static bool skip_seccomp_unavailable(const Unit* u, const char* msg) {
if (!is_seccomp_available()) {
log_open();
- log_unit_debug(u, "SECCOMP not detected in the kernel, skipping %s", msg);
+ log_unit_debug(u, "SECCOMP features not detected in the kernel, skipping %s", msg);
log_close();
return true;
}
#include <errno.h>
#include <seccomp.h>
#include <stddef.h>
+#include <sys/prctl.h>
+#include <linux/seccomp.h>
-#include "alloc-util.h"
-#include "fileio.h"
#include "macro.h"
#include "seccomp-util.h"
#include "string-util.h"
}
+static bool is_basic_seccomp_available(void) {
+ int r;
+ r = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
+ return r >= 0;
+}
+
+static bool is_seccomp_filter_available(void) {
+ int r;
+ r = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, 0, 0);
+ return r < 0 && errno == EFAULT;
+}
+
bool is_seccomp_available(void) {
- _cleanup_free_ char* field = NULL;
static int cached_enabled = -1;
if (cached_enabled < 0)
- cached_enabled = get_proc_field("/proc/self/status", "Seccomp", "\n", &field) == 0;
+ cached_enabled = is_basic_seccomp_available() && is_seccomp_filter_available();
return cached_enabled;
}