path: root/po/fr/man2/seccomp.2.po

# French translation of manpages
# This file is distributed under the same license as the manpages-l10n package.
# Copyright © of this file:
# Christophe Blaess <https://www.blaess.fr/christophe/>, 1996-2003.
# Stéphan Rafin <stephan.rafin@laposte.net>, 2002.
# Thierry Vignaud <tvignaud@mandriva.com>, 1999, 2002.
# François Micaux, 2002.
# Alain Portal <aportal@univ-montp2.fr>, 2003-2008.
# Jean-Philippe Guérard <fevrier@tigreraye.org>, 2005-2006.
# Jean-Luc Coulon (f5ibh) <jean-luc.coulon@wanadoo.fr>, 2006-2007.
# Julien Cristau <jcristau@debian.org>, 2006-2007.
# Thomas Huriaux <thomas.huriaux@gmail.com>, 2006-2008.
# Nicolas François <nicolas.francois@centraliens.net>, 2006-2008.
# Florentin Duneau <fduneau@gmail.com>, 2006-2010.
# Simon Paillard <simon.paillard@resel.enst-bretagne.fr>, 2006, 2013-2014.
# Denis Barbier <barbier@debian.org>, 2006, 2010.
# David Prévot <david@tilapin.org>, 2010-2014.
# Jean-Philippe MENGUAL <jpmengual@debian.org>, 2021-2023.
# Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>, 2023-2024.
msgid ""
msgstr ""
"Project-Id-Version: manpages-l10n 4.22.0\n"
"POT-Creation-Date: 2024-06-01 06:20+0200\n"
"PO-Revision-Date: 2024-06-02 11:09+0200\n"
"Last-Translator: Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>\n"
"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
"Language: fr\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=2; plural=n > 1;\n"
"X-Generator: Lokalize 22.12.3\n"

#. type: TH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "seccomp"
msgstr "seccomp"

#. type: TH
#: archlinux debian-unstable opensuse-tumbleweed
#, no-wrap
msgid "2024-05-02"
msgstr "2 mai 2024"

#. type: TH
#: archlinux debian-unstable
#, no-wrap
msgid "Linux man-pages 6.8"
msgstr "Pages du manuel de Linux 6.8"

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "NAME"
msgstr "NOM"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "seccomp - operate on Secure Computing state of the process"
msgstr ""
"seccomp - Agir sur l'état de calcul sécurisé (Secure Computing State) du "
"processus"

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "LIBRARY"
msgstr "BIBLIOTHÈQUE"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "Standard C library (I<libc>, I<-lc>)"
msgstr "Bibliothèque C standard (I<libc>, I<-lc>)"

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "SYNOPSIS"
msgstr "SYNOPSIS"

#.  Kees Cook noted: Anything that uses SECCOMP_RET_TRACE returns will
#.                   need <sys/ptrace.h>
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"B<#include E<lt>linux/seccomp.hE<gt>>  /* Definition of B<SECCOMP_*> constants */\n"
"B<#include E<lt>linux/filter.hE<gt>>   /* Definition of B<struct sock_fprog> */\n"
"B<#include E<lt>linux/audit.hE<gt>>    /* Definition of B<AUDIT_*> constants */\n"
"B<#include E<lt>linux/signal.hE<gt>>   /* Definition of B<SIG*> constants */\n"
"B<#include E<lt>sys/ptrace.hE<gt>>     /* Definition of B<PTRACE_*> constants */\n"
"B<#include E<lt>sys/syscall.hE<gt>>    /* Definition of B<SYS_*> constants */\n"
"B<#include E<lt>unistd.hE<gt>>\n"
msgstr ""
"B<#include E<lt>linux/seccomp.hE<gt>>  /* Définition des constantes B<SECCOMP_*> */\n"
"B<#include E<lt>linux/filter.hE<gt>>   /* Définition de B<struct sock_fprog> */\n"
"B<#include E<lt>linux/audit.hE<gt>>    /* Définition des constantes B<AUDIT_*> */\n"
"B<#include E<lt>linux/signal.hE<gt>>   /* Définition des constantes B<SIG*> */\n"
"B<#include E<lt>sys/ptrace.hE<gt>>     /* Définition des constantes B<PTRACE_*> */\n"
"B<#include E<lt>sys/syscall.hE<gt>>    /* Définition des constantes B<SYS_*> */\n"
"B<#include E<lt>unistd.hE<gt>>\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"B<int syscall(SYS_seccomp, unsigned int >I<operation>B<, unsigned int >I<flags>B<,>\n"
"B<            void *>I<args>B<);>\n"
msgstr ""
"B<int syscall(SYS_seccomp, unsigned int >I<opération>B<, unsigned int >I<flags>B<,>\n"
"B<            void *>I<args>B<);>\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"I<Note>: glibc provides no wrapper for B<seccomp>(), necessitating the use "
"of B<syscall>(2)."
msgstr ""
"I<Remarque> : la glibc ne fournit pas d'enveloppe pour B<seccomp>(), "
"imposant l'utilisation de B<syscall>(2)."

