Struct SeccompFilterContainer 

pub struct SeccompFilterContainer {
    pub filters: Vec<Arc<SeccompFilter>>,
    pub provided_instructions: u16,
    pub always_allow: [u64; 8],
}

A list of seccomp filters, intended to be associated with a specific process.

Fields

filters: Vec<Arc<SeccompFilter>>

List of currently installed seccomp_filters; most recently added is last.

provided_instructions: u16

always_allow: [u64; 8]

Intersection of always_allow bitmaps across all installed filters.

Implementations

impl SeccompFilterContainer

pub fn can_sync_to(&self, source: &SeccompFilterContainer) -> bool

Ensures that this set of seccomp filters can be “synced to” the given set. This means that our filters are a prefix of the given set of filters.

pub fn add_filter( &mut self, filter: Arc<SeccompFilter>, original_length: u16, ) -> Result<(), Errno>

Adds the given filter to this list. The original_length parameter is the length of the originally provided BPF (i.e., the number of sock_filter instructions), used to ensure the total length does not exceed SECCOMP_MAX_INSNS_PER_PATH

pub fn run_all( &self, current_task: &CurrentTask, syscall: &Syscall, ) -> SeccompFilterResult

Runs all of the seccomp filters in this container, most-to-least recent. Returns the highest priority result (which contains a reference to the filter that generated it)

pub fn create_notifier() -> SeccompNotifierHandle

pub fn register_listener( current_task: &CurrentTask, notifier: SeccompNotifierHandle, ) -> Result<FdNumber, Errno>

Trait Implementations

impl Clone for SeccompFilterContainer

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for SeccompFilterContainer

fn default() -> Self

Returns the “default value” for a type.

impl Drop for SeccompFilterContainer

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.