Adding upstream version 2.5.5.upstream/2.5.5upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1048 insertions, 0 deletions

diff --git a/src/python/seccomp.pyx b/src/python/seccomp.pyx
new file mode 100644
index 0000000..2eeabc1
--- /dev/null
+++ b/src/python/seccomp.pyx
@@ -0,0 +1,1048 @@
+#
+# Seccomp Library Python Bindings
+#
+# Copyright (c) 2012,2013,2017 Red Hat <pmoore@redhat.com>
+# Author: Paul Moore <paul@paul-moore.com>
+#
+
+#
+# This library is free software; you can redistribute it and/or modify it
+# under the terms of version 2.1 of the GNU Lesser General Public License as
+# published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+# for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library; if not, see <http://www.gnu.org/licenses>.
+#
+
+# cython: language_level = 3str
+
+""" Python bindings for the libseccomp library
+
+The libseccomp library provides and easy to use, platform independent,
+interface to the Linux Kernel's syscall filtering mechanism: seccomp.  The
+libseccomp API is designed to abstract away the underlying BPF based
+syscall filter language and present a more conventional function-call
+based filtering interface that should be familiar to, and easily adopted
+by application developers.
+
+Filter action values:
+    KILL_PROCESS - kill the process
+    KILL - kill the thread
+    LOG - allow the syscall to be executed after the action has been logged
+    ALLOW - allow the syscall to execute
+    TRAP - a SIGSYS signal will be thrown
+    NOTIFY - a notification event will be sent via the notification API
+    ERRNO(x) - syscall will return (x)
+    TRACE(x) - if the process is being traced, (x) will be returned to the
+               tracing process via PTRACE_EVENT_SECCOMP and the
+               PTRACE_GETEVENTMSG option
+
+Argument comparison values (see the Arg class):
+
+    NE - arg != datum_a
+    LT - arg < datum_a
+    LE - arg <= datum_a
+    EQ - arg == datum_a
+    GT - arg > datum_a
+    GE - arg >= datum_a
+    MASKED_EQ - (arg & datum_a) == datum_b
+
+
+Example:
+
+    import sys
+    from seccomp import *
+
+    # create a filter object with a default KILL action
+    f = SyscallFilter(defaction=KILL)
+
+    # add some basic syscalls which python typically wants
+    f.add_rule(ALLOW, "rt_sigaction")
+    f.add_rule(ALLOW, "rt_sigreturn")
+    f.add_rule(ALLOW, "exit_group")
+    f.add_rule(ALLOW, "brk")
+
+    # add syscall filter rules to allow certain syscalls
+    f.add_rule(ALLOW, "open")
+    f.add_rule(ALLOW, "close")
+    f.add_rule(ALLOW, "read", Arg(0, EQ, sys.stdin.fileno()))
+    f.add_rule(ALLOW, "write", Arg(0, EQ, sys.stdout.fileno()))
+    f.add_rule(ALLOW, "write", Arg(0, EQ, sys.stderr.fileno()))
+
+    # load the filter into the kernel
+    f.load()
+"""
+__author__ =  'Paul Moore <paul@paul-moore.com>'
+__date__ = "3 February 2017"
+
+from cpython.version cimport PY_MAJOR_VERSION
+from libc.stdint cimport int8_t, int16_t, int32_t, int64_t
+from libc.stdint cimport uint8_t, uint16_t, uint32_t, uint64_t
+from libc.stdlib cimport free
+import errno
+
+cimport libseccomp
+
+def c_str(string):
+    """ Convert a Python string to a C string.
+
+    Arguments:
+    string - the Python string
+
+    Description:
+    Convert the Python string into a form usable by C taking into consideration
+    the Python major version, e.g. Python 2.x or Python 3.x.
+    See http://docs.cython.org/en/latest/src/tutorial/strings.html for more
+    information.
+    """
+    if PY_MAJOR_VERSION < 3:
+        return string
+    else:
+        return bytes(string, "ascii")
+
+KILL_PROCESS = libseccomp.SCMP_ACT_KILL_PROCESS
+KILL = libseccomp.SCMP_ACT_KILL
+TRAP = libseccomp.SCMP_ACT_TRAP
+LOG = libseccomp.SCMP_ACT_LOG
+ALLOW = libseccomp.SCMP_ACT_ALLOW
+NOTIFY = libseccomp.SCMP_ACT_NOTIFY
+def ERRNO(int errno):
+    """The action ERRNO(x) means that the syscall will return (x).
+    To conform to Linux syscall calling conventions, the syscall return
+    value should almost always be a negative number.
