seccomp_api_get(3) — Linux manual page


seccomp_api_get(3)        libseccomp Documentation        seccomp_api_get(3)

NAME         top

       seccomp_api_get, seccomp_api_set - Manage the libseccomp API level

SYNOPSIS         top

       #include <seccomp.h>

       const unsigned int seccomp_api_get(void);
       int seccomp_api_set(unsigned int level);

       Link with -lseccomp.

DESCRIPTION         top

       The seccomp_api_get() function returns an integer representing the
       functionality ("API level") provided by the current running kernel.
       It is important to note that while seccomp_api_get() can be called
       multiple times, the kernel is only probed the first time to see what
       functionality is supported, all following calls to seccomp_api_get()
       return a cached value.

       The seccomp_api_set() function allows callers to force the API level
       to the provided value; however, this is almost always a bad idea and
       use of this function is strongly discouraged.

       The different API level values are described below:

       0      Reserved value, not currently used.

       1      Base level support.

       2      The SCMP_FLTATR_CTL_TSYNC filter attribute is supported and
              libseccomp uses the seccomp(2) syscall to load the seccomp
              filter into the kernel.

       3      The SCMP_FLTATR_CTL_LOG filter attribute and the SCMP_ACT_LOG
              action are supported.

       4      The SCMP_FLTATR_CTL_SSB filter attribute is supported.

       5      The SCMP_ACT_NOTIFY action and the notify APIs are supported.

       5      The simultaneous use of SCMP_FLTATR_CTL_TSYNC and the notify
              APIs are supported.

RETURN VALUE         top

       The seccomp_api_get() function returns an integer representing the
       supported API level.  The seccomp_api_set() function returns zero on
       success, negative values on failure.

EXAMPLES         top

       #include <seccomp.h>

       int main(int argc, char *argv[])
            unsigned int api;

            api = seccomp_api_get();
            switch (api) {
            case 2:
                 /* ... */
                 /* ... */

            return 0;

            return -1;

NOTES         top

       While the seccomp filter can be generated independent of the kernel,
       kernel support is required to load and enforce the seccomp filter
       generated by libseccomp.

       The libseccomp project site, with more information and the source
       code repository, can be found at  This tool, as well as the
       libseccomp library, is currently under development, please report any
       bugs at the project site or directly to the author.

AUTHOR         top

       Paul Moore <>

COLOPHON         top

       This page is part of the libseccomp (high-level API to the Linux
       Kernel's seccomp filter) project.  Information about the project can
       be found at ⟨⟩.  If you have a
       bug report for this manual page, see
       ⟨⟩.  This page was
       obtained from the project's upstream Git repository
       ⟨⟩ on 2020-09-18.  (At that
       time, the date of the most recent commit that was found in the repos‐
       itory was 2020-09-15.)  If you discover any rendering problems in
       this HTML version of the page, or you believe there is a better or
       more up-to-date source for the page, or you have corrections or
       improvements to the information in this COLOPHON (which is not part
       of the original manual page), send a mail to             13 June 2020              seccomp_api_get(3)