Adding upstream version 2.5.5.upstream/2.5.5upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 733 insertions, 0 deletions

diff --git a/src/api.c b/src/api.c
new file mode 100644
index 0000000..5cec088
--- /dev/null
+++ b/src/api.c
@@ -0,0 +1,733 @@
+/**
+ * Seccomp Library API
+ *
+ * Copyright (c) 2012,2013 Red Hat <pmoore@redhat.com>
+ * Author: Paul Moore <paul@paul-moore.com>
+ */
+
+/*
+ * This library is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; if not, see <http://www.gnu.org/licenses>.
+ */
+
+#include <endian.h>
+#include <errno.h>
+#include <inttypes.h>
+#include <unistd.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include <sys/ioctl.h>
+
+#include <seccomp.h>
+
+#include "arch.h"
+#include "db.h"
+#include "gen_pfc.h"
+#include "gen_bpf.h"
+#include "helper.h"
+#include "system.h"
+
+#define API	__attribute__((visibility("default")))
+
+const struct scmp_version library_version = {
+	.major = SCMP_VER_MAJOR,
+	.minor = SCMP_VER_MINOR,
+	.micro = SCMP_VER_MICRO,
+};
+
+unsigned int seccomp_api_level = 0;
+
+/**
+ * Filter the error codes we send back to callers
+ * @param err the error code
+ *
+ * We consider error codes part of our API so we want to make sure we don't
+ * accidentally send an undocumented error code to our callers.  This function
+ * helps with that.
+ *
+ */
+static int _rc_filter(int err)
+{
+	/* pass through success values */
+	if (err >= 0)
+		return err;
+
+	/* filter the error codes */
+	switch (err) {
+	case -EACCES:
+	/* NOTE: operation is not permitted by libseccomp */
+	case -ECANCELED:
+	/* NOTE: kernel level error that is beyond the control of
+	 *       libseccomp */
+	case -EDOM:
+	/* NOTE: failure due to arch/ABI */
+	case -EEXIST:
+	/* NOTE: operation failed due to existing rule or filter */
+	case -EINVAL:
+	/* NOTE: invalid input to the libseccomp API */
+	case -ENOENT:
+	/* NOTE: no matching entry found */
+	case -ENOMEM:
+	/* NOTE: unable to allocate enough memory to perform the
+	 *       requested operation */
+	case -EOPNOTSUPP:
+	/* NOTE: operation is not supported */
+	case -ESRCH:
+		/* NOTE: operation failed due to multi-threading */
+		return err;
+	default:
+		/* NOTE: this is the default "internal libseccomp error"
+		 *       error code, it is our catch-all */
+		return -EFAULT;
+	}
+}
+
+/**
+ * Filter the system error codes we send back to callers
+ * @param col the filter collection
+ * @param err the error code
+ *
+ * This is similar to _rc_filter(), but it first checks the filter attribute
+ * to determine if we should be filtering the return codes.
+ *
+ */
+static int _rc_filter_sys(struct db_filter_col *col, int err)
+{
+	/* pass through success values */
+	if (err >= 0)
+		return err;
+
+	/* pass the return code if the SCMP_FLTATR_API_SYSRAWRC is true */
+	if (db_col_attr_read(col, SCMP_FLTATR_API_SYSRAWRC))
+		return err;
+	return -ECANCELED;
+}
+
+/**
+ * Validate a filter context
+ * @param ctx the filter context
+ *
+ * Attempt to validate the provided filter context.  Returns zero if the
+ * context is valid, negative values on failure.
+ *
+ */
+static int _ctx_valid(const scmp_filter_ctx *ctx)
+{
+	return db_col_valid((struct db_filter_col *)ctx);
+}
+
+/**
+ * Validate a syscall number
+ * @param syscall the syscall number
+ *
+ * Attempt to perform basic syscall number validation.  Returns zero of the
+ * syscall appears valid, negative values on failure.
+ *
+ */
+static int _syscall_valid(const struct db_filter_col *col, int syscall)
+{
+	/* syscall -1 is used by tracers to skip the syscall */
+	if (col->attr.api_tskip && syscall == -1)
+		return 0;
+	if (syscall <= -1 && syscall >= -99)
+		return -EINVAL;
+	return 0;
+}
+
+/**
+ * Update the API level
+ *
+ * This function performs a series of tests to determine what functionality is
+ * supported given the current running environment (kernel, etc.).  It is
+ * important to note that this function only does meaningful checks the first
+ * time it is run, the resulting API level is cached after this first run and
+ * used for all subsequent calls.  The API level value is returned.
