seccomp_init(3)

✨ seccomp_init ✨

okay bestie, welcome to the libseccomp manual, page seccomp_init(3) 💖 this one is literally the start of everything, so pay attention, it's giving origin story 👑

🌸 NAME 🌸

seccomp_init, seccomp_reset — Initialise the seccomp filter state 🧚

🎀 SYNOPSIS 🎀

#include <seccomp.h>

typedef void * scmp_filter_ctx;

scmp_filter_ctx seccomp_init(uint32_t def_action);
int seccomp_reset(scmp_filter_ctx ctx, uint32_t def_action);

Link with -lseccomp.

💅 DESCRIPTION 💅

so the way that seccomp_init() and seccomp_reset() work is they (re)initialise the internal seccomp filter state, get it all prepped and ready for use, and set the default action based on the def_action parameter. no cap.

seccomp_init() must be called before any other libseccomp functions — like, the rest of the library API will straight up fail if the filter context isn't initialised properly. it's the vibe check everybody else has to pass first 🙈

seccomp_reset() releases the existing filter context state before reinitialising it, and it can only be called after a call to seccomp_init() has succeeded. if you call seccomp_reset() with a NULL filter, it resets the library's global task state, including any notification file descriptors retrieved by seccomp_notify_fd(3). normally you don't need this, but it may be required to keep using the library after a fork() or clone() call, so the API level and user notification state get properly reset. iconic behaviour honestly.

when you're done configuring the seccomp filter and have loaded it into the kernel, you should call seccomp_release(3) to release all of the filter context state. clean up after yourself, bestie 🫶

valid def_action values are as follows:

• SCMP_ACT_KILL — the thread gets terminated by the kernel with SIGSYS when it calls a syscall that doesn't match any of the configured seccomp filter rules. and no, the thread can't catch the signal. it's over 💀
• SCMP_ACT_KILL_PROCESS — the entire process gets terminated by the kernel with SIGSYS when it calls a syscall that doesn't match any of the configured seccomp filter rules. whole squad gone.
• SCMP_ACT_TRAP — the thread gets sent a SIGSYS signal when it calls a syscall that doesn't match any of the configured seccomp filter rules. it may catch this and change its behaviour accordingly. when using SA_SIGINFO with sigaction(2), si_code will be set to SYS_SECCOMP, si_syscall will be set to the syscall that failed the rules, and si_arch will be set to the AUDIT_ARCH for the active ABI. so much intel, we love a signal with lore ✨
• SCMP_ACT_ERRNO(uint16_t errno) — the thread receives a return value of errno when it calls a syscall that doesn't match any of the configured seccomp filter rules.
• SCMP_ACT_TRACE(uint16_t msg_num) — if the thread is being traced and the tracing process specified the PTRACE_O_TRACESECCOMP option in the call to ptrace(2), the tracing process gets notified, via PTRACE_EVENT_SECCOMP, and the value provided in msg_num can be retrieved using the PTRACE_GETEVENTMSG option. spy era 👀
• SCMP_ACT_LOG — the seccomp filter will have no effect on the thread calling the syscall if it doesn't match any of the configured seccomp filter rules, but the syscall will be logged. it's just taking notes 📝
• SCMP_ACT_ALLOW — the seccomp filter will have no effect on the thread calling the syscall if it doesn't match any of the configured seccomp filter rules. the chill one. the "we move" option 🌈

⭐ RETURN VALUE ⭐

seccomp_init() returns a filter context on success, and NULL on failure. 😭

seccomp_reset() returns zero on success, or one of the following error codes on failure:

• -EINVAL — invalid input, either the context or action is invalid.
• -ENOMEM — the library was unable to allocate enough memory.

🦋 EXAMPLES 🦋

#include <seccomp.h>

int main(int argc, char *argv[])
{
     int rc = -1;
     scmp_filter_ctx ctx;

     ctx = seccomp_init(SCMP_ACT_KILL);
     if (ctx == NULL)
          goto out;

     /* ... */

     rc = seccomp_reset(ctx, SCMP_ACT_KILL);
     if (rc < 0)
          goto out;

     /* ... */

out:
     seccomp_release(ctx);
     return -rc;
}

💜 NOTES 💜

while the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter generated by libseccomp. so like, you can build it without the kernel's blessing but you can't actually run it without it. main character needs a stage 🎤

the libseccomp project site, with more information and the source code repository, can be found at https://github.com/seccomp/libseccomp. this tool, as well as the libseccomp library, is currently under development — please report any bugs at the project site or directly to the author. we're all works in progress fr fr 🫶

👑 AUTHOR 👑

Paul Moore <paul@paul-moore.com>

🔥 SEE ALSO 🔥

seccomp_release(3)

that's the page, bestie!! 💖 this one comes to you from the libseccomp Documentation, and it's dated 30 May 2020 — and the author's email <paul@paul-moore.com> is right there if you ever wanna say hi. go forth and initialise responsibly ✨🎀🦋