Module: Seccomp::Notify::Filter

Defined in:
lib/seccomp/notify/filter.rb

Class Method Summary collapse

Class Method Details

.install!(program, flags: 0, raw: false) ⇒ Object

Raises:

  • (SystemCallError) 


8
9
10
11
12
13
14
15
16
17
18
 
# File 'lib/seccomp/notify/filter.rb', line 8

def install!(program, flags: 0, raw: false)
  unless Libc.prctl(Constants::PR_SET_NO_NEW_PRIVS, 1).zero?
    raise SystemCallError.new("prctl(PR_SET_NO_NEW_PRIVS)", Fiddle.last_error)
  end

  filter_flags = flags | Constants::SECCOMP_FILTER_FLAG_NEW_LISTENER
  fd = Libc.seccomp(Constants::SECCOMP_SET_MODE_FILTER, filter_flags, program.to_sock_fprog)
  raise SystemCallError.new("seccomp(SET_MODE_FILTER)", Fiddle.last_error) if fd.negative?

  raw ? fd : IO.for_fd(fd, "r")
end