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "DESCRIPTION"
msgstr "DESCRIPTION"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The B<seccomp>()  system call operates on the Secure Computing (seccomp) "
"state of the calling process."
msgstr ""
"L'appel système B<seccomp>() agit sur l'état de calcul sécurisé (seccomp) du "
"processus appelant."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "Currently, Linux supports the following I<operation> values:"
msgstr "Actuellement, Linux gère les valeurs d'I<opération> suivantes :"

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_SET_MODE_STRICT>"
msgstr "B<SECCOMP_SET_MODE_STRICT>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The only system calls that the calling thread is permitted to make are "
"B<read>(2), B<write>(2), B<_exit>(2)  (but not B<exit_group>(2)), and "
"B<sigreturn>(2).  Other system calls result in the termination of the "
"calling thread, or termination of the entire process with the B<SIGKILL> "
"signal when there is only one thread.  Strict secure computing mode is "
"useful for number-crunching applications that may need to execute untrusted "
"byte code, perhaps obtained by reading from a pipe or socket."
msgstr ""
"Les seuls appels système que le thread appelant est autorisé à faire sont "
"B<read>(2), B<write>(2), B<_exit>(2) (mais pas B<exit_group>(2)) et "
"B<sigreturn>(2). Les autres appels système aboutissent à la fin du thread "
"appelant ou à la fin du processus complet avec le signal B<SIGKILL> quand il "
"n'y a qu'un seul thread. Le mode de calcul sécurisé strict est utile pour "
"les applications de traitement de nombres qui peuvent avoir besoin "
"d'exécuter un code à octets non fiable, obtenu peut-être en lisant un tube "
"ou un socket."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Note that although the calling thread can no longer call B<sigprocmask>(2), "
"it can use B<sigreturn>(2)  to block all signals apart from B<SIGKILL> and "
"B<SIGSTOP>.  This means that B<alarm>(2)  (for example) is not sufficient "
"for restricting the process's execution time.  Instead, to reliably "
"terminate the process, B<SIGKILL> must be used.  This can be done by using "
"B<timer_create>(2)  with B<SIGEV_SIGNAL> and I<sigev_signo> set to "
"B<SIGKILL>, or by using B<setrlimit>(2)  to set the hard limit for "
"B<RLIMIT_CPU>."
msgstr ""
"Remarquez que si le thread appelant ne peut plus appeler B<sigprocmask>(2), "
"il peut utiliser B<sigreturn>(2) pour bloquer tous les signaux, sauf ceux "
"provenant de B<SIGKILL> et de B<SIGSTOP>. Cela veut dire que B<alarm>(2) "
"(par exemple) n'est pas suffisant pour restreindre la durée d'exécution d'un "
"processus. Pour terminer de manière fiable un processus, B<SIGKILL> doit "
"être utilisé. On peut le faire en utilisant B<timer_create>(2) avec "
"B<SIGEV_SIGNAL> et I<sigev_signo> positionné à B<SIGKILL> ou en utilisant "
"B<setrlimit>(2) pour positionner la limite ferme de B<RLIMIT_CPU>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"This operation is available only if the kernel is configured with "
"B<CONFIG_SECCOMP> enabled."
msgstr ""
"Cette fonctionnalité n'est disponible que si le noyau a été construit avec "
"l'option B<CONFIG_SECCOMP> activée."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "The value of I<flags> must be 0, and I<args> must be NULL."
msgstr "La valeur de I<flags> doit être de B<0> et I<args> doit être NULL."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "This operation is functionally identical to the call:"
msgstr "Cette opération est fonctionnellement identique à l'appel :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT);\n"
msgstr "prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT);\n"

