seccomp_arch_native(3)

1seccomp_arch_add(3)        libseccomp Documentation        seccomp_arch_add(3)
2
3
4

NAME

6       seccomp_arch_add,    seccomp_arch_remove,    seccomp_arch_exist,   sec‐
7       comp_arch_native - Manage seccomp filter architectures
8

SYNOPSIS

10       #include <seccomp.h>
11
12       typedef void * scmp_filter_ctx;
13
14       #define SCMP_ARCH_NATIVE
15       #define SCMP_ARCH_X86
16       #define SCMP_ARCH_X86_64
17       #define SCMP_ARCH_X32
18       #define SCMP_ARCH_ARM
19       #define SCMP_ARCH_AARCH64
20       #define SCMP_ARCH_MIPS
21       #define SCMP_ARCH_MIPS64
22       #define SCMP_ARCH_MIPS64N32
23       #define SCMP_ARCH_MIPSEL
24       #define SCMP_ARCH_MIPSEL64
25       #define SCMP_ARCH_MIPSEL64N32
26       #define SCMP_ARCH_PPC
27       #define SCMP_ARCH_PPC64
28       #define SCMP_ARCH_PPC64LE
29       #define SCMP_ARCH_S390
30       #define SCMP_ARCH_S390X
31       #define SCMP_ARCH_PARISC
32       #define SCMP_ARCH_PARISC64
33       #define SCMP_ARCH_RISCV64
34
35       uint32_t seccomp_arch_resolve_name(const char *arch_name);
36       uint32_t seccomp_arch_native();
37       int seccomp_arch_exist(const scmp_filter_ctx ctx, uint32_t arch_token);
38       int seccomp_arch_add(scmp_filter_ctx ctx, uint32_t arch_token);
39       int seccomp_arch_remove(scmp_filter_ctx ctx, uint32_t arch_token);
40
41       Link with -lseccomp.
42

DESCRIPTION

44       The seccomp_arch_exist() function tests to see if a given  architecture
45       has   been  added  to  the  seccomp  filter  in  ctx,  where  the  sec‐
46       comp_arch_add() and seccomp_arch_remove() add and remove, respectively,
47       architectures from the seccomp filter.  In all three functions, the ar‐
48       chitecture values given in arch_token should be the SCMP_ARCH_* defined
49       constants;  with  the SCMP_ARCH_NATIVE constant always referring to the
50       native compiled architecture.  The seccomp_arch_native()  function  re‐
51       turns  the  system's  architecture  such  that it will match one of the
52       SCMP_ARCH_* constants.  While the seccomp_arch_resolve_name()  function
53       also  returns  a  SCMP_ARCH_*  constant, the returned token matches the
54       name of the architecture passed as an argument to the function.
55
56       When a seccomp filter is initialized with the call  to  seccomp_init(3)
57       the native architecture is automatically added to the filter.
58
59       While it is possible to remove all architectures from a filter, most of
60       the libseccomp APIs will fail if the filter does not contain  at  least
61       one architecture.
62
63       When  adding  a  new  architecture  to an existing filter, the existing
64       rules will not be added to the new architecture.  However, rules  added
65       after adding the new architecture will be added to all of the architec‐
66       tures in the filter.
67

RETURN VALUE

69       The seccomp_arch_add(), seccomp_arch_remove(), and seccomp_arch_exist()
70       functions return zero on success or one of the following error codes on
71       failure:
72
73       -EDOM  Architecture specific failure.
74
75       -EEXIST
76              In the case of seccomp_arch_add() the architecture  already  ex‐
77              ists  and  in the case of seccomp_arch_remove() the architecture
78              does not exist.
79
80       -EINVAL
81              Invalid input, either the context or architecture token  is  in‐
82              valid.
83
84       -ENOMEM
85              The library was unable to allocate enough memory.
86

EXAMPLES

88       #include <seccomp.h>
89
90       int main(int argc, char *argv[])
91       {
92            int rc = -1;
93            scmp_filter_ctx ctx;
94
95            ctx = seccomp_init(SCMP_ACT_KILL);
96            if (ctx == NULL)
97                 goto out;
98
99            if (seccomp_arch_exist(ctx, SCMP_ARCH_X86) == -EEXIST) {
100                 rc = seccomp_arch_add(ctx, SCMP_ARCH_X86);
101                 if (rc != 0)
102                      goto out_all;
103                 rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
104                 if (rc != 0)
105                      goto out_all;
106            }
107
108            /* ... */
109
110       out:
111            seccomp_release(ctx);
112            return -rc;
113       }
114

NOTES

116       While  the  seccomp  filter can be generated independent of the kernel,
117       kernel support is required to load and enforce the seccomp filter  gen‐
118       erated by libseccomp.
119
120       The  libseccomp project site, with more information and the source code
121       repository,  can  be  found  at  https://github.com/seccomp/libseccomp.
122       This tool, as well as the libseccomp library, is currently under devel‐
123       opment, please report any bugs at the project site or directly  to  the
124       author.
125

AUTHOR

127       Paul Moore <paul@paul-moore.com>
128