diff --git a/third_party/seccomp/seccomp.bzl b/third_party/seccomp/seccomp.bzl
new file mode 100644
index 0000000..782c762
--- /dev/null
+++ b/third_party/seccomp/seccomp.bzl
@@ -0,0 +1,82 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@rules_cc//cc:defs.bzl", "cc_library")
+load("@dev_source_monogon//build/utils:template_file.bzl", "template_file")
+
+genrule(
+    name = "config-h",
+    outs = ["configure.h"],
+    cmd = "echo \"#define HAVE_LINUX_SECCOMP_H 1\" > \"$@\"",
+    visibility = ["//visibility:public"],
+)
+
+genrule(
+    name = "syscalls-tables",
+    srcs = [
+        "src/syscalls.perf.template",
+        "src/syscalls.csv",
+    ],
+    outs = ["syscalls.perf.c"],
+    cmd = """
+    # From src/arch-gperf-generate, modified to not write over source files
+    grep -v '^#' $(location src/syscalls.csv) | nl -ba -s, -v0 | \
+        sed -e 's/^[[:space:]]\\+\\([0-9]\\+\\),\\([^,]\\+\\),\\(.*\\)/\\2,\\1,\\3/' \
+            -e ':repeat; {s|\\([^,]\\+\\)\\(.*\\)[^_]PNR|\\1\\2,__PNR_\\1|g;}; t repeat' \
+             > "$(@D)/syscalls_tmp.csv"
+
+    # create the gperf file
+    sed -e "/@@SYSCALLS_TABLE@@/r $(@D)/syscalls_tmp.csv" \
+        -e '/@@SYSCALLS_TABLE@@/d' \
+        $(location src/syscalls.perf.template) > "$(@D)/syscalls.perf"
+    ./$(location @gperf//:gperf) -m 100 --null-strings --pic -tCEG -T -S1 --output-file="$(location syscalls.perf.c)" "$(@D)/syscalls.perf"
+    """,
+    tools = [
+        "@gperf//:gperf",
+    ],
+)
+
+template_file(
+    name = "seccomp.h",
+    src = "include/seccomp.h.in",
+    substitutions = {
+        # Irrelevant for Bazel. Just look at WORKSPACE.
+        # Make it obviously invalid so nobody is mislead.
+        "@VERSION_MAJOR@": "0",
+        "@VERSION_MINOR@": "0",
+        "@VERSION_MICRO@": "0",
+    },
+    visibility = ["//visibility:public"],
+)
+
+cc_library(
+    name = "seccomp",
+    srcs = glob(
+        [
+            "src/*.c",
+            "src/*.h",
+        ],
+        exclude = [
+            "src/arch-syscall-check.c",
+            "src/arch-syscall-dump.c",
+        ],
+    ) + ["//:configure.h", ":syscalls.perf.c"],
+    hdrs = [
+        ":seccomp.h",
+        "include/seccomp-syscalls.h",
+    ],
+    visibility = ["//visibility:public"],
+)