NAME

       seccomp_attr_set, seccomp_attr_get - Manage the seccomp filter attributes

SYNOPSIS

       #include <seccomp.h>

       typedef void * scmp_filter_ctx;
       enum scmp_filter_attr;

       int seccomp_attr_set(scmp_filter_ctx ctx,
                            enum scmp_filter_attr attr, uint32_t value);
       int seccomp_attr_get(scmp_filter_ctx ctx,
                            enum scmp_filter_attr attr, uint32_t *value);

       Link with -lseccomp.

DESCRIPTION

       The  seccomp_attr_set()  function  sets  the different seccomp filter attributes while the
       seccomp_attr_get() function fetches the filter attributes.  The seccomp filter  attributes
       are  tunable  values  that  affect how the library behaves when generating and loading the
       seccomp filter into the kernel.  The attributes are reset to their default values whenever
       the filter is initialized or reset via seccomp_filter_init(3) or seccomp_filter_reset(3).

       The filter context ctx is the value returned by the call to seccomp_init(3).

       Valid attr values are as follows:

       SCMP_FLTATR_ACT_DEFAULT
              The  default  filter  action  as specified in the call to seccomp_filter_init(3) or
              seccomp_filter_reset(3).  This attribute is read-only.

       SCMP_FLTATR_ACT_BADARCH
              The filter action taken when the loaded filter does not match the  architecture  of
              the executing application.  Defaults to the SCMP_ACT_KILL action.

       SCMP_FLTATR_CTL_NNP
              A  flag  to  specify  if  the  NO_NEW_PRIVS  functionality should be enabled before
              loading the seccomp filter into the kernel.  If set to  off  (  value  ==  0)  then
              loading  the  seccomp filter into the kernel will fail if CAP_SYS_ADMIN is not set.
              Defaults to on ( value == 1).

RETURN VALUE

       Returns zero on success, negative errno values on failure.

EXAMPLES

       #include <seccomp.h>

       int main(int argc, char *argv[])
       {
            int rc = -1;
            scmp_filter_ctx ctx;

            ctx = seccomp_init(SCMP_ACT_ALLOW);
            if (ctx == NULL)
                 goto out;

            /* ... */

            rc = seccomp_attr_set(ctx, SCMP_FLTATR_ACT_BADARCH, SCMP_ACT_TRAP);
            if (rc < 0)
                 goto out;

            /* ... */

       out:
            seccomp_release(ctx);
            return -rc;
       }

NOTES

       While the seccomp filter can be generated independent of the  kernel,  kernel  support  is
       required to load and enforce the seccomp filter generated by libseccomp.

       The  libseccomp project site, with more information and the source code repository, can be
       found at http://libseccomp.sf.net.  This library is currently  under  development,  please
       report any bugs at the project site or directly to the author.

AUTHOR

       Paul Moore <paul@paul-moore.com>

SEE ALSO

       seccomp_init(3), seccomp_reset(3), seccomp_load(3)