The libseccomp library provides an easy to use interface to the Linux Kernel's
syscall filtering mechanism, seccomp. The libseccomp API allows an application
to specify which syscalls, and optionally which syscall arguments, the
application is allowed to execute, all of which are enforced by the Linux
scmp_sys_resolver This command resolves both system call names and numbers with respect to the given architecture supplied in the optional ARCH argument. If the architecture is... seccomp_arch_add The seccomp_arch_exist() function tests to see if a given architecture has been added to the seccomp filter in ctx , where the seccomp_arch_add() and... seccomp_attr_set The seccomp_attr_set() function sets the different seccomp filter attributes while the seccomp_attr_get() function fetches the filter attributes. The seccomp... seccomp_export_bpf The seccomp_export_bpf() and seccomp_export_pfc() functions generate and output the current seccomp filter in either BPF (Berkley Packet Filter) or PFC (Pseudo... seccomp_init The seccomp_init() and seccomp_reset() functions (re)initialize the internal seccomp filter state, prepares it for use, and sets the default action based on the... seccomp_load Loads the seccomp filter provided by ctx into the kernel; if the function succeeds the new seccomp filter will be active when the function returns. seccomp_merge The seccomp_merge() function merges the seccomp filter in src with the filter in dst and stores the resulting in the dst filter. If successfull, the src seccomp... seccomp_release Releases the seccomp filter in ctx which was first initialized by seccomp_init(3) or seccomp_reset(3) and frees any memory associated with the given seccomp... seccomp_rule_add The seccomp_rule_add(), seccomp_rule_add_array(), seccomp_rule_add_exact(), and seccomp_rule_add_exact_array() functions all add a new filter rule to the... seccomp_syscall_priority The seccomp_syscall_priority() function provides a priority hint to the seccomp filter generator in libseccomp such that higher priority syscalls are placed... seccomp_syscall_resolve_name The seccomp_syscall_resolve_name(), seccomp_syscall_resolve_name_arch(), and seccomp_syscall_resolve_name_rewrite() functions resolve the commonly used syscall... seccomp_version The seccomp_version() and seccomp_reset() functions return a pointer to a scmp_version struct which contains the version information of the currently loaded...