Skip to main content

walk_seccomp_profiles

Function walk_seccomp_profiles 

Source
pub fn walk_seccomp_profiles<P: PhysicalMemoryProvider>(
    reader: &ObjectReader<P>,
    processes: &[ProcessInfo],
) -> Result<Vec<SeccompInfo>>
Expand description

Walk seccomp profile information for each process in the provided list.

For each process, reads task_struct.seccomp.mode to determine the seccomp enforcement level. When mode is 2 (filter), follows the seccomp.filter pointer chain (seccomp_filter.prev) to count the number of stacked BPF filters.

Returns Ok(Vec::new()) if the required struct/field symbols are missing from the profile (e.g., older kernel without seccomp support).