seccomp, or secure computing, is a Linux syscall that aims to improve system security. By using seccomp, a process can limit the system calls available to itself.
There are two seccomp modes with different trade-offs, these are called Strict Mode and Filter Mode.
Strict mode is the original seccomp mode that was available before the introduction of filter mode. In strict mode, the only system calls that a process is permitted to make are read, write, exit and sigreturn. Attempting to perform any other system call results in the process getting terminated with a SIGKILL.
Filter mode allows more granular control of system calls by checking every syscall through a BPF program.
Enter seccomp from C
You’re gonna need some imports. If your code is meant to be cross-platform, you should check if you are compiling for a Linux system first.
If you have the necessary imports, you can run the the line below and enable seccomp for the current process.
/* Use seccomp on Linux */
Cannot exit or return from main
This is because glibc is a piece of garbage and instead of a normal exit, it uses a weird exit. You can easily use the exit syscall instead.
The zero here is your exit code. If you had an error, change it to something that is non-zero.