+    """
+    return libseccomp.SCMP_ACT_ERRNO(errno)
+def TRACE(int value):
+    """The action TRACE(x) means that, if the process is being traced, (x)
+    will be returned to the tracing process via PTRACE_EVENT_SECCOMP
+    and the PTRACE_GETEVENTMSG option.
+    """
+    return libseccomp.SCMP_ACT_TRACE(value)
+
+NE = libseccomp.SCMP_CMP_NE
+LT = libseccomp.SCMP_CMP_LT
+LE = libseccomp.SCMP_CMP_LE
+EQ = libseccomp.SCMP_CMP_EQ
+GE = libseccomp.SCMP_CMP_GE
+GT = libseccomp.SCMP_CMP_GT
+MASKED_EQ = libseccomp.SCMP_CMP_MASKED_EQ
+
+def system_arch():
+    """ Return the system architecture value.
+
+    Description:
+    Returns the native system architecture value.
+    """
+    return libseccomp.seccomp_arch_native()
+
+def resolve_syscall(arch, syscall):
+    """ Resolve the syscall.
+
+    Arguments:
+    arch - the architecture value, e.g. Arch.*
+    syscall - the syscall name or number
+
+    Description:
+    Resolve an architecture's syscall name to the correct number or the
+    syscall number to the correct name.
+    """
+    cdef char *ret_str
+
+    if isinstance(syscall, basestring):
+        return libseccomp.seccomp_syscall_resolve_name_rewrite(arch,
+                                                               c_str(syscall))
+    elif isinstance(syscall, int):
+        ret_str = libseccomp.seccomp_syscall_resolve_num_arch(arch, syscall)
+        if ret_str is NULL:
+            raise ValueError('Unknown syscall %d on arch %d' % (syscall, arch))
+        else:
+            return ret_str
+    else:
+        raise TypeError("Syscall must either be an int or str type")
+
+def get_api():
+    """ Query the level of API support
+
+    Description:
+    Returns the API level value indicating the current supported
+    functionality.
+    """
+    level = libseccomp.seccomp_api_get()
+    if level < 0:
+        raise RuntimeError(str.format("Library error (errno = {0})", level))
+
+    return level
+
+def set_api(unsigned int level):
+    """ Set the level of API support
+
+    Arguments:
+    level - the API level
+
+    Description:
+    This function forcibly sets the API level at runtime.  General use
+    of this function is strongly discouraged.
+    """
+    rc = libseccomp.seccomp_api_set(level)
+    if rc == -errno.EINVAL:
+        raise ValueError("Invalid level")
+    elif rc != 0:
+        raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+cdef class Arch:
+    """ Python object representing the SyscallFilter architecture values.
+
+    Data values:
+    NATIVE - the native architecture
+    X86 - 32-bit x86
+    X86_64 - 64-bit x86
+    X32 - 64-bit x86 using the x32 ABI
+    ARM - ARM
+    AARCH64 - 64-bit ARM
+    MIPS - MIPS O32 ABI
+    MIPS64 - MIPS 64-bit ABI
+    MIPS64N32 - MIPS N32 ABI
+    MIPSEL - MIPS little endian O32 ABI
+    MIPSEL64 - MIPS little endian 64-bit ABI
+    MIPSEL64N32 - MIPS little endian N32 ABI
+    PARISC - 32-bit PA-RISC
+    PARISC64 - 64-bit PA-RISC
+    PPC64 - 64-bit PowerPC
+    PPC - 32-bit PowerPC
+    RISCV64 - 64-bit RISC-V
+    """
+
+    cdef int _token
+
+    NATIVE = libseccomp.SCMP_ARCH_NATIVE
+    X86 = libseccomp.SCMP_ARCH_X86
+    X86_64 = libseccomp.SCMP_ARCH_X86_64
+    X32 = libseccomp.SCMP_ARCH_X32
+    ARM = libseccomp.SCMP_ARCH_ARM
+    AARCH64 = libseccomp.SCMP_ARCH_AARCH64
+    MIPS = libseccomp.SCMP_ARCH_MIPS
+    MIPS64 = libseccomp.SCMP_ARCH_MIPS64
+    MIPS64N32 = libseccomp.SCMP_ARCH_MIPS64N32
+    MIPSEL = libseccomp.SCMP_ARCH_MIPSEL
+    MIPSEL64 = libseccomp.SCMP_ARCH_MIPSEL64
+    MIPSEL64N32 = libseccomp.SCMP_ARCH_MIPSEL64N32
+    PARISC = libseccomp.SCMP_ARCH_PARISC
+    PARISC64 = libseccomp.SCMP_ARCH_PARISC64
+    PPC = libseccomp.SCMP_ARCH_PPC
+    PPC64 = libseccomp.SCMP_ARCH_PPC64
+    PPC64LE = libseccomp.SCMP_ARCH_PPC64LE
+    S390 = libseccomp.SCMP_ARCH_S390
+    S390X = libseccomp.SCMP_ARCH_S390X
+    RISCV64 = libseccomp.SCMP_ARCH_RISCV64
+
+    def __cinit__(self, arch=libseccomp.SCMP_ARCH_NATIVE):
+        """ Initialize the architecture object.
