SECCOMP_SYSCALL_PRIORITY(3)

💅 seccomp_syscall_priority — a libseccomp(3) moment

okay bestie so this page is from the libseccomp Documentation and it's called seccomp_syscall_priority(3), and honestly? it's giving "make your syscalls line up in the right order." let's get into it 🎀

✨ NAME ✨

seccomp_syscall_priority — Prioritize syscalls in the seccomp filter

🌸 SYNOPSIS 🌸

#include <seccomp.h>

typedef void * scmp_filter_ctx;

int SCMP_SYS(syscall_name);

int seccomp_syscall_priority(scmp_filter_ctx ctx,
                             int syscall, uint8_t priority);

Link with -lseccomp.

💖 DESCRIPTION 💖

so the seccomp_syscall_priority() function hands a lil priority hint to the seccomp filter generator inside libseccomp. the way it works is: higher priority syscalls get placed earlier in the seccomp filter code, so they incur less overhead — and the price of that is that lower priority syscalls get pushed back. tradeoff, bestie, it's always a tradeoff 💀

and here's the cute part: you can set a syscall's priority regardless of whether any rules currently exist for that syscall. the library literally just remembers the priority, and it'll be assigned to that syscall if and when a rule for that syscall gets created. main character foresight, honestly ✨

now, you could specify the syscall value directly using the standard __NR_syscall values, but for proper operation across multiple architectures it is highly recommended to use the SCMP_SYS() macro instead. no cap. check the EXAMPLES section below 👇

the priority parameter takes an 8-bit value ranging from 0 - 255; a higher value = a higher priority. that's it, that's the range 🫶

and the filter context ctx? that's the value returned by the call to seccomp_init().

🔥 RETURN VALUE 🔥

the SCMP_SYS() macro returns a value suitable for use as the syscall value in seccomp_syscall_priority().

the seccomp_syscall_priority() function returns zero on success or one of the following error codes on failure:

• -EDOM — Architecture specific failure.
• -EFAULT — Internal libseccomp failure.
• -EINVAL — Invalid input, either the context or architecture token is invalid.
• -ENOMEM — The library was unable to allocate enough memory.

🌈 EXAMPLES 🌈

#include <seccomp.h>

int main(int argc, char *argv[])
{
     int rc = -1;
     scmp_filter_ctx ctx;

     ctx = seccomp_init(SCMP_ACT_KILL);
     if (ctx == NULL)
          goto out;

     /* ... */

     rc = seccomp_syscall_priority(ctx, SCMP_SYS(read), 200);
     if (rc < 0)
          goto out;

     /* ... */

out:
     seccomp_release(ctx);
     return -rc;
}

🦋 NOTES 🦋

okay so even though the seccomp filter can be generated independently of the kernel, kernel support is required to load and enforce the seccomp filter that libseccomp generates. like, the filter exists, sure, but it needs the kernel to actually do anything. vibe check: passed conditionally 💅

the libseccomp project site, with more information and the source code repository, can be found at https://github.com/seccomp/libseccomp. this tool, as well as the libseccomp library, is currently under development, so please report any bugs at the project site or directly to the author. be a good citizen bestie 🙈

👑 AUTHOR 👑

Paul Moore <paul@paul-moore.com>

⭐ SEE ALSO ⭐

• seccomp_rule_add(3)
• seccomp_rule_add_exact(3)

and that's the whole page, periodt. this lil doc was written by paul@paul-moore.com, dated 30 May 2020, and it lives under seccomp_syscall_priority(3) in the libseccomp docs. go forth and prioritize your syscalls, you absolute icon 🎀💜