seccomp_check_filter(9)

📦 version 7.3.1, in nixpkgs unstable

💅 seccomp_check_filter(9) — from the Kernel API Manual, section 9, bestie 🎀

Okay so picture this: you're deep in the kernel, section 9 of the manual, and the function on the menu today is seccomp_check_filter. She's a little vibe-checker for seccomp filter code and honestly? She ate. ✨

🌸 NAME 🌸

seccomp_check_filter — the girl who verifies your seccomp filter code. no cap, that's literally her whole job 🫶

🦋 SYNOPSIS 🦋

int seccomp_check_filter (struct sock_filter *filter , unsigned int flen );

✨ ARGUMENTS ✨

  • filter — the filter to verify. yes bestie, this is the one getting the vibe check 💅
  • flen — the length of that filter. gotta know how much filter we're filtering, y'know? 📏

💖 DESCRIPTION 💖

So here's the tea, and it is strong 🍓: seccomp_check_filter takes a filter that has already been checked — by bpf_check_classic, thank you very much — and then does her lil redirect magic. All the filter code that loads struct sk_buff data and related data gets redirected through seccomp_bpf_load. iconic behaviour, truly 👑

And she's not just out here redirecting for fun (well, a little for fun) — she also enforces length and alignment checking of those loads. meticulous. main character energy. the way she cares about alignment is honestly so real 😭

What does she give back? Simple:

  • Returns 0 if the rule set is legal 🎉 slay, valid, we love to see it
  • Returns -EINVAL if not 💀 sorry babe, that rule set is not it
fr fr, -EINVAL is the "nope, illegal rule set, try again" of this whole situation. don't take it personally 🙈

🌈 SEE ALSO 🌈

The kernel file ./kernel/seccomp.c is where the whole friend group lives — go say hi to:

like… the whole squad is in there. iykyk 💜

and that's the page, bestie! 🧚 This cutie lives in ./kernel and the version on the shelf is dated October 2026 — so when you're flipping through and see that date, that's me waving at you from the future. mwah 💋🌸

📦 where this page comes from