Skip to main content

build

proot::seccomp::filter

Function build 

Source 
pub fn build(
    t64: &Table<'_>,
    t32: &Table<'_>,
    no_trace: bool,
) -> Vec<SockFilter>
Expand description

Builds the filter program.

O_PATH opens are routed to the tracer by inspecting the flags argument, because such descriptors cannot be injected with ADDFD; an i386 socketcall is routed there for bind and connect only. Without a tracer (no_trace) both go to the listener instead, like every entry of the trace lists.

§Arguments

  • t64 - The host’s 64-bit ABI and its syscall lists.
  • t32 - The host’s 32-bit compat ABI and its lists (may be empty).
  • no_trace - Serve the trace tier through user notification.

§Returns

The instruction list, ready for seccomp(2).