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_SET_MODE_FILTER>"
msgstr "B<SECCOMP_SET_MODE_FILTER>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The system calls allowed are defined by a pointer to a Berkeley Packet "
"Filter (BPF) passed via I<args>.  This argument is a pointer to a I<struct\\ "
"sock_fprog>; it can be designed to filter arbitrary system calls and system "
"call arguments.  If the filter is invalid, B<seccomp>()  fails, returning "
"B<EINVAL> in I<errno>."
msgstr ""
"Les appels système autorisés sont définis par un pointeur vers un filtre "
"Berkeley Packet (BPF) fourni à l'aide de I<args>. Ce paramètre est un "
"pointeur vers une I<struct\\ sock_fprog> ; il peut être conçu pour filtrer "
"des appels système de votre choix ainsi que des paramètres d'appel système. "
"Si le filtre n'est pas valable, B<seccomp>() échoue en renvoyant B<EINVAL> "
"dans I<errno>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"If B<fork>(2)  or B<clone>(2)  is allowed by the filter, any child processes "
"will be constrained to the same system call filters as the parent.  If "
"B<execve>(2)  is allowed, the existing filters will be preserved across a "
"call to B<execve>(2)."
msgstr ""
"Si B<fork>(2) ou B<clone>(2) est autorisé par le filtre, les processus "
"enfant seront contraints par les mêmes filtres d'appel système que leur "
"parent. Si B<execve>(2) est autorisé, les filtres existants seront préservés "
"lors d'un appel à B<execve>(2)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"In order to use the B<SECCOMP_SET_MODE_FILTER> operation, either the calling "
"thread must have the B<CAP_SYS_ADMIN> capability in its user namespace, or "
"the thread must already have the I<no_new_privs> bit set.  If that bit was "
"not already set by an ancestor of this thread, the thread must make the "
"following call:"
msgstr ""
"Pour utiliser l'opération B<SECCOMP_SET_MODE_FILTER>, soit le thread "
"appelant doit avoir la capacité B<CAP_SYS_ADMIN> dans son espace de noms "
"utilisateur, soit il doit avoir déjà le bit I<no_new_privs> défini. Si ce "
"bit n'a pas déjà été positionné par un ascendant du thread, le thread doit "
"effectuer l'appel suivant :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "prctl(PR_SET_NO_NEW_PRIVS, 1);\n"
msgstr "prctl(PR_SET_NO_NEW_PRIVS, 1);\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Otherwise, the B<SECCOMP_SET_MODE_FILTER> operation fails and returns "
"B<EACCES> in I<errno>.  This requirement ensures that an unprivileged "
"process cannot apply a malicious filter and then invoke a set-user-ID or "
"other privileged program using B<execve>(2), thus potentially compromising "
"that program.  (Such a malicious filter might, for example, cause an attempt "
"to use B<setuid>(2)  to set the caller's user IDs to nonzero values to "
"instead return 0 without actually making the system call.  Thus, the program "
"might be tricked into retaining superuser privileges in circumstances where "
"it is possible to influence it to do dangerous things because it did not "
"actually drop privileges.)"
msgstr ""
"Sinon, l'opération B<SECCOMP_SET_MODE_FILTER> échoue et renvoie B<EACCES> "
"dans I<errno>. Cette exigence garantit qu'un processus non privilégié ne "
"peut pas appliquer un filtre malveillant et appeler un programme set-user-ID "
"ou avec d'autres privilèges en utilisant B<execve>(2), compromettant ainsi "
"le programme (un tel filtre malveillant pourrait, par exemple, conduire "
"B<setuid>(2) à essayer de définir les identifiants utilisateur de l'appelant "
"à des valeurs non nulles pour renvoyer plutôt B<0> sans faire d'appel "
"système. Ainsi, le programme pourrait être bidouillé pour garder les "
"privilèges du super-utilisateur à des moments où il est possible de "
"l'influencer pour faire des choses dangereuses vu qu'il n'a pas abandonné "
"ses privilèges)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"If B<prctl>(2)  or B<seccomp>()  is allowed by the attached filter, further "
"filters may be added.  This will increase evaluation time, but allows for "
"further reduction of the attack surface during execution of a thread."
msgstr ""
"Si B<prctl>(2) ou B<seccomp>() est autorisé par le filtre rattaché, d'autres "
"filtres peuvent être ajoutés. Cela augmentera le temps d'évaluation mais "
"permet d'autres réductions de la surface d'attaque lors de l'exécution d'un "
"thread."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The B<SECCOMP_SET_MODE_FILTER> operation is available only if the kernel is "
"configured with B<CONFIG_SECCOMP_FILTER> enabled."
msgstr ""
"L'opération B<SECCOMP_SET_MODE_FILTER> n'est disponible que si le noyau a "
"été configuré avec B<CONFIG_SECCOMP_FILTER>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"When I<flags> is 0, this operation is functionally identical to the call:"
msgstr ""
"Quand I<flags> vaut B<0>, cette opération est fonctionnellement identique à "
"l'appel :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, args);\n"
msgstr "prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, args);\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "The recognized I<flags> are:"
msgstr "Les paramètres reconnus de I<flags> sont :"

