STRUCT SECCOMP_DATA(9)

✨ struct seccomp_data(9) ✨

okay so this is a page from the Kernel API Manual, and honestly? it's a little baddie. it's the struct that describes the format your BPF program executes over when seccomp is out here doing its thing. let's get into it 💅

---

🌸 NAME 🌸

struct seccomp_data — the format the BPF program executes over. that's it, that's the whole vibe. ✨

---

🦋 SYNOPSIS 🦋

struct seccomp_data {
    int nr;
    __u32 arch;
    __u64 instruction_pointer;
    __u64 args[6];
 };

like, look at her. so clean. so structured. main character energy fr fr 💖

---

🎀 Members 🎀

time to meet the cast, bestie. every field gets its moment 👑

• nr — the system call number. iconic, essential, the whole reason we're here 🫶
• arch — indicates the system call convention as an AUDIT_ARCH_* value, as defined in <linux/audit.h>. yes bestie you literally need that header, no cap.
• instruction_pointer — at the time of the system call. that's when. that's the moment. timestamped by the kernel herself 😭
• args — up to 6 system call arguments, always stored as 64-bit values regardless of the architecture. the way she doesn't care what arch you're on and keeps everything 64-bit anyway?? consistent queen. always 64-bit. periodt. 💅

ngl the "always stored as 64-bit values regardless of the architecture" part is the detail people forget, so like... don't forget it 🙈

---

👑 SEE ALSO 👑

• Kernel file ./tools/include/uapi/linux/seccomp.h struct
• seccomp_notif_addfd(9)

go read those too, iykyk. tag yourself, i'm the struct in the tools include directory 🌈

---

and that's the page, bestie!! source is ./tools/include/uapi/linux, dated October 2026 — so like, future girlboss energy ⭐ love that for us. mwah, go write some slay BPF filters 💖🧚‍♀️🔥