Search code examples
bpfseccomp

use another data structure instead of seccomp_data with seccomp

Is it possible to use another data structure instead of seccomp_data within the BPF code of seccomp? For example from this... 

...
BPF_STMT(BPF_LD+BPF_W+BPF_ABS,(offsetof (struct seccomp_data, args[0]))),
...

to this

...
BPF_STMT(BPF_LD+BPF_W+BPF_ABS,(offsetof (struct my_data, my_field[0]))),
...
Solution

  • No, that structure is populated on the kernel side before calling your cBPF program. To change what data your cBPF programs take as input, you'd have to edit (and recompile) the kernel.

    You could redefine that structure, but I'm not sure what the point of that would be.