+
+        Arguments:
+        arch - the architecture name or token value
+
+        Description:
+        Create an architecture object using the given name or token value.
+        """
+        if isinstance(arch, int):
+            if arch == libseccomp.SCMP_ARCH_NATIVE:
+                self._token = libseccomp.seccomp_arch_native()
+            elif arch == libseccomp.SCMP_ARCH_X86:
+                self._token = libseccomp.SCMP_ARCH_X86
+            elif arch == libseccomp.SCMP_ARCH_X86_64:
+                self._token = libseccomp.SCMP_ARCH_X86_64
+            elif arch == libseccomp.SCMP_ARCH_X32:
+                self._token = libseccomp.SCMP_ARCH_X32
+            elif arch == libseccomp.SCMP_ARCH_ARM:
+                self._token = libseccomp.SCMP_ARCH_ARM
+            elif arch == libseccomp.SCMP_ARCH_AARCH64:
+                self._token = libseccomp.SCMP_ARCH_AARCH64
+            elif arch == libseccomp.SCMP_ARCH_MIPS:
+                self._token = libseccomp.SCMP_ARCH_MIPS
+            elif arch == libseccomp.SCMP_ARCH_MIPS64:
+                self._token = libseccomp.SCMP_ARCH_MIPS64
+            elif arch == libseccomp.SCMP_ARCH_MIPS64N32:
+                self._token = libseccomp.SCMP_ARCH_MIPS64N32
+            elif arch == libseccomp.SCMP_ARCH_MIPSEL:
+                self._token = libseccomp.SCMP_ARCH_MIPSEL
+            elif arch == libseccomp.SCMP_ARCH_MIPSEL64:
+                self._token = libseccomp.SCMP_ARCH_MIPSEL64
+            elif arch == libseccomp.SCMP_ARCH_MIPSEL64N32:
+                self._token = libseccomp.SCMP_ARCH_MIPSEL64N32
+            elif arch == libseccomp.SCMP_ARCH_PARISC:
+                self._token = libseccomp.SCMP_ARCH_PARISC
+            elif arch == libseccomp.SCMP_ARCH_PARISC64:
+                self._token = libseccomp.SCMP_ARCH_PARISC64
+            elif arch == libseccomp.SCMP_ARCH_PPC:
+                self._token = libseccomp.SCMP_ARCH_PPC
+            elif arch == libseccomp.SCMP_ARCH_PPC64:
+                self._token = libseccomp.SCMP_ARCH_PPC64
+            elif arch == libseccomp.SCMP_ARCH_PPC64LE:
+                self._token = libseccomp.SCMP_ARCH_PPC64LE
+            elif arch == libseccomp.SCMP_ARCH_S390:
+                self._token = libseccomp.SCMP_ARCH_S390
+            elif arch == libseccomp.SCMP_ARCH_S390X:
+                self._token = libseccomp.SCMP_ARCH_S390X
+            else:
+                self._token = 0;
+        elif isinstance(arch, basestring):
+            self._token = libseccomp.seccomp_arch_resolve_name(c_str(arch))
+        else:
+            raise TypeError("Architecture must be an int or str type")
+        if self._token == 0:
+            raise ValueError("Invalid architecture")
+
+    def __int__(self):
+        """ Convert the architecture object to a token value.
+
+        Description:
+        Convert the architecture object to an integer representing the
+        architecture's token value.
+        """
+        return self._token
+
+cdef class Attr:
+    """ Python object representing the SyscallFilter attributes.
