pub struct Context { /* private fields */ }Expand description
The context to configure and enforce seccomp rules
Implementations
sourceimpl Context
impl Context
sourcepub fn init() -> Result<Context>
pub fn init() -> Result<Context>
Create a new seccomp context and use
DEFAULT_KILL as the default action.
sourcepub fn init_with_action(default_action: Action) -> Result<Context>
pub fn init_with_action(default_action: Action) -> Result<Context>
Create a new seccomp context with the given Action as default action.
sourcepub fn allow_syscall(&mut self, syscall: Syscall) -> Result<()>
pub fn allow_syscall(&mut self, syscall: Syscall) -> Result<()>
Allow the given syscall regardless of the arguments.
sourcepub fn set_action_for_syscall(
&mut self,
action: Action,
syscall: Syscall
) -> Result<()>
pub fn set_action_for_syscall(
&mut self,
action: Action,
syscall: Syscall
) -> Result<()>
Execute the given action for the given syscall. This can be used to either allow or deny a syscall, regardless of the arguments.
sourcepub fn set_rule_for_syscall(
&mut self,
action: Action,
syscall: Syscall,
comparators: &[Comparator]
) -> Result<()>
pub fn set_rule_for_syscall(
&mut self,
action: Action,
syscall: Syscall,
comparators: &[Comparator]
) -> Result<()>
Execute a given action for a given syscall if the
Comparators match the given arguments.
sourcepub fn export_bpf(&self, fd: &mut dyn AsRawFd) -> Result<()>
pub fn export_bpf(&self, fd: &mut dyn AsRawFd) -> Result<()>
Generate and output the current seccomp filter in BPF (Berkeley Packet Filter) format. The output is suitable to be loaded into the kernel. The filter is written to the given file descriptor.
sourcepub fn export_pfc(&self, fd: &mut dyn AsRawFd) -> Result<()>
pub fn export_pfc(&self, fd: &mut dyn AsRawFd) -> Result<()>
Generate and output the current seccomp filter in PFC (Pseudo Filter Code) format. The output is human read and meant to be used for debugging for developers. The filter is written to the given file descriptor.