NAME

       seccomp_api_get, seccomp_api_set - Manage the libseccomp API level

SYNOPSIS

       #include <seccomp.h>

       const unsigned int seccomp_api_get(void);
       int seccomp_api_set(unsigned int level);

       Link with -lseccomp.

DESCRIPTION

       The  seccomp_api_get()  function returns an integer representing the functionality ("API level") provided
       by the current running kernel.  It is important to  note  that  while  seccomp_api_get()  can  be  called
       multiple  times,  the  kernel  is  only probed the first time to see what functionality is supported, all
       following calls to seccomp_api_get() return a cached value.

       The seccomp_api_set() function allows callers to force the API level to the provided value; however, this
       is almost always a bad idea and use of this function is strongly discouraged.

       The different API level values are described below:

       0      Reserved value, not currently used.

       1      Base level support.

       2      The SCMP_FLTATR_CTL_TSYNC filter attribute is supported and libseccomp uses the seccomp(2) syscall
              to load the seccomp filter into the kernel.

       3      The SCMP_FLTATR_CTL_LOG filter attribute and the SCMP_ACT_LOG action are supported.

       4      The SCMP_FLTATR_CTL_SSB filter attribute is supported.

       5      The SCMP_ACT_NOTIFY action and the notify APIs are supported.

       6      The simultaneous use of SCMP_FLTATR_CTL_TSYNC and the notify APIs are supported.

RETURN VALUE

       The  seccomp_api_get()  function  returns  an  integer  representing  the  supported  API   level.    The
       seccomp_api_set() function returns zero on success, negative values on failure.

EXAMPLES

       #include <seccomp.h>

       int main(int argc, char *argv[])
       {
            unsigned int api;

            api = seccomp_api_get();
            switch (api) {
            case 2:
                 /* ... */
            default:
                 /* ... */
            }

            return 0;

       err:
            return 1;
       }

NOTES

       While  the  seccomp filter can be generated independent of the kernel, kernel support is required to load
       and enforce the seccomp filter generated by libseccomp.

       The libseccomp project site, with more information and the  source  code  repository,  can  be  found  at
       https://github.com/seccomp/libseccomp.   This tool, as well as the libseccomp library, is currently under
       development, please report any bugs at the project site or directly to the author.

AUTHOR

       Paul Moore <paul@paul-moore.com>