+ *
+ */
+static unsigned int _seccomp_api_update(void)
+{
+	unsigned int level = 1;
+
+	/* if seccomp_api_level > 0 then it's already been set, we're done */
+	if (seccomp_api_level >= 1)
+		return seccomp_api_level;
+
+	/* NOTE: level 1 is the base level, start checking at 2 */
+
+	if (sys_chk_seccomp_syscall() &&
+	    sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC) == 1)
+		level = 2;
+
+	if (level == 2 &&
+	    sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_LOG) == 1 &&
+	    sys_chk_seccomp_action(SCMP_ACT_LOG) == 1 &&
+	    sys_chk_seccomp_action(SCMP_ACT_KILL_PROCESS) == 1)
+		level = 3;
+
+	if (level == 3 &&
+	    sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 1)
+		level = 4;
+
+	if (level == 4 &&
+	    sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_NEW_LISTENER) == 1 &&
+	    sys_chk_seccomp_action(SCMP_ACT_NOTIFY) == 1)
+		level = 5;
+
+	if (level == 5 &&
+	    sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC_ESRCH) == 1)
+		level = 6;
+
+	/* update the stored api level and return */
+	seccomp_api_level = level;
+	return seccomp_api_level;
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API const struct scmp_version *seccomp_version(void)
+{
+	return &library_version;
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API unsigned int seccomp_api_get(void)
+{
+	/* update the api level, if needed */
+	return _seccomp_api_update();
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_api_set(unsigned int level)
+{
+	switch (level) {
+	case 1:
+		sys_set_seccomp_syscall(false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_LOG, false);
+		sys_set_seccomp_action(SCMP_ACT_LOG, false);
+		sys_set_seccomp_action(SCMP_ACT_KILL_PROCESS, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_NEW_LISTENER, false);
+		sys_set_seccomp_action(SCMP_ACT_NOTIFY, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC_ESRCH, false);
+		break;
+	case 2:
+		sys_set_seccomp_syscall(true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_LOG, false);
+		sys_set_seccomp_action(SCMP_ACT_LOG, false);
+		sys_set_seccomp_action(SCMP_ACT_KILL_PROCESS, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_NEW_LISTENER, false);
+		sys_set_seccomp_action(SCMP_ACT_NOTIFY, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC_ESRCH, false);
+		break;
+	case 3:
+		sys_set_seccomp_syscall(true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_LOG, true);
+		sys_set_seccomp_action(SCMP_ACT_LOG, true);
+		sys_set_seccomp_action(SCMP_ACT_KILL_PROCESS, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_NEW_LISTENER, false);
+		sys_set_seccomp_action(SCMP_ACT_NOTIFY, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC_ESRCH, false);
+		break;
+	case 4:
+		sys_set_seccomp_syscall(true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_LOG, true);
+		sys_set_seccomp_action(SCMP_ACT_LOG, true);
+		sys_set_seccomp_action(SCMP_ACT_KILL_PROCESS, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_NEW_LISTENER, false);
+		sys_set_seccomp_action(SCMP_ACT_NOTIFY, false);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC_ESRCH, false);
+		break;
+	case 5:
+		sys_set_seccomp_syscall(true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_LOG, true);
+		sys_set_seccomp_action(SCMP_ACT_LOG, true);
+		sys_set_seccomp_action(SCMP_ACT_KILL_PROCESS, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_NEW_LISTENER, true);
+		sys_set_seccomp_action(SCMP_ACT_NOTIFY, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC_ESRCH, false);
+		break;
+	case 6:
+		sys_set_seccomp_syscall(true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_LOG, true);
+		sys_set_seccomp_action(SCMP_ACT_LOG, true);
+		sys_set_seccomp_action(SCMP_ACT_KILL_PROCESS, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_SPEC_ALLOW, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_NEW_LISTENER, true);