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_FILTER_FLAG_LOG> (since Linux 4.14)"
msgstr "B<SECCOMP_FILTER_FLAG_LOG> (depuis Linux 4.14)"

#.  commit e66a39977985b1e69e17c4042cb290768eca9b02
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"All filter return actions except B<SECCOMP_RET_ALLOW> should be logged.  An "
"administrator may override this filter flag by preventing specific actions "
"from being logged via the I</proc/sys/kernel/seccomp/actions_logged> file."
msgstr ""
"Toutes les actions de renvoi des filtres, sauf B<SECCOMP_RET_ALLOW>, doivent "
"être journalisées. Un administrateur peut outrepasser cet attribut de filtre "
"en empêchant des actions spécifiques d'être journalisées à l'aide du fichier "
"I</proc/sys/kernel/seccomp/actions_logged>."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_FILTER_FLAG_NEW_LISTENER> (since Linux 5.0)"
msgstr "B<SECCOMP_FILTER_FLAG_NEW_LISTENER> (depuis Linux 5.0)"

#.  commit 6a21cc50f0c7f87dae5259f6cfefe024412313f6
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"After successfully installing the filter program, return a new user-space "
"notification file descriptor.  (The close-on-exec flag is set for the file "
"descriptor.)  When the filter returns B<SECCOMP_RET_USER_NOTIF> a "
"notification will be sent to this file descriptor."
msgstr ""
"Après une installation réussie du programme de filtrage, renvoyer un nouveau "
"descripteur de fichier de notification pour l'espace utilisateur. "
"(L'attribut close-on-exec est défini pour le descripteur de fichier.) Quand "
"le filtre renvoie B<SECCOMP_RET_USER_NOTIF>, une notification sera envoyée à "
"ce descripteur de fichier."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"At most one seccomp filter using the B<SECCOMP_FILTER_FLAG_NEW_LISTENER> "
"flag can be installed for a thread."
msgstr ""
"Pour un thread, au maximum un seul filtre de seccomp utilisant l'attribut "
"B<SECCOMP_FILTER_FLAG_NEW_LISTENER> peut être installé."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "See B<seccomp_unotify>(2)  for further details."
msgstr "Consultez B<seccomp_unotify>(2) pour plus de détails."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_FILTER_FLAG_SPEC_ALLOW> (since Linux 4.17)"
msgstr "B<SECCOMP_FILTER_FLAG_SPEC_ALLOW> (depuis Linux 4.17)"