+
+    Data values:
+    ACT_DEFAULT - the filter's default action
+    ACT_BADARCH - the filter's bad architecture action
+    CTL_NNP - the filter's "no new privileges" flag
+    CTL_NNP - the filter's thread sync flag
+    CTL_TSYNC - sync threads on filter load
+    CTL_TSKIP - allow rules with a -1 syscall number
+    CTL_LOG - log not-allowed actions
+    CTL_SSB - disable SSB mitigations
+    CTL_OPTIMIZE - the filter's optimization level:
+                   0: currently unused
+                   1: rules weighted by priority and complexity (DEFAULT)
+                   2: binary tree sorted by syscall number
+    API_SYSRAWRC - return the raw syscall codes
+    """
+    ACT_DEFAULT = libseccomp.SCMP_FLTATR_ACT_DEFAULT
+    ACT_BADARCH = libseccomp.SCMP_FLTATR_ACT_BADARCH
+    CTL_NNP = libseccomp.SCMP_FLTATR_CTL_NNP
+    CTL_TSYNC = libseccomp.SCMP_FLTATR_CTL_TSYNC
+    API_TSKIP = libseccomp.SCMP_FLTATR_API_TSKIP
+    CTL_LOG = libseccomp.SCMP_FLTATR_CTL_LOG
+    CTL_SSB = libseccomp.SCMP_FLTATR_CTL_SSB
+    CTL_OPTIMIZE = libseccomp.SCMP_FLTATR_CTL_OPTIMIZE
+    API_SYSRAWRC = libseccomp.SCMP_FLTATR_API_SYSRAWRC
+
+cdef class Arg:
+    """ Python object representing a SyscallFilter syscall argument.
+    """
+    cdef libseccomp.scmp_arg_cmp _arg
+
+    def __cinit__(self, arg, op, datum_a, datum_b = 0):
+        """ Initialize the argument comparison.
+
+        Arguments:
+        arg - the argument number, starting at 0
+        op - the argument comparison operator, e.g. {NE,LT,LE,...}
+        datum_a - argument value
+        datum_b - argument value, only valid when op == MASKED_EQ
+
+        Description:
+        Create an argument comparison object for use with SyscallFilter.
+        """
+        self._arg.arg = arg
+        self._arg.op = op
+        self._arg.datum_a = datum_a
+        self._arg.datum_b = datum_b
+
+    cdef libseccomp.scmp_arg_cmp to_c(self):
+        """ Convert the object into a C structure.
+
+        Description:
+        Helper function which should only be used internally by
+        SyscallFilter objects and exists for the sole purpose of making it
+        easier to deal with the varadic functions of the libseccomp API,
+        e.g. seccomp_rule_add().
+        """
+        return self._arg
+
+cdef class Notification:
+    """ Python object representing a seccomp notification.
+    """
+    cdef uint64_t _id
+    cdef uint32_t _pid
+    cdef uint32_t _flags
+    cdef int _syscall
+    cdef uint32_t _syscall_arch
+    cdef uint64_t _syscall_ip
+    cdef uint64_t _syscall_args[6]
+
+    def __cinit__(self, id, pid, flags, syscall, arch, ip, args):
+        """ Initialize the notification.
+
+        Arguments:
+        id - the notification ID
+        pid - the process ID
+        flags - the notification flags
+        syscall - the syscall number
+        ip - the instruction pointer
+        args - list of the six syscall arguments
+
+        Description:
+        Create a seccomp Notification object.
+        """
+        self._id = id
+        self._pid = pid
+        self._flags = flags
+        self._syscall = syscall
+        self._syscall_arch = arch
+        self._syscall_ip = ip
+        self._syscall_args[0] = args[0]
+        self._syscall_args[1] = args[1]
+        self._syscall_args[2] = args[2]
+        self._syscall_args[3] = args[3]
+        self._syscall_args[4] = args[4]
+        self._syscall_args[5] = args[5]
+
+    @property
+    def id(self):
+        """ Get the seccomp notification ID.
+
+        Description:
+        Get the seccomp notification ID.
+        """
+        return self._id
+
+    @property
+    def pid(self):
+        """ Get the seccomp notification process ID.
+
+        Description:
+        Get the seccomp notification process ID.
+        """
+        return self._pid
+
+    @property
+    def flags(self):
+        """ Get the seccomp notification flags.
+
+        Description:
+        Get the seccomp notification flags.
+        """
+        return self._flags
+
+    @property
+    def syscall(self):
+        """ Get the seccomp notification syscall.
+
+        Description:
+        Get the seccomp notification syscall.
+        """
+        return self._syscall
+
+    @property
+    def syscall_arch(self):
+        """ Get the seccomp notification syscall architecture.
+
+        Description:
+        Get the seccomp notification syscall architecture.
+        """
+        return self._syscall_arch
+
+    @property
+    def syscall_ip(self):
+        """ Get the seccomp notification syscall instruction pointer.
+
+        Description:
+        Get the seccomp notification syscall instruction pointer.
+        """
+        return self._syscall_ip
+
+    @property
+    def syscall_args(self):
+        """ Get the seccomp notification syscall arguments.
