pub fn apply_filter(bpf_filter: BpfProgramRef) -> std::result::Result<(), InstallationError> {
    // If the program is empty, don't install the filter.
    if bpf_filter.is_empty() {
        return Ok(());
    }

    // If the program length is greater than the limit allowed by the kernel,
    // fail quickly. Otherwise, `prctl` will give a more cryptic error code.
    if bpf_filter.len() > BPF_MAX_LEN {
        return Err(InstallationError::FilterTooLarge);
    }

    unsafe {
        {
            let rc = libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
            if rc != 0 {
                return Err(InstallationError::Prctl(*libc::__errno_location()));
            }
        }

        let bpf_prog = sock_fprog {
            len: bpf_filter.len() as u16,
            filter: bpf_filter.as_ptr(),
        };
        let bpf_prog_ptr = &bpf_prog as *const sock_fprog;
        {
            let rc = libc::prctl(
                libc::PR_SET_SECCOMP,
                libc::SECCOMP_MODE_FILTER,
                bpf_prog_ptr,
            );
            if rc != 0 {
                return Err(InstallationError::Prctl(*libc::__errno_location()));
            }
        }
    }

    Ok(())
}
/// Helper function for installing a BPF filter.
Helper function for installing a BPF filter.
Helper function for installing a BPF filter .
pub fn apply_filter(bpf_filter: BpfProgramRef) -> std::result::Result<(), InstallationError> {
    // If the program is empty, don't install the filter.
    if bpf_filter.is_empty() {
        return Ok(());
    }
    // If the program length is greater than the limit allowed by the kernel,
    // fail quickly. Otherwise, `prctl` will give a more cryptic error code.
    if bpf_filter.len() > BPF_MAX_LEN {
        return Err(InstallationError::FilterTooLarge);
    }
    unsafe {
        {
            let rc = libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
            if rc != 0 {
                return Err(InstallationError::Prctl(*libc::__errno_location()));
            }
        }
        let bpf_prog = sock_fprog {
            len: bpf_filter.len() as u16,
            filter: bpf_filter.as_ptr(),
        };
        let bpf_prog_ptr = &bpf_prog as *const sock_fprog;
        {
            let rc = libc::prctl(
                libc::PR_SET_SECCOMP,
                libc::SECCOMP_MODE_FILTER,
                bpf_prog_ptr,
            );
            if rc != 0 {
                return Err(InstallationError::Prctl(*libc::__errno_location()));
            }
        }
    }
    Ok(())
}
pub fn apply_filter ( bpf_filter : BpfProgramRef ) -> std :: result :: Result < ( ) , InstallationError > { // If the program is empty, don't install the filter. if bpf_filter . is_empty ( ) { return Ok ( ( ) ) ; } // If the program length is greater than the limit allowed by the kernel, // fail quickly. Otherwise, `prctl` will give a more cryptic error code. if bpf_filter . len ( ) > BPF_MAX_LEN { return Err ( InstallationError :: FilterTooLarge ) ; } unsafe { { let rc = libc :: prctl ( libc :: PR_SET_NO_NEW_PRIVS , 1 , 0 , 0 , 0 ) ; if rc != 0 { return Err ( InstallationError :: Prctl ( * libc :: __errno_location ( ) ) ) ; } } let bpf_prog = sock_fprog { len : bpf_filter . len ( ) as u16 , filter : bpf_filter . as_ptr ( ) , } ; let bpf_prog_ptr = & bpf_prog as * const sock_fprog ; { let rc = libc :: prctl ( libc :: PR_SET_SECCOMP , libc :: SECCOMP_MODE_FILTER , bpf_prog_ptr , ) ; if rc != 0 { return Err ( InstallationError :: Prctl ( * libc :: __errno_location ( ) ) ) ; } } } Ok ( ( ) ) }
Helper function for installing a BPF filter.
Helper function for installing a BPF filter .
bpf_filter
BpfProgramRef
bpf_filter
BpfProgramRef