1seccomp_api_get(3)         libseccomp Documentation         seccomp_api_get(3)
2
3
4

NAME

6       seccomp_api_get, seccomp_api_set - Manage the libseccomp API level
7

SYNOPSIS

9       #include <seccomp.h>
10
11       const unsigned int seccomp_api_get(void);
12       int seccomp_api_set(unsigned int level);
13
14       Link with -lseccomp.
15

DESCRIPTION

17       The  seccomp_api_get()  function  returns  an  integer representing the
18       functionality ("API level") provided by the current running kernel.  It
19       is  important to note that while seccomp_api_get() can be called multi‐
20       ple times, the kernel is only probed the first time to see  what  func‐
21       tionality is supported, all following calls to seccomp_api_get() return
22       a cached value.
23
24       The seccomp_api_set() function allows callers to force the API level to
25       the  provided  value; however, this is almost always a bad idea and use
26       of this function is strongly discouraged.
27
28       The different API level values are described below:
29
30       0      Reserved value, not currently used.
31
32       1      Base level support.
33
34       2      The SCMP_FLTATR_CTL_TSYNC filter attribute is supported and lib‐
35              seccomp  uses  the seccomp(2) syscall to load the seccomp filter
36              into the kernel.
37
38       3      The SCMP_FLTATR_CTL_LOG filter attribute  and  the  SCMP_ACT_LOG
39              action are supported.
40
41       4      The SCMP_FLTATR_CTL_SSB filter attribute is supported.
42
43       5      The SCMP_ACT_NOTIFY action and the notify APIs are supported.
44
45       5      The  simultaneous  use  of  SCMP_FLTATR_CTL_TSYNC and the notify
46              APIs are supported.
47

RETURN VALUE

49       The seccomp_api_get() function returns an integer representing the sup‐
50       ported  API level.  The seccomp_api_set() function returns zero on suc‐
51       cess, negative values on failure.
52

EXAMPLES

54       #include <seccomp.h>
55
56       int main(int argc, char *argv[])
57       {
58            unsigned int api;
59
60            api = seccomp_api_get();
61            switch (api) {
62            case 2:
63                 /* ... */
64            default:
65                 /* ... */
66            }
67
68            return 0;
69
70       err:
71            return -1;
72       }
73

NOTES

75       While the seccomp filter can be generated independent  of  the  kernel,
76       kernel  support is required to load and enforce the seccomp filter gen‐
77       erated by libseccomp.
78
79       The libseccomp project site, with more information and the source  code
80       repository,  can  be  found  at  https://github.com/seccomp/libseccomp.
81       This tool, as well as the libseccomp library, is currently under devel‐
82       opment,  please  report any bugs at the project site or directly to the
83       author.
84

AUTHOR

86       Paul Moore <paul@paul-moore.com>
87
88
89
90paul@paul-moore.com              13 June 2020               seccomp_api_get(3)
Impressum