seccomp_load(3)

💖 seccomp_load(3) — libseccomp Documentation 💖

okay bestie, sit down, hydrate, because we're about to talk about seccomp_load from the libseccomp docs. this is the glow-up moment where your filter stops being a vibe and starts being real. ✨

---

🌸 NAME 🌸

seccomp_load — load the current seccomp filter into the kernel

like. that's it. that's the whole job. take the filter and yeet it into the kernel. 👑

---

🎀 SYNOPSIS 🎀

#include <seccomp.h>

typedef void * scmp_filter_ctx;

int seccomp_load(scmp_filter_ctx ctx);

Link with -lseccomp.

---

🦋 DESCRIPTION 🦋

So here's the tea, bestie. seccomp_load() takes the seccomp filter that ctx is holding and loads it into the kernel. if the function succeeds, that new seccomp filter is active the moment the function returns — no waiting, no "let me think about it", it's live. periodt. 💅

and listen: if seccomp_precompute(3) was called before you tried to load the filter, and nobody has touched the filter since, then seccomp_load() can be considered to be async-signal-safe. that's the good stuff. no cap.

now, the important part 👇 it is possible to have multiple stacked seccomp filters for a given task (and "task" here means either a process or a thread, okay?). so remember: every single filter loaded for that task gets executed when a syscall is made, and the "strictest" rule is the one that actually gets applied.

and in seccomp-land, "strictest" is defined as the action with the lowest value. for example, SCMP_ACT_KILL is "stricter" than SCMP_ACT_ALLOW. it's giving very much "the most dramatic rule wins". 😭

---

✨ RETURN VALUE ✨

Returns zero on success, or one of these error codes on failure:

• -ECANCELED — there was a system failure beyond the control of the library. not us, not you, just the universe being messy. 🙈
• -EFAULT — internal libseccomp failure. oop.
• -EINVAL — invalid input; either the context or the architecture token is invalid. check your args bestie.
• -ENOMEM — the library could not allocate enough memory. it's broke, not bougie. 💀
• -ESRCH — unable to load the filter due to thread issues.

and if the SCMP_FLTATR_API_SYSRAWRC filter attribute is non-zero, then additional error codes may be returned to the caller. those extra codes are the negative errno values returned by the system. unfortunately, libseccomp can make no guarantees about these return values. so like… good luck, but also we warned you. 🫶

---

🌈 EXAMPLES 🌈

#include <seccomp.h>

int main(int argc, char *argv[])
{
     int rc = -1;
     scmp_filter_ctx ctx;

     ctx = seccomp_init(SCMP_ACT_KILL);
     if (ctx == NULL)
          goto out;

     /* ... */

     rc = seccomp_load(ctx);
     if (rc < 0)
          goto out;

     /* ... */

out:
     seccomp_release(ctx);
     return -rc;
}

look at that goto out doing its little cleanup dance. iconic. 🕺

---

💜 NOTES 💜

so the seccomp filter can absolutely be generated independently of the kernel — that part's fine, that part slays — but kernel support is required to load and enforce the seccomp filter that libseccomp generates. you can bake the cake without an oven, you just can't, y'know, cook it. 🍓

the libseccomp project site, with more info and the source code repository, lives at https://github.com/seccomp/libseccomp. this tool, as well as the libseccomp library, is currently under development — so please report any bugs at the project site or directly to the author. we're all just girls supporting girls out here. 💅

---

👑 AUTHOR 👑

Paul Moore <paul@paul-moore.com>

---

🔥 SEE ALSO 🔥

seccomp_init(3), seccomp_reset(3), seccomp_release(3), seccomp_rule_add(3), seccomp_rule_add_exact(3) seccomp_precompute(3), signal-safety(7)

---

and that's the whole page, bestie! this was seccomp_load(3) from the libseccomp Documentation, dated 30 May 2020, brought to you by paul@paul-moore.com. now go forth and load your filters. mwah. 💖🎀🦋✨