+		sys_set_seccomp_action(SCMP_ACT_NOTIFY, true);
+		sys_set_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC_ESRCH, true);
+		break;
+	default:
+		return _rc_filter(-EINVAL);
+	}
+
+	seccomp_api_level = level;
+	return _rc_filter(0);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API scmp_filter_ctx seccomp_init(uint32_t def_action)
+{
+	/* force a runtime api level detection */
+	_seccomp_api_update();
+
+	if (db_col_action_valid(NULL, def_action) < 0)
+		return NULL;
+
+	return db_col_init(def_action);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_reset(scmp_filter_ctx ctx, uint32_t def_action)
+{
+	struct db_filter_col *col = (struct db_filter_col *)ctx;
+
+	/* a NULL filter context indicates we are resetting the global state */
+	if (ctx == NULL) {
+		/* reset the global state and redetermine the api level */
+		sys_reset_state();
+		_seccomp_api_update();
+		return _rc_filter(0);
+	}
+	/* ensure the default action is valid */
+	if (db_col_action_valid(NULL, def_action) < 0)
+		return _rc_filter(-EINVAL);
+
+	/* reset the filter */
+	return _rc_filter(db_col_reset(col, def_action));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API void seccomp_release(scmp_filter_ctx ctx)
+{
+	db_col_release((struct db_filter_col *)ctx);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_merge(scmp_filter_ctx ctx_dst, scmp_filter_ctx ctx_src)
+{
+	struct db_filter_col *col_dst = (struct db_filter_col *)ctx_dst;
+	struct db_filter_col *col_src = (struct db_filter_col *)ctx_src;
+
+	if (db_col_valid(col_dst) || db_col_valid(col_src))
+		return _rc_filter(-EINVAL);
+
+	/* NOTE: only the default action, NNP, and TSYNC settings must match */
+	if ((col_dst->attr.act_default != col_src->attr.act_default) ||
+	    (col_dst->attr.nnp_enable != col_src->attr.nnp_enable) ||
+	    (col_dst->attr.tsync_enable != col_src->attr.tsync_enable))
+		return _rc_filter(-EINVAL);
+
+	return _rc_filter(db_col_merge(col_dst, col_src));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API uint32_t seccomp_arch_resolve_name(const char *arch_name)
+{
+	const struct arch_def *arch;
+
+	if (arch_name == NULL)
+		return 0;
+
+	arch = arch_def_lookup_name(arch_name);
+	if (arch == NULL)
+		return 0;
+
+	return arch->token;
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API uint32_t seccomp_arch_native(void)
+{
+	return arch_def_native->token;
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_arch_exist(const scmp_filter_ctx ctx, uint32_t arch_token)
+{
+	struct db_filter_col *col = (struct db_filter_col *)ctx;
+
+	if (arch_token == 0)
+		arch_token = arch_def_native->token;
+
+	if (arch_valid(arch_token))
+		return _rc_filter(-EINVAL);
+
+	return _rc_filter((db_col_arch_exist(col, arch_token) ? 0 : -EEXIST));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_arch_add(scmp_filter_ctx ctx, uint32_t arch_token)
+{
+	const struct arch_def *arch;
+	struct db_filter_col *col = (struct db_filter_col *)ctx;
+
+	if (arch_token == 0)
+		arch_token = arch_def_native->token;
+
+	arch = arch_def_lookup(arch_token);
+	if (arch == NULL)
+		return _rc_filter(-EINVAL);
+	if (db_col_arch_exist(col, arch_token))
+		return _rc_filter(-EEXIST);
+
+	return _rc_filter(db_col_db_new(col, arch));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_arch_remove(scmp_filter_ctx ctx, uint32_t arch_token)
+{
+	struct db_filter_col *col = (struct db_filter_col *)ctx;
+
+	if (arch_token == 0)
+		arch_token = arch_def_native->token;
+
+	if (arch_valid(arch_token))
+		return _rc_filter(-EINVAL);
+	if (db_col_arch_exist(col, arch_token) != -EEXIST)
+		return _rc_filter(-EEXIST);
+
+	return _rc_filter(db_col_db_remove(col, arch_token));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_load(const scmp_filter_ctx ctx)
+{
+	struct db_filter_col *col;
+	bool rawrc;
+
+	if (_ctx_valid(ctx))
+		return _rc_filter(-EINVAL);
