有详细论述
割接运维：安全切换与持续运营支持
elementary OS 8.1.1 is available as a pay-what-you-can purchase at elementary.io today. Localized direct downloads and a torrent magnet link are provided.
第三十九条 有下列行为之一的，处十日以上十五日以下拘留；情节较轻的，处五日以下拘留：