seccomp_arch_add(3)

✨ seccomp_arch_add(3) — libseccomp Documentation ✨

okay bestie, buckle up 💖 this is the libseccomp manual page for managing seccomp filter architectures, and honestly? it's giving "small API, big power". let's get into it 🦋

---

🌸 NAME 🌸

seccomp_arch_add, seccomp_arch_remove, seccomp_arch_exist, seccomp_arch_native — the girls that Manage seccomp filter architectures 💅

---

🎀 SYNOPSIS 🎀

#include <seccomp.h>

typedef void * scmp_filter_ctx;

#define SCMP_ARCH_NATIVE
#define SCMP_ARCH_X86
#define SCMP_ARCH_X86_64
#define SCMP_ARCH_X32
#define SCMP_ARCH_ARM
#define SCMP_ARCH_AARCH64
#define SCMP_ARCH_LOONGARCH64
#define SCMP_ARCH_M68K
#define SCMP_ARCH_MIPS
#define SCMP_ARCH_MIPS64
#define SCMP_ARCH_MIPS64N32
#define SCMP_ARCH_MIPSEL
#define SCMP_ARCH_MIPSEL64
#define SCMP_ARCH_MIPSEL64N32
#define SCMP_ARCH_PPC
#define SCMP_ARCH_PPC64
#define SCMP_ARCH_PPC64LE
#define SCMP_ARCH_S390
#define SCMP_ARCH_S390X
#define SCMP_ARCH_SH
#define SCMP_ARCH_SHEB
#define SCMP_ARCH_PARISC
#define SCMP_ARCH_PARISC64
#define SCMP_ARCH_RISCV64

uint32_t seccomp_arch_resolve_name(const char *arch_name);
uint32_t seccomp_arch_native();
int seccomp_arch_exist(const scmp_filter_ctx ctx, uint32_t arch_token);
int seccomp_arch_add(scmp_filter_ctx ctx, uint32_t arch_token);
int seccomp_arch_remove(scmp_filter_ctx ctx, uint32_t arch_token);

and like, obviously you gotta link with -lseccomp 🫶

---

💖 DESCRIPTION 💖

so, seccomp_arch_exist() is the vibe-checker — it peeks at whether a given architecture has already been added to the seccomp filter in ctx. meanwhile seccomp_arch_add() and seccomp_arch_remove() do exactly what their names say: add and remove architectures from that seccomp filter, respectively. ✨

in all three of those functions, the architecture values you pass as arch_token should be the SCMP_ARCH_* defined constants, and SCMP_ARCH_NATIVE always refers to the native compiled architecture, no cap 🧚

seccomp_arch_native() hands you back the system's architecture, in a form that'll match one of the SCMP_ARCH_* constants. and seccomp_arch_resolve_name() also returns a SCMP_ARCH_* constant — the difference is that the token it returns matches the name of the architecture you passed in as an argument. iykyk 💅

when a seccomp filter gets initialized via seccomp_init(3), the native architecture is automatically added to the filter. it's just there. main character energy, it was always invited 💖

and yes, technically you can remove all the architectures from a filter — but lowkey, most of the libseccomp APIs will fail if the filter doesn't contain at least one architecture. so like... don't 🙈

here's the important one, fr fr: when you add a new architecture to an existing filter, the existing rules will not be added to the new architecture. nope. they stay where they are. however, any rules you add after adding the new architecture will be added to all of the architectures in the filter. the way that rules added later just show up everywhere?? iconic ⭐

---

🔥 RETURN VALUE 🔥

seccomp_arch_add(), seccomp_arch_remove(), and seccomp_arch_exist() return zero on success, or one of these error codes on failure:

• -EDOM — architecture-specific failure. it's giving "this arch said no" 💀
• -EEXIST — in the case of seccomp_arch_add() the architecture already exists, and in the case of seccomp_arch_remove() the architecture does not exist. yes it's the same errno for both, the duality of woman 💅
• -EINVAL — invalid input, meaning either the context or the architecture token is invalid.
• -ENOMEM — the library was unable to allocate enough memory. bestie is broke (in RAM) 😭

---

🌈 EXAMPLES 🌈

#include <seccomp.h>

int main(int argc, char *argv[])
{
     int rc = -1;
     scmp_filter_ctx ctx;

     ctx = seccomp_init(SCMP_ACT_KILL);
     if (ctx == NULL)
          goto out;

     if (seccomp_arch_exist(ctx, SCMP_ARCH_X86) == -EEXIST) {
          rc = seccomp_arch_add(ctx, SCMP_ARCH_X86);
          if (rc != 0)
               goto out_all;
          rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
          if (rc != 0)
               goto out_all;
     }

     /* ... */

out:
     seccomp_release(ctx);
     return -rc;
}

---

🦋 NOTES 🦋

okay so, the seccomp filter itself can be generated independent of the kernel — but 👀 kernel support is required to load and enforce the seccomp filter that libseccomp generated. so like, you still need the kernel on your side, bestie 🤝

the libseccomp project site, which has more information and the source code repository, lives at https://github.com/seccomp/libseccomp. this tool, as well as the libseccomp library, is currently under development, so please report any bugs at the project site or directly to the author 🐛✨

---

👑 AUTHOR 👑

Paul Moore <paul@paul-moore.com>

---

💜 SEE ALSO 💜

seccomp_init(3), seccomp_reset(3), seccomp_merge(3)

---

and that's the whole page bestie!! 🫶 this one was brought to you by Paul Moore (<paul@paul-moore.com>), dated 15 June 2020, from the libseccomp Documentation set. go forth and manage your architectures, you absolute icon 💅💖✨