seccomp/libseccomp_demo.c

This is seccomp/libseccomp_demo.c, an example to accompany the book, The Linux Programming Interface.

This file is not printed in the book; it demonstrates Linux features that are not described in the book (typically features that have appeared since the book was published).

In the listing below, the names of Linux system calls and C library functions are hyperlinked to manual pages from the Linux man-pages project, and the names of functions implemented in the book are hyperlinked to the implementations of those functions.

Download seccomp/libseccomp_demo.c

Cover of The Linux Programming Interface

Distribution version

/* libseccomp_demo.c
*/
#include <errno.h>
#include <stdio.h>
#include <unistd.h>
#include <seccomp.h>
#include "tlpi_hdr.h"

int main(int argc, char *argv[])
{
    /* Create seccomp filter state that allows by default */

    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW);
    if (ctx == NULL)
        fatal("seccomp_init() failed");

    /* Cause clone(), clone3(), and fork() to fail, each with different
       errors */

    int rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(clone), 0);
    if (rc < 0)
        errExitEN(-rc, "seccomp_rule_add");

    rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(clone3), 0);
    if (rc < 0)
        errExitEN(-rc, "seccomp_rule_add");

    rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOTSUP), SCMP_SYS(fork), 0);
    if (rc < 0)
        errExitEN(-rc, "seccomp_rule_add");

    /* Export the pseudofilter code and BPF binary code,
       each to different file descriptors (if they are open) */

    seccomp_export_pfc(ctx, 5);
    seccomp_export_bpf(ctx, 6);

    /* Install the seccomp filter into the kernel */

    rc = seccomp_load(ctx);
    if (rc < 0)
        errExitEN(-rc, "seccomp_load");

    /* Free the user-space seccomp filter state */

    seccomp_release(ctx);

    if (fork() != -1)
        fprintf(stderr, "fork() succeeded?!\n");
    else
        perror("fork");

    exit(EXIT_SUCCESS);
}

Download seccomp/libseccomp_demo.c

Note that, in most cases, the programs rendered in these web pages are not free standing: you'll typically also need a few other source files (mostly in the lib/ subdirectory) as well. Generally, it's easier to just download the entire source tarball and build the programs with make(1). By hovering your mouse over the various hyperlinked include files and function calls above, you can see which other source files this file depends on.