@@ -118,6 +118,13 @@ var defaultSeccompProfile = &configs.Seccomp{

 			Args:   []*configs.Arg{},

 		},

 		{

+			// Restrict process inspection capabilities

+			// Already blocked by dropping CAP_PTRACE

+			Name:   "kcmp",

+			Action: configs.Errno,

+			Args:   []*configs.Arg{},

+		},

+		{

 			// Sister syscall of kexec_load that does the same thing,

 			// slightly different arguments

 			Name:   "kexec_file_load",

@@ -216,6 +223,20 @@ var defaultSeccompProfile = &configs.Seccomp{

 			Args:   []*configs.Arg{},

 		},

 		{

+			// Restrict process inspection capabilities

+			// Already blocked by dropping CAP_PTRACE

+			Name:   "process_vm_readv",

+			Action: configs.Errno,

+			Args:   []*configs.Arg{},

+		},

+		{

+			// Restrict process modification capabilities

+			// Already blocked by dropping CAP_PTRACE

+			Name:   "process_vm_writev",

+			Action: configs.Errno,

+			Args:   []*configs.Arg{},

+		},

+		{

 			// Already blocked by dropping CAP_PTRACE

 			Name:   "ptrace",

 			Action: configs.Errno,