PR_SET_SECCOMP(2const)

💖 PR_SET_SECCOMP — the <linux/prctl.h> / <sys/prctl.h> girly pop 💖

okay so bestie, this is the PR_SET_SECCOMP page from section 2const of the Linux manuals, and it's giving "prctl operation that locks your thread down into secure computing mode" ✨ lowkey iconic, highkey deprecated for the new stuff. Let's get into it 🫶

---

🌸 NAME 🌸

PR_SET_SECCOMP — set the secure computing mode 💅

---

📚 LIBRARY 📚

Standard C library (libc, -lc) 🎀

---

✨ SYNOPSIS ✨

#include <linux/prctl.h>  /* Definition of PR_* constants */
#include <sys/prctl.h>

[[deprecated]]
int prctl(PR_SET_SECCOMP, long mode, ...);

[[deprecated]]
int prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT);
[[deprecated]]
int prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER,
          struct sock_fprog *filter);

not the double [[deprecated]] jumpscare 😭 yeah, this whole operation is marked deprecated. the compiler is gonna side-eye you and honestly? it's right.

---

🦋 DESCRIPTION 🦋

Set the secure computing (seccomp) mode for the calling thread, to limit the available system calls. no cap, that's the whole vibe: your thread gets a smaller menu of syscalls and that's it.

the more recent seccomp(2) system call provides a superset of the functionality of PR_SET_SECCOMP, and is the preferred interface for new applications 👑 so like. use that one. this one is the OG that walked so seccomp(2) could run.

The seccomp mode is selected via mode. The seccomp constants are defined in <linux/seccomp.h>. The following values can be specified:

• SECCOMP_MODE_STRICT (since Linux 2.6.23) — see the description of SECCOMP_SET_MODE_STRICT in seccomp(2). 🧚

This operation is available only if the kernel is configured with CONFIG_SECCOMP enabled.

• SECCOMP_MODE_FILTER (since Linux 3.5) — the allowed system calls are defined by a pointer to a Berkeley Packet Filter passed in filter. It can be designed to filter arbitrary system calls and system call arguments. See the description of SECCOMP_SET_MODE_FILTER in seccomp(2). 🔥

This operation is available only if the kernel is configured with CONFIG_SECCOMP_FILTER enabled.

fr fr: both modes have a kernel-config prerequisite. if your kernel wasn't built with the matching CONFIG_*, you're getting an EINVAL and a reality check 💀

---

🎀 RETURN VALUE 🎀

On success, 0 is returned. 🫶

On error, -1 is returned, and errno is set to indicate the error.

---

💅 ERRORS 💅

• EACCES — mode is SECCOMP_MODE_FILTER, but the process does not have the CAP_SYS_ADMIN capability or has not set the no_new_privs attribute (see PR_SET_NO_NEW_PRIVS(2const)).
• EFAULT — mode is SECCOMP_MODE_FILTER, and filter is an invalid address.
• EINVAL — mode is not a valid value.
• EINVAL — the kernel was not configured with CONFIG_SECCOMP.
• EINVAL — mode is SECCOMP_MODE_FILTER, and the kernel was not configured with CONFIG_SECCOMP_FILTER.

literally three separate reasons to get EINVAL on this page. read the whole list before you start debugging, bestie 😭

---

🌈 STANDARDS 🌈

Linux. 🐧 that's it, that's the standard.

---

⭐ HISTORY ⭐

Linux 2.6.23. (yes, ancient. she's a millennial. respect your elders 💜)

---

👑 SEE ALSO 👑

• prctl(2)
• PR_GET_SECCOMP(2const)
• seccomp(2)

---

and that's the page, babes 💖 go read seccomp(2) if you're starting something new, and remember: this one's deprecated, so don't build your whole personality on it. mwah 🫶

this cutie was served to you by Linux man-pages 6.20, dated 2026-02-08. stay safe, set your filters, and slay 💅✨