+
+        Description:
+        Get the seccomp notification syscall arguments in a six element list.
+        """
+        return [self._syscall_args[0], self._syscall_args[1],
+                self._syscall_args[2], self._syscall_args[3],
+                self._syscall_args[4], self._syscall_args[5]]
+
+cdef class NotificationResponse:
+    """ Python object representing a seccomp notification response.
+    """
+    cdef uint64_t _id
+    cdef int64_t _val
+    cdef int32_t _error
+    cdef uint32_t _flags
+
+    def __cinit__(self, notify, val = 0, error = 0, flags = 0):
+        """ Initialize the notification response.
+
+        Arguments:
+        notify - a Notification object
+        val - the notification response value
+        error - the notification response error
+        flags - the notification response flags
+
+        Description:
+        Create a seccomp NotificationResponse object.
+        """
+        self._id = notify.id
+        self._val = val
+        self._error = error
+        self._flags = flags
+
+    @property
+    def id(self):
+        """ Get the seccomp notification response ID.
+
+        Description:
+        Get the seccomp notification response ID.
+        """
+        return self._id
+
+    @id.setter
+    def id(self, value):
+        """ Set the seccomp notification response ID.
+
+        Arguments:
+        id - the notification response ID
+
+        Description:
+        Set the seccomp notification response ID.
+        """
+        self._id = value
+
+    @property
+    def val(self):
+        """ Get the seccomp notification response value.
+
+        Description:
+        Get the seccomp notification response value.
+        """
+        return self._val
+
+    @val.setter
+    def val(self, value):
+        """ Set the seccomp notification response value.
+
+        Arguments:
+        val - the notification response value
+
+        Description:
+        Set the seccomp notification response value.
+        """
+        self._val = value
+
+    @property
+    def error(self):
+        """ Get the seccomp notification response error.
+
+        Description:
+        Get the seccomp notification response error.
+        """
+        return self._error
+
+    @error.setter
+    def error(self, value):
+        """ Set the seccomp notification response error.
+
+        Arguments:
+        error - the notification response error
+
+        Description:
+        Set the seccomp notification response error.
+        """
+        self._error = value
+
+    @property
+    def flags(self):
+        """ Get the seccomp notification response flags.
+
+        Description:
+        Get the seccomp notification response flags.
+        """
+        return self._flags
+
+    @flags.setter
+    def flags(self, value):
+        """ Set the seccomp notification response flags.
+
+        Arguments:
+        flags - the notification response flags
+
+        Description:
+        Set the seccomp notification response flags.
+        """
+        self._flags = value
+
+cdef class SyscallFilter:
+    """ Python object representing a seccomp syscall filter. """
+    cdef int _defaction
+    cdef libseccomp.scmp_filter_ctx _ctx
+
+    def __cinit__(self, int defaction):
+        self._ctx = libseccomp.seccomp_init(defaction)
+        if self._ctx == NULL:
+            raise RuntimeError("Library error")
+        _defaction = defaction
+
+    def __init__(self, defaction):
+        """ Initialize the filter state
+
+        Arguments:
+        defaction - the default filter action
+
+        Description:
+        Initializes the seccomp filter state to the defaults.
+        """
+
+    def __dealloc__(self):
+        """ Destroys the filter state and releases any resources.
+
+        Description:
+        Destroys the seccomp filter state and releases any resources
+        associated with the filter state.  This function does not affect
+        any seccomp filters already loaded into the kernel.
+        """
+        if self._ctx != NULL:
+            libseccomp.seccomp_release(self._ctx)
+
+    def reset(self, int defaction = -1):
+        """ Reset the filter state.
+
+        Arguments:
+        defaction - the default filter action
+
+        Description:
+        Resets the seccomp filter state to an initial default state, if a
+        default filter action is not specified in the reset call the
+        original action will be reused.  This function does not affect any
+        seccomp filters alread loaded into the kernel.
+        """
+        if defaction == -1:
+            defaction = self._defaction
+        rc = libseccomp.seccomp_reset(self._ctx, defaction)
+        if rc == -errno.EINVAL:
+            raise ValueError("Invalid action")
+        if rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+        _defaction = defaction
+
+    def merge(self, SyscallFilter filter):
+        """ Merge two existing SyscallFilter objects.
+
+        Arguments:
+        filter - a valid SyscallFilter object
+
+        Description:
+        Merges a valid SyscallFilter object with the current SyscallFilter
+        object; the passed filter object will be reset on success.  In
+        order to successfully merge two seccomp filters they must have the
+        same attribute values and not share any of the same architectures.