+	col = (struct db_filter_col *)ctx;
+
+	rawrc = db_col_attr_read(col, SCMP_FLTATR_API_SYSRAWRC);
+	return _rc_filter(sys_filter_load(col, rawrc));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_attr_get(const scmp_filter_ctx ctx,
+			 enum scmp_filter_attr attr, uint32_t *value)
+{
+	if (_ctx_valid(ctx))
+		return _rc_filter(-EINVAL);
+
+	return _rc_filter(db_col_attr_get((const struct db_filter_col *)ctx,
+					  attr, value));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_attr_set(scmp_filter_ctx ctx,
+			 enum scmp_filter_attr attr, uint32_t value)
+{
+	if (_ctx_valid(ctx))
+		return _rc_filter(-EINVAL);
+
+	return _rc_filter(db_col_attr_set((struct db_filter_col *)ctx,
+					  attr, value));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API char *seccomp_syscall_resolve_num_arch(uint32_t arch_token, int num)
+{
+	const struct arch_def *arch;
+	const char *name;
+
+	if (arch_token == 0)
+		arch_token = arch_def_native->token;
+	if (arch_valid(arch_token))
+		return NULL;
+	arch = arch_def_lookup(arch_token);
+	if (arch == NULL)
+		return NULL;
+
+	name = arch_syscall_resolve_num(arch, num);
+	if (name == NULL)
+		return NULL;
+
+	return strdup(name);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_syscall_resolve_name_arch(uint32_t arch_token, const char *name)
+{
+	const struct arch_def *arch;
+
+	if (name == NULL)
+		return __NR_SCMP_ERROR;
+
+	if (arch_token == 0)
+		arch_token = arch_def_native->token;
+	if (arch_valid(arch_token))
+		return __NR_SCMP_ERROR;
+	arch = arch_def_lookup(arch_token);
+	if (arch == NULL)
+		return __NR_SCMP_ERROR;
+
+	return arch_syscall_resolve_name(arch, name);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_syscall_resolve_name_rewrite(uint32_t arch_token,
+					     const char *name)
+{
+	int rc;
+	int syscall;
+	const struct arch_def *arch;
+
+	if (name == NULL)
+		return __NR_SCMP_ERROR;
+
+	if (arch_token == 0)
+		arch_token = arch_def_native->token;
+	if (arch_valid(arch_token))
+		return __NR_SCMP_ERROR;
+	arch = arch_def_lookup(arch_token);
+	if (arch == NULL)
+		return __NR_SCMP_ERROR;
+
+	syscall = arch_syscall_resolve_name(arch, name);
+	if (syscall == __NR_SCMP_ERROR)
+		return __NR_SCMP_ERROR;
+	rc = arch_syscall_rewrite(arch, &syscall);
+	if (rc == -EDOM)
+		/* if we can't rewrite the syscall, just pass it through */
+		return syscall;
+	else if (rc < 0)
+		return __NR_SCMP_ERROR;
+
+	return syscall;
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_syscall_resolve_name(const char *name)
+{
+	return seccomp_syscall_resolve_name_arch(SCMP_ARCH_NATIVE, name);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_syscall_priority(scmp_filter_ctx ctx,
+				 int syscall, uint8_t priority)
+{
+	struct db_filter_col *col = (struct db_filter_col *)ctx;
+
+	if (db_col_valid(col) || _syscall_valid(col, syscall))
+		return _rc_filter(-EINVAL);
+
+	return _rc_filter(db_col_syscall_priority(col, syscall, priority));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_rule_add_array(scmp_filter_ctx ctx,
+			       uint32_t action, int syscall,
+			       unsigned int arg_cnt,
+			       const struct scmp_arg_cmp *arg_array)
+{
+	int rc;
+	struct db_filter_col *col = (struct db_filter_col *)ctx;
+
+	if (arg_cnt > ARG_COUNT_MAX)
+		return _rc_filter(-EINVAL);
+	if (arg_cnt > 0 && arg_array == NULL)
+		return _rc_filter(-EINVAL);
+
+	if (db_col_valid(col) || _syscall_valid(col, syscall))
+		return _rc_filter(-EINVAL);
+
+	rc = db_col_action_valid(col, action);
+	if (rc < 0)
+		return _rc_filter(rc);
+	if (action == col->attr.act_default)
+		return _rc_filter(-EACCES);
+
+	return _rc_filter(db_col_rule_add(col, 0, action,
+					  syscall, arg_cnt, arg_array));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_rule_add(scmp_filter_ctx ctx,
+			 uint32_t action, int syscall,
+			 unsigned int arg_cnt, ...)
