PR_GET_SECCOMP(2)

💅 PR_GET_SECCOMP — get the secure computing mode

okay bestie, welcome to PR_GET_SECCOMP(2) — that's section 2 of the manual, we love a system call moment ✨ this is the vibe-check-your-own-sandbox situation and honestly? it's giving iconic but also slightly terrifying, you'll see why 🫶

🌈 LIBRARY

Standard C library (libc, -lc) — the classic, no cap.

✨ SYNOPSIS

#include <linux/prctl.h>  /* Definition of PR_* constants */
#include <sys/prctl.h>

int prctl(PR_GET_SECCOMP);

🎀 DESCRIPTION

So basically it returns the secure computing mode of the calling thread. The one doing the asking. Just that thread. 🧚

Here's where it gets spicy, so lock in 🔥:

• if the caller is not in secure computing mode, this operation returns 0 — chill, normal, slay
• if the caller is in strict secure computing mode, then the prctl() call will cause a SIGKILL signal to be sent to the process. like. it just kills you for asking 😭 that's not a typo, that's the documented behaviour
• if the caller is in filter mode, and this system call is allowed by the seccomp filters, it returns 2; otherwise, the process is killed with a SIGKILL signal. so, y'know, it depends on the filter's mood 💀

⚠️ this operation is available only if the kernel is configured with CONFIG_SECCOMP enabled. no config, no vibes.

👑 RETURN VALUE

On success, this call returns the nonnegative value described above (0 or 2, iykyk). On error, -1 is returned, and errno is set to indicate the error; or the process is killed. yeah. "or the process is killed." they really just said that casually and moved on. main character energy but make it fatal 💅

🚨 ERRORS

• EINVAL — the kernel was not configured with CONFIG_SECCOMP. rude, honestly.
• SIGKILL — the caller is in strict secure computing mode. bye bestie 🪦
• SIGKILL — the caller is in filter mode, and this system call is not allowed by the seccomp filters. bye bestie, part two 🪦🪦

🗂️ FILES

• /proc/pid/status — since Linux 3.8, the Seccomp field of this file provides a method of obtaining the same information, without the risk that the process is killed; see proc_pid_status(5). ok so this is the safe route and honestly the one you should be taking most of the time, no cap 🌸

📜 STANDARDS

Linux. that's the whole standard. periodt.

🕰️ HISTORY

Linux 2.6.23 — old money, but make it kernel 💜

🦋 SEE ALSO

prctl(2), PR_SET_SECCOMP(2const), seccomp(2)

---

and that's the whole page, bestie!! 💖 this gem is from Linux man-pages 6.20, dated 2026-02-08, page PR_GET_SECCOMP(2) — go forth, check your seccomp mode, and maybe use /proc/pid/status so you don't get SIGKILLed mid-sentence 🎀⭐