+        """
+        rc = libseccomp.seccomp_merge(self._ctx, filter._ctx)
+        if rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+        filter._ctx = NULL
+        filter = SyscallFilter(filter._defaction)
+
+    def exist_arch(self, arch):
+        """ Check if the seccomp filter contains a given architecture.
+
+        Arguments:
+        arch - the architecture value, e.g. Arch.*
+
+        Description:
+        Test to see if a given architecture is included in the filter.
+        Return True is the architecture exists, False if it does not
+        exist.
+        """
+        rc = libseccomp.seccomp_arch_exist(self._ctx, arch)
+        if rc == 0:
+            return True
+        elif rc == -errno.EEXIST:
+            return False
+        elif rc == -errno.EINVAL:
+            raise ValueError("Invalid architecture")
+        else:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def add_arch(self, arch):
+        """ Add an architecture to the filter.
+
+        Arguments:
+        arch - the architecture value, e.g. Arch.*
+
+        Description:
+        Add the given architecture to the filter.  Any new rules added
+        after this method returns successfully will be added to this new
+        architecture, but any existing rules will not be added to the new
+        architecture.
+        """
+        rc = libseccomp.seccomp_arch_add(self._ctx, arch)
+        if rc == -errno.EINVAL:
+            raise ValueError("Invalid architecture")
+        elif rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def remove_arch(self, arch):
+        """ Remove an architecture from the filter.
+
+        Arguments:
+        arch - the architecture value, e.g. Arch.*
+
+        Description:
+        Remove the given architecture from the filter.  The filter must
+        always contain at least one architecture, so if only one
+        architecture exists in the filter this method will fail.
+        """
+        rc = libseccomp.seccomp_arch_remove(self._ctx, arch)
+        if rc == -errno.EINVAL:
+            raise ValueError("Invalid architecture")
+        elif rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def load(self):
+        """ Load the filter into the Linux Kernel.
+
+        Description:
+        Load the current filter into the Linux Kernel.  As soon as the
+        method returns the filter will be active and enforcing.
+        """
+        rc = libseccomp.seccomp_load(self._ctx)
+        if rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def get_attr(self, attr):
+        """ Get an attribute value from the filter.
+
+        Arguments:
+        attr - the attribute, e.g. Attr.*
+
+        Description:
+        Lookup the given attribute in the filter and return the
+        attribute's value to the caller.
+        """
+        cdef uint32_t value = 0
+        rc = libseccomp.seccomp_attr_get(self._ctx,
+                                         attr, <uint32_t *>&value)
+        if rc == -errno.EINVAL:
+            raise ValueError("Invalid attribute")
+        elif rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+        return value
+
+    def set_attr(self, attr, int value):
+        """ Set a filter attribute.
+
+        Arguments:
+        attr - the attribute, e.g. Attr.*
+        value - the attribute value
+
+        Description:
+        Lookup the given attribute in the filter and assign it the given
+        value.
+        """
+        rc = libseccomp.seccomp_attr_set(self._ctx, attr, value)
+        if rc == -errno.EINVAL:
+            raise ValueError("Invalid attribute")
+        elif rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def syscall_priority(self, syscall, int priority):
+        """ Set the filter priority of a syscall.
+
+        Arguments:
+        syscall - the syscall name or number
+        priority - the priority of the syscall
+
+        Description:
+        Set the filter priority of the given syscall.  A syscall with a
+        higher priority will have less overhead in the generated filter
+        code which is loaded into the system.  Priority values can range
+        from 0 to 255 inclusive.
+        """
+        if priority < 0 or priority > 255:
+            raise ValueError("Syscall priority must be between 0 and 255")
+        if isinstance(syscall, str):
+            syscall_str = syscall.encode()
+            syscall_num = libseccomp.seccomp_syscall_resolve_name(syscall_str)
+        elif isinstance(syscall, int):
+            syscall_num = syscall
+        else:
+            raise TypeError("Syscall must either be an int or str type")
+        rc = libseccomp.seccomp_syscall_priority(self._ctx,
+                                                 syscall_num, priority)
+        if rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def add_rule(self, int action, syscall, *args):
+        """ Add a new rule to filter.
+
+        Arguments:
+        action - the rule action: KILL_PROCESS, KILL, TRAP, ERRNO(), TRACE(),
+                 LOG, or ALLOW
+        syscall - the syscall name or number
+        args - variable number of Arg objects
+
+        Description:
+        Add a new rule to the filter, matching on the given syscall and an
+        optional list of argument comparisons.  If the rule is triggered
+        the given action will be taken by the kernel.  In order for the
+        rule to trigger, the syscall as well as each argument comparison
+        must be true.
