seccomp_api_get(3) — Linux manual page

NAME \| SYNOPSIS \| DESCRIPTION \| RETURN VALUE \| EXAMPLES \| NOTES \| AUTHOR \| COLOPHON

seccomp_api_get(3)      libseccomp Documentation      seccomp_api_get(3)

NAME top

       seccomp_api_get, seccomp_api_set - Manage the libseccomp API
       level

SYNOPSIS top

       #include <seccomp.h>

       const unsigned int seccomp_api_get(void);
       int seccomp_api_set(unsigned int level);

       Link with -lseccomp.

DESCRIPTION top

       The seccomp_api_get() function returns an integer representing
       the functionality ("API level") provided by the current running
       kernel.  It is important to note that while seccomp_api_get() can
       be called multiple times, the kernel is only probed the first
       time to see what functionality is supported, all following calls
       to seccomp_api_get() return a cached value.

       The seccomp_api_set() function allows callers to force the API
       level to the provided value; however, this is almost always a bad
       idea and use of this function is strongly discouraged.

       The different API level values are described below:

       0      Reserved value, not currently used.

       1      Base level support.

       2      The SCMP_FLTATR_CTL_TSYNC filter attribute is supported
              and libseccomp uses the seccomp(2) syscall to load the
              seccomp filter into the kernel.

       3      The SCMP_FLTATR_CTL_LOG filter attribute and the
              SCMP_ACT_LOG action are supported.

       4      The SCMP_FLTATR_CTL_SSB filter attribute is supported.

       5      The SCMP_ACT_NOTIFY action and the notify APIs are
              supported.

       6      The simultaneous use of SCMP_FLTATR_CTL_TSYNC and the
              notify APIs are supported.

       7      The SCMP_FLTATR_CTL_WAITKILL filter attribute is
              supported.

RETURN VALUE top

       The seccomp_api_get() function returns an integer representing
       the supported API level.  The seccomp_api_set() function returns
       zero on success, negative values on failure.

EXAMPLES top

       #include <seccomp.h>

       int main(int argc, char *argv[])
       {
            unsigned int api;

            api = seccomp_api_get();
            switch (api) {
            case 2:
                 /* ... */
            default:
                 /* ... */
            }

            return 0;

       err:
            return 1;
       }

NOTES top

       While the seccomp filter can be generated independent of the
       kernel, kernel support is required to load and enforce the
       seccomp filter generated by libseccomp.

       The libseccomp project site, with more information and the source
       code repository, can be found at
       https://github.com/seccomp/libseccomp.  This tool, as well as the
       libseccomp library, is currently under development, please report
       any bugs at the project site or directly to the author.

AUTHOR top

       Paul Moore <paul@paul-moore.com>

COLOPHON top

       This page is part of the libseccomp (high-level API to the Linux
       Kernel's seccomp filter) project.  Information about the project
       can be found at ⟨https://github.com/seccomp/libseccomp⟩.  If you
       have a bug report for this manual page, see
       ⟨https://groups.google.com/d/forum/libseccomp⟩.  This page was
       obtained from the project's upstream Git repository
       ⟨https://github.com/seccomp/libseccomp⟩ on 2024-06-14.  (At that
       time, the date of the most recent commit that was found in the
       repository was 2024-04-18.)  If you discover any rendering
       problems in this HTML version of the page, or you believe there
       is a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to
       man-pages@man7.org

paul@paul-moore.com         22 September 2022         seccomp_api_get(3)