#.  commit 00a02d0c502a06d15e07b857f8ff921e3e402675
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "Disable Speculative Store Bypass mitigation."
msgstr "Désactiver la mitigation Speculative Store Bypass."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_FILTER_FLAG_TSYNC>"
msgstr "B<SECCOMP_FILTER_FLAG_TSYNC>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"When adding a new filter, synchronize all other threads of the calling "
"process to the same seccomp filter tree.  A \"filter tree\" is the ordered "
"list of filters attached to a thread.  (Attaching identical filters in "
"separate B<seccomp>()  calls results in different filters from this "
"perspective.)"
msgstr ""
"Lors de l'ajout d'un filtre, synchroniser tous les autres threads du "
"processus appelant avec la même arborescence de filtres seccomp. Une "
"« arborescence de filtres » est une liste ordonnée de filtres rattachée à un "
"thread (le rattachement de filtres identiques dans des appels B<seccomp>() "
"distincts génère différents filtres depuis cette perspective)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"If any thread cannot synchronize to the same filter tree, the call will not "
"attach the new seccomp filter, and will fail, returning the first thread ID "
"found that cannot synchronize.  Synchronization will fail if another thread "
"in the same process is in B<SECCOMP_MODE_STRICT> or if it has attached new "
"seccomp filters to itself, diverging from the calling thread's filter tree."
msgstr ""
"Si aucun thread ne peut pas se synchroniser avec l'arborescence de filtres, "
"l'appel ne rattachera pas le nouveau filtre seccomp et échouera en renvoyant "
"le premier identifiant de thread qui n'a pas pu se synchroniser. La "
"synchronisation échouera si un autre thread du même processus est en "
"B<SECCOMP_MODE_STRICT> ou si des nouveaux filtres seccomp lui sont rattachés "
"en propre, en décalage par rapport à l'arborescence de filtres du thread "
"appelant."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_GET_ACTION_AVAIL> (since Linux 4.14)"
msgstr "B<SECCOMP_GET_ACTION_AVAIL> (depuis Linux 4.14)"

#.  commit d612b1fd8010d0d67b5287fe146b8b55bcbb8655
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Test to see if an action is supported by the kernel.  This operation is "
"helpful to confirm that the kernel knows of a more recently added filter "
"return action since the kernel treats all unknown actions as "
"B<SECCOMP_RET_KILL_PROCESS>."
msgstr ""
"Tester pour savoir si une action est prise en charge par le noyau. Cette "
"opération peut aider à confirmer que le noyau connaît l'action de renvoi "
"d'un filtre récemment ajouté puisque le noyau traite toutes les actions "
"inconnues comme des B<SECCOMP_RET_KILL_PROCESS>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The value of I<flags> must be 0, and I<args> must be a pointer to an "
"unsigned 32-bit filter return action."
msgstr ""
"La valeur de I<flags> doit être de B<0> et I<args> doit être un pointeur "
"vers une action de renvoi de filtre 32 bits non signé."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_GET_NOTIF_SIZES> (since Linux 5.0)"
msgstr "B<SECCOMP_GET_NOTIF_SIZES> (depuis Linux 5.O)"

#.  commit 6a21cc50f0c7f87dae5259f6cfefe024412313f6
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Get the sizes of the seccomp user-space notification structures.  Since "
"these structures may evolve and grow over time, this command can be used to "
"determine how much memory to allocate for sending and receiving "
"notifications."
msgstr ""
"Obtenir la taille des structures de notification de l'espace utilisateur de "
"seccomp. Comme ces structures peuvent évoluer et croître avec le temps, "
"cette commande peut être utilisée pour déterminer quelle quantité de mémoire "
"allouer pour envoyer et recevoir des notifications."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The value of I<flags> must be 0, and I<args> must be a pointer to a I<struct "
"seccomp_notif_sizes>, which has the following form:"
msgstr ""
"La valeur de I<flags> doit être de B<0> et I<args> doit être un pointeur "
"vers un I<struct seccomp_notif_sizes> de la forme suivante :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"struct seccomp_notif_sizes\n"
"    __u16 seccomp_notif;      /* Size of notification structure */\n"
"    __u16 seccomp_notif_resp; /* Size of response structure */\n"
"    __u16 seccomp_data;       /* Size of \\[aq]struct seccomp_data\\[aq] */\n"
"};\n"
msgstr ""
"struct seccomp_notif_sizes\n"
"    __u16 seccomp_notif;      /* Taille de la structure de notification */\n"
"    __u16 seccomp_notif_resp; /* Taille de la structure de réponse */\n"
"    __u16 seccomp_data;       /* Taille de \\[aq]struct seccomp_data\\[aq] */\n"
"};\n"

