seccomp

Partial in Antinomie 0.7.0 · Syscall list

Synopsis

long seccomp(unsigned int op, unsigned int flags, void *uargs);

Number (x86-64)	317
ABI	common
Kernel entry point	sys_seccomp

This is the raw kernel prototype from the pinned Linux 6.12.94 schema, not the libc wrapper.

Description

Controls seccomp system call filtering: set strict mode, load a filter program, query actions.

Arguments

Name	Type	Meaning
op (arg0)	unsigned int	seccomp operation: SECCOMP_SET_MODE_STRICT, SECCOMP_SET_MODE_FILTER, SECCOMP_GET_ACTION_AVAIL, SECCOMP_GET_NOTIF_SIZES.
flags (arg1)	unsigned int	Option flags that change the behavior of the call.
uargs (arg2)	void *	Operation-specific pointer, such as a struct sock_fprog.

Return value

On success: 0, or a filter id for some operations.

In an Antinomie trace the Return column and the ret filter field show the raw kernel return value. On failure that is the negative errno, for example -2 for ENOENT, not the -1 plus errno that the libc wrapper gives. syscall.errno holds the positive errno and syscall.success is false.

Common errors

Raw return	Name	Meaning
-13	EACCES	Permission denied.
-14	EFAULT	A pointer argument points outside the accessible address space.
-22	EINVAL	An argument is invalid.

Man page

seccomp(2) on man7.org

Captured by Antinomie

Coverage mark: Partial. The filter program is decoded for SECCOMP_SET_MODE_FILTER. An unknown operation records a seccomp.unknown_selector “no decoder” gap.

Every call is recorded as an Entry record (the six argument words and the pointees copied at entry) and an Exit record (the return value and the pointees copied at exit).

Arguments

Argument	When	How	Recorded field key	Condition
op (arg0)	Entry	raw scalar word	args.0, args.op
flags (arg1)	Entry	raw scalar word; Syscall Trace also decodes it into flag names (seccomp group), listing unknown bits separately	args.1, args.flags
uargs (arg2)	Entry	the pointer itself, as a raw word	args.2, args.raw[2]
↳ pointee	Entry	structure sock_fprog (the filter header)	arg2.program	op is SECCOMP_SET_MODE_FILTER
↳ pointee	Entry	array of sock_filter (8 bytes each), count from the header; “invalid extent” if 0 or above 4,096	arg2.program.filter	op is SECCOMP_SET_MODE_FILTER and the header was read
↳ pointee	Entry	u32 action	arg2.action	op is SECCOMP_GET_ACTION_AVAIL
↳ pointee	Exit	structure seccomp_notif_sizes	arg2.sizes	op is SECCOMP_GET_NOTIF_SIZES and result is 0

Filter fields

• Result: ret, syscall.errno, syscall.success, syscall.duration_ns.
• Argument words: args.op (arg0), args.flags (arg1), args.uargs (arg2); args.0 to args.5 by position.
• Structure u32 behind uargs (arg2): args.uargs.<member> for value.

See Syscall Trace filter for the full syntax.

Known gaps

• An unknown op records seccomp.unknown_selector with the “no decoder” status.
• See the coverage mark above for the code paths that record a gap.

For what the capture statuses mean, see Capture statuses. For what is never recorded, see Known gaps.