seccomp_attach_filter(9)

📦 version 7.3.1, in nixpkgs unstable

💅 seccomp_attach_filter(9)

okay bestie, welcome to the Kernel API Manual, section 9 — this is the seccomp_attach_filter(9) page and it's short but it's got ✨lore✨ so let's get into it 🎀

🌸 NAME 🌸

seccomp_attach_filter — validate and attach filter. that's it. that's the whole vibe check: it checks the filter, then it attaches the filter 🫶

✨ SYNOPSIS ✨

long seccomp_attach_filter (unsigned int flags , struct seccomp_filter
*filter );

like literally that's the whole signature, no cap 💅

🦋 ARGUMENTS 🦋

  • flags — flags to change filter behavior. the little knobs that switch up how the filter acts 🎛️
  • filter — seccomp filter to add to the current process. this is the actual filter being yeeted into your current process 🫡

👑 DESCRIPTION 👑

bestie read this part carefully because it's giving prerequisites 😭

Caller must be holding current->sighand->siglock lock. — not optional, not a suggestion, you literally have to be holding it before you call this. no lock, no service 🚫

so what does it give back? returns 0 on success, -ve on error, or… 👀

  • in TSYNC mode: the pid of a thread which was either not in the correct seccomp mode or did not have an ancestral seccomp filter 🔥
  • in NEW_LISTENER mode: the fd of the new listener 🌟

so yeah, "success" isn't always just 0 — sometimes it hands you a pid or an fd and you gotta know which mode you're in. iykyk 🤫

🌈 SEE ALSO 🌈

Kernel file ./kernel/seccomp.c and the whole friend group 🫶

and that's the page!! mwah 💋 this one came from the ./kernel source tree, dated October 2026 — go read the other seccomp_* pages too, they all ate 🔥🍓💜

📦 where this page comes from