seccomp_merge(3)

💖 seccomp_merge(3) — the libseccomp glow-up 💖

okay bestie, welcome to the libseccomp Documentation corner of the group chat. today's main character is seccomp_merge, and no cap, it's lowkey one of the most satisfying little functions in the whole library. you got two filters, you want one filter? say less. 🫶

✨ NAME ✨

seccomp_merge — merge two seccomp filters together, slay

🌸 SYNOPSIS 🌸

#include <seccomp.h>

typedef void * scmp_filter_ctx;

int seccomp_merge(scmp_filter_ctx dst, scmp_filter_ctx src);

Link with -lseccomp.

🦋 DESCRIPTION 🦋

so seccomp_merge() takes the seccomp filter living in src, smooshes it into the filter living in dst, and stores the result in dst. that's it, that's the whole vibe. ✨

and the glow-up? if it works, the src seccomp filter gets released and literally all the internal memory attached to it gets freed. so do not call seccomp_release(3) on src afterwards — that's already handled, bestie. also pls discard any references you were still holding to that filter, because it's gone gone. 💀

now for the fine print, because there's always fine print: to merge two seccomp filters, both filters must have the same attribute values and no overlapping architectures. that's the compatibility check. no overlap, same attrs, or it's not happening. 🙈

💅 RETURN VALUE 💅

returns zero on success, or one of these error codes when it's not giving:

• -EDOM — couldn't merge because of architecture issues, like byte endian mismatches. the vibes were off. 😭
• -EEXIST — that architecture already exists in the filter. it's already in the group chat, bestie.
• -EINVAL — one of the filters is invalid. 🚩
• -ENOMEM — the library could not allocate enough memory. ran out of room, tragic.

🌈 EXAMPLES 🌈

here's the whole thing in action, copy it, love it, run it:

#include <seccomp.h>

int main(int argc, char *argv[])
{
     int rc = -1;
     scmp_filter_ctx ctx_32, ctx_64;

     ctx_32 = seccomp_init(SCMP_ACT_KILL);
     if (ctx_32 == NULL)
          goto out_all;
     ctx_64 = seccomp_init(SCMP_ACT_KILL);
     if (ctx_64 == NULL)
          goto out_all;

     if (seccomp_arch_exist(ctx_32, SCMP_ARCH_X86) == -EEXIST) {
          rc = seccomp_arch_add(ctx_32, SCMP_ARCH_X86);
          if (rc != 0)
               goto out_all;
          rc = seccomp_arch_remove(ctx_32, SCMP_ARCH_NATIVE);
          if (rc != 0)
               goto out_all;
     }
     if (seccomp_arch_exist(ctx_64, SCMP_ARCH_X86_64) == -EEXIST) {
          rc = seccomp_arch_add(ctx_64, SCMP_ARCH_X86_64);
          if (rc != 0)
               goto out_all;
          rc = seccomp_arch_remove(ctx_64, SCMP_ARCH_NATIVE);
          if (rc != 0)
               goto out_all;
     }

     /* ... */

     rc = seccomp_merge(ctx_64, ctx_32);
     if (rc != 0)
          goto out_all;

     /* NOTE: the 'ctx_32' filter is no longer valid at this point */

     /* ... */

out:
     seccomp_release(ctx_64);
     return -rc;
out_all:
     seccomp_release(ctx_32);
     goto out;
}

see that NOTE comment? read it again. once seccomp_merge succeeds, ctx_32 is no longer valid. not "kinda stale", not "use with caution" — invalid. 🫠

🎀 NOTES 🎀

ngl this part matters: while the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter that libseccomp generates. so the filter existing ≠ the filter being enforced. iykyk. 👑

the libseccomp project site — with more info and the source code repository — lives at https://github.com/seccomp/libseccomp. this tool, as well as the libseccomp library, is currently under development, so pls report any bugs at the project site or directly to the author. be a good citizen about it. 🫶

👑 AUTHOR 👑

Paul Moore <paul@paul-moore.com> — the icon, the legend, the main character energy behind all of this.

🔥 SEE ALSO 🔥

seccomp_init(3), seccomp_reset(3), seccomp_arch_add(3), seccomp_arch_remove(3), seccomp_attr_get(3), seccomp_attr_set(3)

and that's a wrap on the libseccomp Documentation, bestie ✨ this page is from 30 May 2020, brought to you by paul@paul-moore.com — go merge something responsibly, and remember: release dst, forget src. periodt. 💅🌸