Struct syscallz::Context

pub struct Context { /* fields omitted */ }

The context to configure and enforce seccomp rules

Implementations

impl Context

pub fn init() -> Result<Context>

Create a new seccomp context and use DEFAULT_KILL as the default action.

pub fn init_with_action(default_action: Action) -> Result<Context>

Create a new seccomp context with the given Action as default action.

pub fn allow_syscall(&mut self, syscall: Syscall) -> Result<()>

Allow the given syscall regardless of the arguments.

pub fn set_action_for_syscall(
    &mut self,
    action: Action,
    syscall: Syscall
) -> Result<()>

Execute the given action for the given syscall. This can be used to either allow or deny a syscall, regardless of the arguments.

pub fn set_rule_for_syscall(
    &mut self,
    action: Action,
    syscall: Syscall,
    comparators: &[Comparator]
) -> Result<()>

Execute a given action for a given syscall if the Comparators match the given arguments.

pub fn load(&self) -> Result<()>

Load and enforce the configured seccomp policy

pub fn export_bpf(&self, fd: &mut dyn AsRawFd) -> Result<()>

Generate and output the current seccomp filter in BPF (Berkeley Packet Filter) format. The output is suitable to be loaded into the kernel. The filter is written to the given file descriptor.

pub fn export_pfc(&self, fd: &mut dyn AsRawFd) -> Result<()>

Generate and output the current seccomp filter in PFC (Pseudo Filter Code) format. The output is human read and meant to be used for debugging for developers. The filter is written to the given file descriptor.

Trait Implementations

impl Drop for Context

fn drop(&mut self)

Executes the destructor for this type.