#. type: SS
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "Filters"
msgstr "Filtres"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"When adding filters via B<SECCOMP_SET_MODE_FILTER>, I<args> points to a "
"filter program:"
msgstr ""
"Lors de l'ajout d'un filtre à l'aide de B<SECCOMP_SET_MODE_FILTER>, I<args> "
"pointe vers un programme de filtrage :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"struct sock_fprog {\n"
"    unsigned short      len;    /* Number of BPF instructions */\n"
"    struct sock_filter *filter; /* Pointer to array of\n"
"                                   BPF instructions */\n"
"};\n"
msgstr ""
"struct sock_fprog {\n"
"    unsigned short      len;    /* Nombre d'instructions BPF */\n"
"    struct sock_filter *filter; /* Pointeur vers le tableau\n"
"                                   d'instructions BPF */\n"
"};\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "Each program must contain one or more BPF instructions:"
msgstr "Chaque programme doit contenir une ou plusieurs instructions BPF :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"struct sock_filter {            /* Filter block */\n"
"    __u16 code;                 /* Actual filter code */\n"
"    __u8  jt;                   /* Jump true */\n"
"    __u8  jf;                   /* Jump false */\n"
"    __u32 k;                    /* Generic multiuse field */\n"
"};\n"
msgstr ""
"struct sock_filter {            /* Filter block */\n"
"    __u16 code;                 /* Code du filtre réel */\n"
"    __u8  jt;                   /* Jump true (sauter le vrai) */\n"
"    __u8  jf;                   /* Jump false (sauter le faux) */\n"
"    __u32 k;                    /* Champ générique multiusages */\n"
"};\n"

#.  Quoting Kees Cook:
#.      If BPF even allows changing the data, it's not copied back to
#.      the syscall when it runs. Anything wanting to do things like
#.      that would need to use ptrace to catch the call and directly
#.      modify the registers before continuing with the call.
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"When executing the instructions, the BPF program operates on the system call "
"information made available (i.e., use the B<BPF_ABS> addressing mode) as a "
"(read-only)  buffer of the following form:"
msgstr ""
"Lors de l'exécution des instructions, le programme BPF agit sur les "
"informations de l'appel système qui sont rendues disponibles (c'est-à-dire "
"qu'il utilise le mode d'adressage B<BPF_ABS>) en tant que tampon (en lecture "
"seule) ayant la forme suivante :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"struct seccomp_data {\n"
"    int   nr;                   /* System call number */\n"
"    __u32 arch;                 /* AUDIT_ARCH_* value\n"
"                                   (see E<lt>linux/audit.hE<gt>) */\n"
"    __u64 instruction_pointer;  /* CPU instruction pointer */\n"
"    __u64 args[6];              /* Up to 6 system call arguments */\n"
"};\n"
msgstr ""
"struct seccomp_data {\n"
"    int   nr;                   /* Numéro de l'appel système */\n"
"    __u32 arch;                 /* Valeur AUDIT_ARCH_*\n"
"                                   (voir E<lt>linux/audit.hE<gt>) */\n"
"    __u64 instruction_pointer;  /* pointeur vers l'instruction du processeur */\n"
"    __u64 args[6];              /* Jusqu'à 6 paramètres de l'appel système */\n"
"};\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Because numbering of system calls varies between architectures and some "
"architectures (e.g., x86-64) allow user-space code to use the calling "
"conventions of multiple architectures (and the convention being used may "
"vary over the life of a process that uses B<execve>(2)  to execute binaries "
"that employ the different conventions), it is usually necessary to verify "
"the value of the I<arch> field."
msgstr ""
"Comme la numérotation des appels système varie entre les architectures et "
"comme certaines (comme x86-64) autorisent du code de l'espace utilisateur à "
"utiliser les conventions de l'appelant d'autres architectures (et comme "
"cette convention peut varier pendant la vie d'un processus qui utilise "
"B<execve>(2) pour exécuter des binaires qui utilisent différentes "
"conventions), il est généralement nécessaire de vérifier la valeur du champ "
"I<arch>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"It is strongly recommended to use an allow-list approach whenever possible "
"because such an approach is more robust and simple.  A deny-list will have "
"to be updated whenever a potentially dangerous system call is added (or a "
"dangerous flag or option if those are deny-listed), and it is often possible "
"to alter the representation of a value without altering its meaning, leading "
"to a deny-list bypass.  See also I<Caveats> below."
msgstr ""
"Il est fortement recommandé d'utiliser une approche par liste "
"d'autorisations autant que possible, parce qu'une telle approche est plus "
"robuste et plus simple. Une liste d'interdictions devra être mise à jour à "
"chaque fois qu'un appel système dangereux sera ajouté (ou un attribut ou une "
"option si elles font partie de la liste des interdictions) et il est souvent "
"possible de modifier la représentation d'une valeur sans changer sa "
"signification, conduisant à contourner la liste d'interdictions. Voir aussi "
"I<Mises en garde> ci-dessous."

