Crate libscmp

libscmp provides a friendly wrapper over the libseccomp C library.

Here’s a simple example:

use libscmp::{Filter, Action, Arg, resolve_syscall_name};

// Allow all syscalls by default
let mut filter = Filter::new(Action::Allow).unwrap();

// Block `setpriority(PRIO_PROCESS, ...)`
filter
    .add_rule_exact(
        Action::Errno(libc::EPERM),
        resolve_syscall_name("setpriority").unwrap(),
        &[Arg::new_eq(0, libc::PRIO_PROCESS as u64)],
    )
    .unwrap();

// Load the filter into the kernel
filter.load().unwrap();

// Now `setpriority(PRIO_PROCESS, 0, 0)` should fail
assert_eq!(unsafe { libc::setpriority(libc::PRIO_PROCESS, 0, 0) }, -1);
assert_eq!(std::io::Error::last_os_error().raw_os_error(), Some(libc::EPERM));

Structs

Arg

Represents a syscall argument comparison, used in a filter rule.

Error

Represents an error that could occur when interacting with libseccomp.

Filter

Represents a syscall filter.

NotifRespFlagslibseccomp-2-5

Represents the flags that can be set on a NotificationResponse.

Notificationlibseccomp-2-5

Represents a seccomp notification.

NotificationResponselibseccomp-2-5

Represents a response to a seccomp notification.

ParseArchError

Represents an error when parsing an Arch from a string.

Enums

Action

Specifies an action to be taken, either as the default action for a filter or when a rule matches.

Arch

An architecture supported by libseccomp.

Cmp

Represents a comparison type that can be used in an Arg.

Flag

Represents a boolean flag that can be set on a filter.

Functions

api_getlibseccomp-2-4

Get the “API level” supported by the running kernel.

api_setlibseccomp-2-4

Force the API level used by libseccomp (do not use unless you know what you’re doing).

libseccomp_version

Get the version of the currently loaded libseccomp library.

notify_id_validlibseccomp-2-5

Check if the given notification ID is still valid.

reset_global_state

Reset libseccomp’s global state.

resolve_syscall_name

Look up the number of the syscall with the given name on the native architecture.

resolve_syscall_name_arch

Look up the number of the syscall with the given name on the given architecture.

resolve_syscall_name_rewrite

Look up the number of the syscall with the given name on the given architecture, modifying the syscall number for multiplexed syscalls.

resolve_syscall_num

Look up the name of a syscall given the architecture and the syscall number.

Type Aliases

Result