+
+        In the case where the specific rule is not valid on a specific
+        architecture, e.g. socket() on 32-bit x86, this method rewrites
+        the rule to the best possible match.  If you don't want this fule
+        rewriting to take place use add_rule_exactly().
+        """
+        cdef libseccomp.scmp_arg_cmp c_arg[6]
+        if isinstance(syscall, str):
+            syscall_str = syscall.encode()
+            syscall_num = libseccomp.seccomp_syscall_resolve_name(syscall_str)
+        elif isinstance(syscall, int):
+            syscall_num = syscall
+        else:
+            raise TypeError("Syscall must either be an int or str type")
+        """ NOTE: the code below exists solely to deal with the varadic
+        nature of seccomp_rule_add() function and the inability of Cython
+        to handle this automatically """
+        if len(args) > 6:
+            raise RuntimeError("Maximum number of arguments exceeded")
+        cdef Arg arg
+        for i, arg in enumerate(args):
+            c_arg[i] = arg.to_c()
+        if len(args) == 0:
+            rc = libseccomp.seccomp_rule_add(self._ctx, action, syscall_num, 0)
+        elif len(args) == 1:
+            rc = libseccomp.seccomp_rule_add(self._ctx, action, syscall_num,
+                                             len(args),
+                                             c_arg[0])
+        elif len(args) == 2:
+            rc = libseccomp.seccomp_rule_add(self._ctx, action, syscall_num,
+                                             len(args),
+                                             c_arg[0],
+                                             c_arg[1])
+        elif len(args) == 3:
+            rc = libseccomp.seccomp_rule_add(self._ctx, action, syscall_num,
+                                             len(args),
+                                             c_arg[0],
+                                             c_arg[1],
+                                             c_arg[2])
+        elif len(args) == 4:
+            rc = libseccomp.seccomp_rule_add(self._ctx, action, syscall_num,
+                                             len(args),
+                                             c_arg[0],
+                                             c_arg[1],
+                                             c_arg[2],
+                                             c_arg[3])
+        elif len(args) == 5:
+            rc = libseccomp.seccomp_rule_add(self._ctx, action, syscall_num,
+                                             len(args),
+                                             c_arg[0],
+                                             c_arg[1],
+                                             c_arg[2],
+                                             c_arg[3],
+                                             c_arg[4])
+        elif len(args) == 6:
+            rc = libseccomp.seccomp_rule_add(self._ctx, action, syscall_num,
+                                             len(args),
+                                             c_arg[0],
+                                             c_arg[1],
+                                             c_arg[2],
+                                             c_arg[3],
+                                             c_arg[4],
+                                             c_arg[5])
+        else:
+            raise RuntimeError("Maximum number of arguments exceeded")
+        if rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def add_rule_exactly(self, int action, syscall, *args):
+        """ Add a new rule to filter.
+
+        Arguments:
+        action - the rule action: KILL_PROCESS, KILL, TRAP, ERRNO(), TRACE(),
+                 LOG, or ALLOW
+        syscall - the syscall name or number
+        args - variable number of Arg objects
+
+        Description:
+        Add a new rule to the filter, matching on the given syscall and an
+        optional list of argument comparisons.  If the rule is triggered
+        the given action will be taken by the kernel.  In order for the
+        rule to trigger, the syscall as well as each argument comparison
+        must be true.
+
+        This method attempts to add the filter rule exactly as specified
+        which can cause problems on certain architectures, e.g. socket()
+        on 32-bit x86.  For a architecture independent version of this
+        method use add_rule().
