PR_GET_SECCOMP(2)

💖 PR_GET_SECCOMP — get the secure computing mode 💖

okay bestie, gather round, because this is a prctl(2) operation from the System Calls Manual and it's lowkey one of the most dramatic little calls in the whole kernel. it's called PR_GET_SECCOMP, and yes, it does exactly what it says on the tin. 🎀

---

✨ NAME ✨

PR_GET_SECCOMP — get the secure computing mode

---

📚 LIBRARY 📚

Standard C library (libc, -lc)

---

🦋 SYNOPSIS 🦋

#include <linux/prctl.h>  /* Definition of PR_* constants */
#include <sys/prctl.h>

int prctl(PR_GET_SECCOMP);

---

🌸 DESCRIPTION 🌸

so the whole vibe here is: this returns the secure computing mode of the calling thread. that's it. that's the job. 🫶

here's the tea on what you actually get back, and it's giving choose-your-own-adventure:

• if the caller is not in secure computing mode, this operation returns 0.
• if the caller is in strict secure computing mode, then the prctl() call will cause a SIGKILL signal to be sent to the process. 💀 yes, fr fr. you don't get an answer, you get deleted.
• if the caller is in filter mode, and this system call is allowed by the seccomp filters, it returns 2. otherwise? the process is killed with a SIGKILL signal. 😭

ngl this is the "asking a question might unalive you" system call and i need you to respect it.

also, plot twist: this operation is available only if the kernel is configured with CONFIG_SECCOMP enabled. no config, no service. 🧚

---

⭐ RETURN VALUE ⭐

on success, this call returns the nonnegative value described above (you know, the 0 or the 2). 👑

on error, -1 is returned, and errno is set to indicate the error; or the process is killed. yeah. "or". that's the whole sentence. periodt. 💅

---

💀 ERRORS 💀

• EINVAL — the kernel was not configured with CONFIG_SECCOMP. rude, honestly.
• SIGKILL — the caller is in strict secure computing mode.
• SIGKILL — the caller is in filter mode, and this system call is not allowed by the seccomp filters.

two separate SIGKILL entries, bestie. not a typo. two different ways to get got. 🙈

---

🍓 FILES 🍓

• /proc/pid/status — since Linux 3.8, the Seccomp field of this file provides a method of obtaining the same information, without the risk that the process is killed; see proc_pid_status(5).

THIS is the move. same info, zero chance of dying. main character energy fr. 🌈

---

👑 STANDARDS 👑

Linux.

---

🕰️ HISTORY 🕰️

Linux 2.6.23.

---

🔥 SEE ALSO 🔥

prctl(2), PR_SET_SECCOMP(2const), seccomp(2)

---

okay that's the whole page, no cap, every single detail intact. this was written up in Linux man-pages 6.19, dated 2026-02-08, and honestly? iconic of them. go check your Seccomp field instead of gambling with your life, i'm literally begging. 💜✨🦋