#
#.  As noted by Dave Drysdale in a note at the end of
#.  https://lwn.net/Articles/604515/
#.      One additional detail to point out for the x32 ABI case:
#.      the syscall number gets a high bit set (__X32_SYSCALL_BIT),
#.      to mark it as an x32 call.
#.      If x32 support is included in the kernel, then __SYSCALL_MASK
#.      will have a value that is not all-ones, and this will trigger
#.      an extra instruction in system_call to mask off the extra bit,
#.      so that the syscall table indexing still works.
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The I<arch> field is not unique for all calling conventions.  The x86-64 ABI "
"and the x32 ABI both use B<AUDIT_ARCH_X86_64> as I<arch>, and they run on "
"the same processors.  Instead, the mask B<__X32_SYSCALL_BIT> is used on the "
"system call number to tell the two ABIs apart."
msgstr ""
"Le champ I<arch> n'est pas unique pour toutes les conventions d'appelant. "
"Les ABI x86-64 et x32 utilisent B<AUDIT_ARCH_X86_64> en tant que I<arch> et "
"elles fonctionnent sur les mêmes processeurs. Au contraire, le masque "
"B<__X32_SYSCALL_BIT> est utilisé sur le numéro d'appel système pour parler "
"indépendamment aux deux ABI."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"This means that a policy must either deny all syscalls with "
"B<__X32_SYSCALL_BIT> or it must recognize syscalls with and without "
"B<__X32_SYSCALL_BIT> set.  A list of system calls to be denied based on "
"I<nr> that does not also contain I<nr> values with B<__X32_SYSCALL_BIT> set "
"can be bypassed by a malicious program that sets B<__X32_SYSCALL_BIT>."
msgstr ""
"Cela veut dire qu'une politique peut soit interdire tous les appels système "
"avec B<__X32_SYSCALL_BIT>, soit elle doit les reconnaître avec le "
"positionnement ou pas de B<__X32_SYSCALL_BIT>. Une liste des appels système "
"à interdire qui s'appuie sur I<nr> et qui ne contient pas de valeurs I<nr> "
"où B<__X32_SYSCALL_BIT> est positionné peut être contournée par un programme "
"malveillant qui positionne B<__X32_SYSCALL_BIT>."

