diff --git a/libc/tools/genseccomp.py b/libc/tools/genseccomp.py
index a8e551e..79968ae 100755
--- a/libc/tools/genseccomp.py
+++ b/libc/tools/genseccomp.py
@@ -27,11 +27,22 @@
 
 
 def get_names(syscall_files, architecture):
-  syscalls = []
+  syscall_lists = []
   for syscall_file in syscall_files:
     parser = SysCallsTxtParser()
     parser.parse_open_file(syscall_file)
-    syscalls += parser.syscalls
+    syscall_lists.append(parser.syscalls)
+
+  bionic, whitelist, blacklist = syscall_lists[0], syscall_lists[1], syscall_lists[2]
+  for x in blacklist:
+    if not x in bionic:
+      raise RuntimeError("Blacklist item not in bionic - aborting " + str(x))
+
+    if x in whitelist:
+      raise RuntimeError("Blacklist item in whitelist - aborting " + str(x))
+
+  bionic_minus_blacklist = [x for x in bionic if x not in blacklist]
+  syscalls = bionic_minus_blacklist + whitelist
 
   # Select only elements matching required architecture
   syscalls = [x for x in syscalls if architecture in x and x[architecture]]
@@ -47,8 +58,7 @@
     dups.remove("socketcall")
 
   if len(dups) > 0:
-    print "Duplicate entries found - aborting ", dups
-    exit(-1)
+    raise RuntimeError("Duplicate entries found - aborting " + str(dups))
 
   # Remove remaining duplicates
   return list(set(names))
@@ -188,7 +198,9 @@
   return convert_bpf_to_output(bpf, architecture)
 
 
-ANDROID_SYSCALL_FILES = ["SYSCALLS.TXT", "SECCOMP_WHITELIST.TXT"]
+ANDROID_SYSCALL_FILES = ["SYSCALLS.TXT",
+                         "SECCOMP_WHITELIST.TXT",
+                         "SECCOMP_BLACKLIST.TXT"]
 
 
 POLICY_CONFIGS = [("arm", "kernel/uapi/asm-arm", []),
diff --git a/libc/tools/test_genseccomp.py b/libc/tools/test_genseccomp.py
index 73f768d..71a78d1 100755
--- a/libc/tools/test_genseccomp.py
+++ b/libc/tools/test_genseccomp.py
@@ -24,7 +24,7 @@
     return self.get_config(arch)[2]
 
   def test_get_names(self):
-    syscalls = cStringIO.StringIO(textwrap.dedent("""\
+    bionic = cStringIO.StringIO(textwrap.dedent("""\
 int __llseek:_llseek(int, unsigned long, unsigned long, off64_t*, int) arm,mips,x86
 int         fchown:fchown(int, uid_t, gid_t)    arm64,mips,mips64,x86_64
     """))
@@ -33,11 +33,17 @@
 ssize_t     read(int, void*, size_t)        all
     """))
 
-    syscall_files = [syscalls, whitelist]
-    names = genseccomp.get_names(syscall_files, "arm")
-    for f in syscall_files:
-      f.seek(0)
-    names64 = genseccomp.get_names(syscall_files, "arm64")
+    empty = cStringIO.StringIO(textwrap.dedent("""\
+    """))
+
+    names = genseccomp.get_names([bionic, whitelist, empty], "arm")
+    bionic.seek(0)
+    whitelist.seek(0)
+    empty.seek(0)
+    names64 = genseccomp.get_names([bionic, whitelist, empty], "arm64")
+    bionic.seek(0)
+    whitelist.seek(0)
+    empty.seek(0)
 
     self.assertIn("fchown", names64)
     self.assertNotIn("fchown", names)
@@ -46,6 +52,47 @@
     self.assertIn("read", names)
     self.assertIn("read", names64)
 
+    # Blacklist item must be in bionic
+    blacklist = cStringIO.StringIO(textwrap.dedent("""\
+int         fchown2:fchown2(int, uid_t, gid_t)    arm64,mips,mips64,x86_64
+    """))
+    with self.assertRaises(RuntimeError):
+      genseccomp.get_names([bionic, whitelist, blacklist], "arm")
+    bionic.seek(0)
+    whitelist.seek(0)
+    blacklist.seek(0)
+
+    # Test blacklist item is removed
+    blacklist = cStringIO.StringIO(textwrap.dedent("""\
+int         fchown:fchown(int, uid_t, gid_t)    arm64,mips,mips64,x86_64
+    """))
+    names = genseccomp.get_names([bionic, whitelist, blacklist], "arm64")
+    bionic.seek(0)
+    whitelist.seek(0)
+    blacklist.seek(0)
+    self.assertIn("read", names)
+    self.assertNotIn("fchown", names)
+
+    # Blacklist item must not be in whitelist
+    whitelist = cStringIO.StringIO(textwrap.dedent("""\
+int         fchown:fchown(int, uid_t, gid_t)    arm64,mips,mips64,x86_64
+    """))
+    with self.assertRaises(RuntimeError):
+      genseccomp.get_names([empty, whitelist, blacklist], "arm")
+    empty.seek(0)
+    whitelist.seek(0)
+    blacklist.seek(0)
+
+    # No dups in bionic and whitelist
+    whitelist = cStringIO.StringIO(textwrap.dedent("""\
+int __llseek:_llseek(int, unsigned long, unsigned long, off64_t*, int) arm,mips,x86
+    """))
+    with self.assertRaises(RuntimeError):
+      genseccomp.get_names([bionic, whitelist, empty], "arm")
+    bionic.seek(0)
+    whitelist.seek(0)
+    empty.seek(0)
+
   def test_convert_names_to_NRs(self):
     self.assertEquals(genseccomp.convert_names_to_NRs(["open"],
                                                       self.get_headers("arm"),
@@ -153,7 +200,10 @@
     ssize_t     read(int, void*, size_t)        all
     """))
 
-    syscall_files = [syscalls, whitelist]
+    blacklist = cStringIO.StringIO(textwrap.dedent("""\
+    """))
+
+    syscall_files = [syscalls, whitelist, blacklist]
     output = genseccomp.construct_bpf(syscall_files, "arm", self.get_headers("arm"),
                                       self.get_switches("arm"))