+{
+	int rc;
+	int iter;
+	struct scmp_arg_cmp arg_array[ARG_COUNT_MAX];
+	va_list arg_list;
+
+	/* arg_cnt is unsigned, so no need to check the lower bound */
+	if (arg_cnt > ARG_COUNT_MAX)
+		return _rc_filter(-EINVAL);
+
+	va_start(arg_list, arg_cnt);
+	for (iter = 0; iter < arg_cnt; ++iter)
+		arg_array[iter] = va_arg(arg_list, struct scmp_arg_cmp);
+	rc = seccomp_rule_add_array(ctx, action, syscall, arg_cnt, arg_array);
+	va_end(arg_list);
+
+	return _rc_filter(rc);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_rule_add_exact_array(scmp_filter_ctx ctx,
+				     uint32_t action, int syscall,
+				     unsigned int arg_cnt,
+				     const struct scmp_arg_cmp *arg_array)
+{
+	int rc;
+	struct db_filter_col *col = (struct db_filter_col *)ctx;
+
+	if (arg_cnt > ARG_COUNT_MAX)
+		return _rc_filter(-EINVAL);
+	if (arg_cnt > 0 && arg_array == NULL)
+		return _rc_filter(-EINVAL);
+
+	if (db_col_valid(col) || _syscall_valid(col, syscall))
+		return _rc_filter(-EINVAL);
+
+	rc = db_col_action_valid(col, action);
+	if (rc < 0)
+		return _rc_filter(rc);
+	if (action == col->attr.act_default)
+		return _rc_filter(-EACCES);
+
+	if (col->filter_cnt > 1)
+		return _rc_filter(-EOPNOTSUPP);
+
+	return _rc_filter(db_col_rule_add(col, 1, action,
+					  syscall, arg_cnt, arg_array));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_rule_add_exact(scmp_filter_ctx ctx,
+			       uint32_t action, int syscall,
+			       unsigned int arg_cnt, ...)
+{
+	int rc;
+	int iter;
+	struct scmp_arg_cmp arg_array[ARG_COUNT_MAX];
+	va_list arg_list;
+
+	/* arg_cnt is unsigned, so no need to check the lower bound */
+	if (arg_cnt > ARG_COUNT_MAX)
+		return _rc_filter(-EINVAL);
+
+	va_start(arg_list, arg_cnt);
+	for (iter = 0; iter < arg_cnt; ++iter)
+		arg_array[iter] = va_arg(arg_list, struct scmp_arg_cmp);
+	rc = seccomp_rule_add_exact_array(ctx,
+					  action, syscall, arg_cnt, arg_array);
+	va_end(arg_list);
+
+	return _rc_filter(rc);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_notify_alloc(struct seccomp_notif **req,
+			     struct seccomp_notif_resp **resp)
+{
+	/* force a runtime api level detection */
+	_seccomp_api_update();
+
+	return _rc_filter(sys_notify_alloc(req, resp));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API void seccomp_notify_free(struct seccomp_notif *req,
+			     struct seccomp_notif_resp *resp)
+{
+	if (req)
+		free(req);
+	if (resp)
+		free(resp);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_notify_receive(int fd, struct seccomp_notif *req)
+{
+	return _rc_filter(sys_notify_receive(fd, req));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_notify_respond(int fd, struct seccomp_notif_resp *resp)
+{
+	return _rc_filter(sys_notify_respond(fd, resp));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_notify_id_valid(int fd, uint64_t id)
+{
+	/* force a runtime api level detection */
+	_seccomp_api_update();
+
+	return _rc_filter(sys_notify_id_valid(fd, id));
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_notify_fd(const scmp_filter_ctx ctx)
+{
+	/* NOTE: for historical reasons, and possibly future use, we require a
+	 * valid filter context even though we don't actual use it here; the
+	 * api update is also not strictly necessary, but keep it for now */
+
+	/* force a runtime api level detection */
+	_seccomp_api_update();
+
+	if (_ctx_valid(ctx))
+		return _rc_filter(-EINVAL);
+
+	return _rc_filter(sys_notify_fd());
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_export_pfc(const scmp_filter_ctx ctx, int fd)
+{
+	int rc;
+	struct db_filter_col *col;
+
+	if (_ctx_valid(ctx))
+		return _rc_filter(-EINVAL);
+	col = (struct db_filter_col *)ctx;
+
+	rc = gen_pfc_generate(col, fd);
+	return _rc_filter_sys(col, rc);
+}
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_export_bpf(const scmp_filter_ctx ctx, int fd)
+{
+	int rc;
+	struct db_filter_col *col;
+	struct bpf_program *program;
+
+	if (_ctx_valid(ctx))
+		return _rc_filter(-EINVAL);
+	col = (struct db_filter_col *)ctx;
+
+	rc = gen_bpf_generate(col, &program);
+	if (rc < 0)
+		return _rc_filter(rc);
+	rc = write(fd, program->blks, BPF_PGM_SIZE(program));
+	gen_bpf_release(program);
+	if (rc < 0)
+		return _rc_filter_sys(col, -errno);
+
+	return 0;
+}