seccomp_syscall_resolve_num_arch(3) [centos man page]
seccomp_syscall_resolve_name(3) libseccomp Documentation seccomp_syscall_resolve_name(3) NAME
seccomp_syscall_resolve_name - Resolve a syscall name SYNOPSIS
#include <seccomp.h> int seccomp_syscall_resolve_name(const char *name); int seccomp_syscall_resolve_name_arch(uint32_t arch_token, const char *name); char *seccomp_syscall_resolve_num_arch(uint32_t arch_token, int num); Link with -lseccomp. DESCRIPTION
The seccomp_syscall_resolve_name() and seccomp_syscall_resolve_name_arch() functions resolve the commonly used syscall name to the syscall number used by the kernel and the rest of the libseccomp API. The seccomp_syscall_resolve_num_arch() function resolves the syscall number used by the kernel to the commonly used syscall name. The caller is responsible for freeing the returned string from seccomp_syscall_resolve_num_arch(). RETURN VALUE
In the case of seccomp_syscall_resolve_name() and seccomp_syscall_resolve_name_arch() the associated syscall number is returned, with the negative pseudo syscall number being returned in cases where the given syscall does not exist for the architeture. The value __NR_SCMP_ERROR is returned in case of error. In all cases, the return value is suitable for use in any libseccomp API function which requires the syscall number, examples include seccomp_rule_add() and seccomp_rule_add_exact(). In the case of seccomp_syscall_resolve_num_arch() the associated syscall name is returned and it remains the callers responsibility to free the returned string via free(3). EXAMPLES
#include <seccomp.h> int main(int argc, char *argv[]) { int rc = -1; scmp_filter_ctx ctx; ctx = seccomp_init(SCMP_ACT_KILL); if (ctx == NULL) goto out; /* ... */ rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, seccomp_syscall_resolve_name("open"), 0); if (rc < 0) goto out; /* ... */ rc = seccomp_load(ctx); if (rc < 0) goto out; /* ... */ out: seccomp_release(ctx); return -rc; } NOTES
While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter gen- erated by libseccomp. The libseccomp project site, with more information and the source code repository, can be found at http://libseccomp.sf.net. This library is currently under development, please report any bugs at the project site or directly to the author. AUTHOR
Paul Moore <paul@paul-moore.com> SEE ALSO
seccomp_rule_add(3), seccomp_rule_add_exact(3) paul@paul-moore.com 7 January 2013 seccomp_syscall_resolve_name(3)
Check Out this Related Man Page
seccomp_init(3) libseccomp Documentation seccomp_init(3) NAME
seccomp_init, seccomp_reset - Initialize the seccomp filter state SYNOPSIS
#include <seccomp.h> typedef void * scmp_filter_ctx; scmp_filter_ctx seccomp_init(uint32_t def_action); int seccomp_reset(scmp_filter_ctx ctx, uint32_t def_action); Link with -lseccomp. DESCRIPTION
The seccomp_init() and seccomp_reset() functions (re)initialize the internal seccomp filter state, prepares it for use, and sets the default action based on the def_action parameter. The seccomp_init() function must be called before any other libseccomp functions as the rest of the library API will fail if the filter context is not initialized properly. The seccomp_reset() function releases the existing filter context state before reinitializing it and can only be called after a call to seccomp_init() has succeeded. When the caller is finished configuring the seccomp filter and has loaded it into the kernel, the caller should call seccomp_release(3) to release all of the filter context state. Valid def_action values are as follows: SCMP_ACT_KILL The process will be killed by the kernel when it calls a syscall that does not match any of the configured seccomp filter rules. SCMP_ACT_TRAP The process will throw a SIGSYS signal when it calls a syscall that does not match any of the configured seccomp filter rules. SCMP_ACT_ERRNO(uint16_t errno) The process will receive a return value of errno when it calls a syscall that does not match any of the configured seccomp filter rules. SCMP_ACT_TRACE(uint16_t msg_num) If the process is being traced and the tracing process specified the PTRACE_O_TRACESECCOMP option in the call to ptrace(2), the tracing process will be notified, via PTRACE_EVENT_SECCOMP , and the value provided in msg_num can be retrieved using the PTRACE_GETEVENTMSG option. SCMP_ACT_ALLOW The seccomp filter will have no effect on the process calling the syscall if it does not match any of the configured seccomp filter rules. RETURN VALUE
The seccomp_init() function returns a filter context on success, NULL on failure. The seccomp_reset() function returns zero on success, negative errno values on failure. EXAMPLES
#include <seccomp.h> int main(int argc, char *argv[]) { int rc = -1; scmp_filter_ctx ctx; ctx = seccomp_init(SCMP_ACT_KILL); if (ctx == NULL) goto out; /* ... */ rc = seccomp_reset(ctx, SCMP_ACT_KILL); if (rc < 0) goto out; /* ... */ out: seccomp_release(ctx); return -rc; } NOTES
While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter gen- erated by libseccomp. The libseccomp project site, with more information and the source code repository, can be found at http://libseccomp.sf.net. This library is currently under development, please report any bugs at the project site or directly to the author. AUTHOR
Paul Moore <paul@paul-moore.com> SEE ALSO
seccomp_release(3) paul@paul-moore.com 25 July 2012 seccomp_init(3)