+        """
+        cdef libseccomp.scmp_arg_cmp c_arg[6]
+        if isinstance(syscall, str):
+            syscall_str = syscall.encode()
+            syscall_num = libseccomp.seccomp_syscall_resolve_name(syscall_str)
+        elif isinstance(syscall, int):
+            syscall_num = syscall
+        else:
+            raise TypeError("Syscall must either be an int or str type")
+        """ NOTE: the code below exists solely to deal with the varadic
+        nature of seccomp_rule_add_exact() function and the inability of
+        Cython to handle this automatically """
+        if len(args) > 6:
+            raise RuntimeError("Maximum number of arguments exceeded")
+        cdef Arg arg
+        for i, arg in enumerate(args):
+            c_arg[i] = arg.to_c()
+        if len(args) == 0:
+            rc = libseccomp.seccomp_rule_add_exact(self._ctx, action,
+                                                   syscall_num, 0)
+        elif len(args) == 1:
+            rc = libseccomp.seccomp_rule_add_exact(self._ctx, action,
+                                                   syscall_num, len(args),
+                                                   c_arg[0])
+        elif len(args) == 2:
+            rc = libseccomp.seccomp_rule_add_exact(self._ctx, action,
+                                                   syscall_num, len(args),
+                                                   c_arg[0],
+                                                   c_arg[1])
+        elif len(args) == 3:
+            rc = libseccomp.seccomp_rule_add_exact(self._ctx, action,
+                                                   syscall_num, len(args),
+                                                   c_arg[0],
+                                                   c_arg[1],
+                                                   c_arg[2])
+        elif len(args) == 4:
+            rc = libseccomp.seccomp_rule_add_exact(self._ctx, action,
+                                                   syscall_num, len(args),
+                                                   c_arg[0],
+                                                   c_arg[1],
+                                                   c_arg[2],
+                                                   c_arg[3])
+        elif len(args) == 5:
+            rc = libseccomp.seccomp_rule_add_exact(self._ctx, action,
+                                                   syscall_num, len(args),
+                                                   c_arg[0],
+                                                   c_arg[1],
+                                                   c_arg[2],
+                                                   c_arg[3],
+                                                   c_arg[4])
+        elif len(args) == 6:
+            rc = libseccomp.seccomp_rule_add_exact(self._ctx, action,
+                                                   syscall_num, len(args),
+                                                   c_arg[0],
+                                                   c_arg[1],
+                                                   c_arg[2],
+                                                   c_arg[3],
+                                                   c_arg[4],
+                                                   c_arg[5])
+        else:
+            raise RuntimeError("Maximum number of arguments exceeded")
+        if rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def receive_notify(self):
+        """ Receive seccomp notifications.
+
+        Description:
+        Receive a seccomp notification from the system, requires the use of
+        the NOTIFY action.
+        """
+        cdef libseccomp.seccomp_notif *req
+
+        fd = libseccomp.seccomp_notify_fd(self._ctx)
+        if fd < 0:
+            raise RuntimeError("Notifications not enabled/active")
+        rc = libseccomp.seccomp_notify_alloc(&req, NULL)
+        if rc < 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+        rc = libseccomp.seccomp_notify_receive(fd, req)
+        if rc < 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+        rc = libseccomp.seccomp_notify_id_valid(fd, req.id)
+        if rc < 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+        notify = Notification(req.id, req.pid, req.flags, req.data.nr,
+                              req.data.arch, req.data.instruction_pointer,
+                              [req.data.args[0], req.data.args[1],
+                               req.data.args[2], req.data.args[3],
+                               req.data.args[4], req.data.args[5]])
+        free(req)
+        return notify
+
+    def respond_notify(self, response):
+        """ Send a seccomp notification response.
+
+        Arguments:
+        response - the response to send to the system
+
+        Description:
+        Respond to a seccomp notification.
+        """
+        cdef libseccomp.seccomp_notif_resp *resp
+
+        fd = libseccomp.seccomp_notify_fd(self._ctx)
+        if fd < 0:
+            raise RuntimeError("Notifications not enabled/active")
+        rc = libseccomp.seccomp_notify_alloc(NULL, &resp)
+        if rc < 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+        resp.id = response.id
+        resp.val = response.val
+        resp.error = response.error
+        resp.flags = response.flags
+        rc = libseccomp.seccomp_notify_respond(fd, resp)
+        if rc < 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def get_notify_fd(self):
+        """ Get the seccomp notification file descriptor
+
+        Description:
+        Returns the seccomp listener file descriptor that was generated when
+        the seccomp policy was loaded. This is only valid after load() with a
+        filter that makes use of the NOTIFY action.
+        """
+        fd = libseccomp.seccomp_notify_fd(self._ctx)
+        if fd < 0:
+            raise RuntimeError("Notifications not enabled/active")
+        return fd
+
+    def export_pfc(self, file):
+        """ Export the filter in PFC format.
+
+        Arguments:
+        file - the output file
+
+        Description:
+        Output the filter in Pseudo Filter Code (PFC) to the given file.
+        The output is functionally equivalent to the BPF based filter
+        which is loaded into the Linux Kernel.
+        """
+        rc = libseccomp.seccomp_export_pfc(self._ctx, file.fileno())
+        if rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+    def export_bpf(self, file):
+        """ Export the filter in BPF format.
+
+        Arguments:
+        file - the output file
+
+        Description:
+        Output the filter in Berkeley Packet Filter (BPF) to the given
+        file.  The output is identical to what is loaded into the
+        Linux Kernel.
+        """
+        rc = libseccomp.seccomp_export_bpf(self._ctx, file.fileno())
+        if rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
+# kate: syntax python;
+# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;