Provided by: libseccomp-dev_2.3.3-3ubuntu2_amd64 bug


       seccomp_attr_set, seccomp_attr_get - Manage the seccomp filter attributes


       #include <seccomp.h>

       typedef void * scmp_filter_ctx;
       enum scmp_filter_attr;

       int seccomp_attr_set(scmp_filter_ctx ctx,
                            enum scmp_filter_attr attr, uint32_t value);
       int seccomp_attr_get(scmp_filter_ctx ctx,
                            enum scmp_filter_attr attr, uint32_t *value);

       Link with -lseccomp.


       The  seccomp_attr_set()  function  sets  the different seccomp filter attributes while the
       seccomp_attr_get() function fetches the filter attributes.  The seccomp filter  attributes
       are  tunable  values  that  affect how the library behaves when generating and loading the
       seccomp filter into the kernel.  The attributes are reset to their default values whenever
       the filter is initialized or reset via seccomp_filter_init(3) or seccomp_filter_reset(3).

       The filter context ctx is the value returned by the call to seccomp_init(3).

       Valid attr values are as follows:

              The  default  filter  action  as specified in the call to seccomp_filter_init(3) or
              seccomp_filter_reset(3).  This attribute is read-only.

              The filter action taken when the loaded filter does not match the  architecture  of
              the executing application.  Defaults to the SCMP_ACT_KILL action.

              A  flag  to  specify  if  the  NO_NEW_PRIVS  functionality should be enabled before
              loading the seccomp filter into the kernel.  If set to  off  (  value  ==  0)  then
              loading  the  seccomp filter into the kernel will fail if CAP_SYS_ADMIN is not set.
              Defaults to on ( value == 1).

              A flag to specify if the kernel should attempt to synchronize  the  filters  across
              all  threads on seccomp_load(3).  If the kernel is unable to synchronize all of the
              thread then the load operation will fail.  This flag is  only  available  on  Linux
              Kernel  3.17  or  greater;  attempting  to enable this flag on earlier kernels will
              result in an error being returned.  Defaults to off ( value == 0).

              A flag to specify if libseccomp should allow filter rules to be created for the  -1
              syscall.   The  -1  syscall  value  can be used by tracer programs to skip specific
              syscall invocations, see seccomp(2) for more information.  Defaults to off (  value
              == 0).


       Returns zero on success, negative errno values on failure.


       #include <seccomp.h>

       int main(int argc, char *argv[])
            int rc = -1;
            scmp_filter_ctx ctx;

            ctx = seccomp_init(SCMP_ACT_ALLOW);
            if (ctx == NULL)
                 goto out;

            /* ... */

            rc = seccomp_attr_set(ctx, SCMP_FLTATR_ACT_BADARCH, SCMP_ACT_TRAP);
            if (rc < 0)
                 goto out;

            /* ... */

            return -rc;


       While  the  seccomp  filter  can be generated independent of the kernel, kernel support is
       required to load and enforce the seccomp filter generated by libseccomp.

       The libseccomp project site, with more information and the source code repository, can  be
       found  at   This  tool,  as well as the libseccomp
       library, is currently under development, please report any bugs at  the  project  site  or
       directly to the author.


       Paul Moore <>


       seccomp_init(3), seccomp_reset(3), seccomp_load(3), seccomp(2)