seccomp_arch_add(3)       libseccomp Documentation       seccomp_arch_add(3)

NAME         top

       seccomp_arch_add,   seccomp_arch_remove,   seccomp_arch_exist,   sec‐
       comp_arch_native - Manage seccomp filter architectures

SYNOPSIS         top

       #include <seccomp.h>

       typedef void * scmp_filter_ctx;

       #define SCMP_ARCH_NATIVE
       #define SCMP_ARCH_X86
       #define SCMP_ARCH_X86_64

       uint32_t seccomp_arch_resolve_name(const char *arch_name);
       uint32_t seccomp_arch_native();
       int seccomp_arch_exist(const scmp_filter_ctx ctx, uint32_t arch_token);
       int seccomp_arch_add(scmp_filter_ctx ctx, uint32_t arch_token);
       int seccomp_arch_remove(scmp_filter_ctx ctx, uint32_t arch_token);

       Link with -lseccomp.

DESCRIPTION         top

       The seccomp_arch_exist() function tests to see if a given
       architecture has been added to the seccomp filter in ctx , where the
       seccomp_arch_add() and seccomp_arch_remove() add and remove,
       respectively, architectures from the seccomp filter.  In all three
       functions, the architecture values given in arch_token should be the
       SCMP_ARCH_* defined constants; with the SCMP_ARCH_NATIVE constant
       always referring to the native compiled architecture.  The
       seccomp_arch_native() function returns the system's architecture such
       that it will match one of the SCMP_ARCH_* constants.  While the
       seccomp_arch_resolve_name() function also returns a SCMP_ARCH_*
       constant, the returned token matches the name of the architecture
       passed as an argument to the function.

       When a seccomp filter is initialized with the call to seccomp_init(3)
       the native architecture is automatically added to the filter.

       While it is possible to remove all architectures from a filter, most
       of the libseccomp APIs will fail if the filter does not contain at
       least one architecture.

       When adding a new architecture to an existing filter, the existing
       rules will not be added to the new architecture.  However, rules
       added after adding the new architecture will be added to all of the
       architectures in the filter.

RETURN VALUE         top

       The seccomp_arch_add() and seccomp_arch_remove() functions return
       zero on success, negative errno values on failure.  The
       seccomp_arch_exist() function returns zero if the architecture
       exists, -EEXIST if it does not, and other negative errno values on

EXAMPLES         top

       #include <seccomp.h>

       int main(int argc, char *argv[])
            int rc = -1;
            scmp_filter_ctx ctx;

            ctx = seccomp_init(SCMP_ACT_KILL);
            if (ctx == NULL)
                 goto out;

            if (seccomp_arch_exist(ctx, SCMP_ARCH_X86) == -EEXIST) {
                 rc = seccomp_arch_add(ctx, SCMP_ARCH_X86);
                 if (rc != 0)
                      goto out_all;
                 rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
                 if (rc != 0)
                      goto out_all;

            /* ... */

            return -rc;

NOTES         top

       While the seccomp filter can be generated independent of the kernel,
       kernel support is required to load and enforce the seccomp filter
       generated by libseccomp.

       The libseccomp project site, with more information and the source
       code repository, can be found at  This tool, as well as the
       libseccomp library, is currently under development, please report any
       bugs at the project site or directly to the author.

AUTHOR         top

       Paul Moore <>

SEE ALSO         top

       seccomp_init(3), seccomp_reset(3), seccomp_merge(3)

COLOPHON         top

       This page is part of the libseccomp (high-level API to the Linux
       Kernel's seccomp filter) project.  Information about the project can
       be found at ⟨⟩.  If you have a
       bug report for this manual page, see 
       ⟨⟩.  This page was
       obtained from the project's upstream Git repository 
       ⟨⟩ on 2017-03-13.  If you dis‐
       cover any rendering problems in this HTML version of the page, or you
       believe there is a better or more up-to-date source for the page, or
       you have corrections or improvements to the information in this
       COLOPHON (which is not part of the original manual page), send a mail
       to              7 May 2014              seccomp_arch_add(3)