Struct SeccompFilterContainer 

pub struct SeccompFilterContainer {
    pub filters: Vec<Arc<SeccompFilter>>,
    pub provided_instructions: u16,
    pub notifier: Option<SeccompNotifierHandle>,
}

A list of seccomp filters, intended to be associated with a specific process.

Fields

filters: Vec<Arc<SeccompFilter>>

List of currently installed seccomp_filters; most recently added is last.

provided_instructions: u16

notifier: Option<SeccompNotifierHandle>

Implementations

impl SeccompFilterContainer

pub fn can_sync_to(&self, source: &SeccompFilterContainer) -> bool

Ensures that this set of seccomp filters can be “synced to” the given set. This means that our filters are a prefix of the given set of filters.

pub fn add_filter( &mut self, filter: Arc<SeccompFilter>, original_length: u16, ) -> Result<(), Errno>

Adds the given filter to this list. The original_length parameter is the length of the originally provided BPF (i.e., the number of sock_filter instructions), used to ensure the total length does not exceed SECCOMP_MAX_INSNS_PER_PATH

pub fn run_all( &self, current_task: &CurrentTask, syscall: &Syscall, ) -> SeccompFilterResult

Runs all of the seccomp filters in this container, most-to-least recent. Returns the highest priority result (which contains a reference to the filter that generated it)

pub fn create_listener( locked: &mut Locked<Unlocked>, current_task: &CurrentTask, ) -> Result<FdNumber, Errno>

Creates a new listener for use by SECCOMP_RET_USER_NOTIF. Returns its fd.

Trait Implementations

impl Clone for SeccompFilterContainer

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for SeccompFilterContainer

fn default() -> SeccompFilterContainer

Returns the “default value” for a type.

impl Drop for SeccompFilterContainer

fn drop(&mut self)

Executes the destructor for this type.