seccomp system call priority values 65535

Question

I've read that priority can be a value between 0 and 255 (http://man7.org/linux/man-pages/man3/seccomp_syscall_priority.3.html). Why using seccomp_export_pfc the baseline priority is 65535???

 # filter for syscall "exit_group" (231) [priority: 65535]
  if ($syscall == 231)
    action ALLOW;
  # filter for syscall "exit" (60) [priority: 65535]
  if ($syscall == 60)
    action ALLOW;

Could you post the code you used to create this seccomp filter? — pchaigno, Aug 13 '19 at 16:20

pchaigno · Accepted Answer · 2019-08-14T08:20:55.937

1

They are two different things: with seccomp_syscall_priority, you provide a priority hint, whereas seccomp_export_pfc outputs libseccomp's internal priority.

As explained in the source code comments, the internal priority contains your priority hint, if any, as the first 16 bits. The last 16 bits are useful is case of tie (i.e., two filters have the same upper 16 bits), in which case libseccomp gives higher priority to filters that are easier to evaluate.

So, in your case, since you did not provide any hint, the internal priority is equal to 0x0000FFFF, or 65535.

edited Aug 14 '19 at 08:20

answered Aug 13 '19 at 16:33

pchaigno

11,313
2
29
54

Thanks, what does "in case of tie" mean? – Maicake Aug 14 '19 at 08:16
In case two filters have the same priority hint. I'll edit the post for clarity. – pchaigno Aug 14 '19 at 08:20
So anyway in the computation of the priority it's also subtracted the number of nodes (does this mean how many "branches" has the filter?) – Maicake Aug 14 '19 at 08:26
If I understand correctly libseccomp's code, they represent filters internally as graphs before generating the bytecode. So the number of nodes would be the number of code blocks in the control flow graph of your program. It's just one way to measure the complexity of a piece of code. – pchaigno Aug 17 '19 at 09:44

seccomp system call priority values 65535

1 Answers1