#.  commit 6365b842aae4490ebfafadfc6bb27a6d3cc54757
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Additionally, kernels prior to Linux 5.4 incorrectly permitted I<nr> in the "
"ranges 512-547 as well as the corresponding non-x32 syscalls ORed with "
"B<__X32_SYSCALL_BIT>.  For example, I<nr> == 521 and I<nr> == (101 | "
"B<__X32_SYSCALL_BIT>)  would result in invocations of B<ptrace>(2)  with "
"potentially confused x32-vs-x86_64 semantics in the kernel.  Policies "
"intended to work on kernels before Linux 5.4 must ensure that they deny or "
"otherwise correctly handle these system calls.  On Linux 5.4 and newer, such "
"system calls will fail with the error B<ENOSYS>, without doing anything."
msgstr ""
"En outre, les noyaux précédant Linux 5.4 autorisaient à tort I<nr> dans les "
"intervalles 512–547 ainsi que les appels système non x32 correspondants "
"reliés (opération OU) avec B<__X32_SYSCALL_BIT>. Par exemple, I<nr> == 521 "
"et I<nr> == (101 | B<__X32_SYSCALL_BIT>) créeraient des appels B<ptrace>(2) "
"avec une sémantique potentiellement confondue entre x32 et x86_64 dans le "
"noyau. Les politiques prévues pour fonctionner sur des noyaux antérieurs à "
"Linux 5.4 doivent garantir qu'elles interdisent ou qu'elles gèrent "
"correctement ces appels système. Sur Linux 5.4 et plus récents, de tels "
"appels système échoueront avec une erreur B<ENOSYS> sans rien faire."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The I<instruction_pointer> field provides the address of the machine-"
"language instruction that performed the system call.  This might be useful "
"in conjunction with the use of I</proc/>pidI</maps> to perform checks based "
"on which region (mapping) of the program made the system call.  (Probably, "
"it is wise to lock down the B<mmap>(2)  and B<mprotect>(2)  system calls to "
"prevent the program from subverting such checks.)"
msgstr ""
"Le champ I<instruction_pointer> fournit l'adresse de l'instruction en "
"langage machine qui a effectué l'appel système. Cela pourrait être utile "
"avec I</proc/>pidI</maps> pour effectuer des vérifications à partir de la "
"région (projection) du programme qui a fait l'appel système (il est "
"probablement raisonnable de verrouiller les appels système B<mmap>(2) et "
"B<mprotect>(2) pour empêcher le programme de contourner de telles "
"vérifications)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"When checking values from I<args>, keep in mind that arguments are often "
"silently truncated before being processed, but after the seccomp check.  For "
"example, this happens if the i386 ABI is used on an x86-64 kernel: although "
"the kernel will normally not look beyond the 32 lowest bits of the "
"arguments, the values of the full 64-bit registers will be present in the "
"seccomp data.  A less surprising example is that if the x86-64 ABI is used "
"to perform a system call that takes an argument of type I<int>, the more-"
"significant half of the argument register is ignored by the system call, but "
"visible in the seccomp data."
msgstr ""
"Lors de la vérification des valeurs de I<args>, gardez en tête que les "
"paramètres sont souvent tronqués silencieusement avant d'être traités mais "
"après la vérification seccomp. Cela arrive par exemple si l'ABI i386 est "
"utilisée sur un noyau x86-64 : bien que le noyau n'ira normalement pas "
"regarder au-delà des 32 bits les plus faibles des paramètres, les valeurs "
"des registres 64 bits complets seront présentes dans les données de seccomp. "
"Un exemple moins surprenant est que si l'ABI x86-64 est utilisée pour "
"effectuer un appel système prenant un paramètre de type I<int>, la moitié du "
"registre du paramètre la plus significative est ignorée par l'appel système "
"mais visible dans les données de seccomp."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"A seccomp filter returns a 32-bit value consisting of two parts: the most "
"significant 16 bits (corresponding to the mask defined by the constant "
"B<SECCOMP_RET_ACTION_FULL>)  contain one of the \"action\" values listed "
"below; the least significant 16-bits (defined by the constant "
"B<SECCOMP_RET_DATA>)  are \"data\" to be associated with this return value."
msgstr ""
"Un filtre seccomp renvoie une valeur 32 bits en deux parties : la plus "
"significative, de 16 bits (correspondant au masque défini par la constante "
"B<SECCOMP_RET_ACTION_FULL>), contient une des valeurs « action » listée ci-"
"dessous ; la moins significative, de 16 bits (définie par la constante "
"B<SECCOMP_RET_DATA>), contient des « data » à associer à ce code de retour."

#
#.  From an Aug 2015 conversation with Kees Cook where I asked why *all*
#.  filters are applied even if one of the early filters returns
#.  SECCOMP_RET_KILL:
#.      It's just because it would be an optimization that would only speed up
#.      the RET_KILL case, but it's the uncommon one and the one that doesn't
#.      benefit meaningfully from such a change (you need to kill the process
#.      really quickly?). We would speed up killing a program at the (albeit
#.      tiny) expense to all other filtered programs. Best to keep the filter
#.      execution logic clear, simple, and as fast as possible for all
#.      filters.
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"If multiple filters exist, they are I<all> executed, in reverse order of "
"their addition to the filter tree\\[em]that is, the most recently installed "
"filter is executed first.  (Note that all filters will be called even if one "
"of the earlier filters returns B<SECCOMP_RET_KILL>.  This is done to "
"simplify the kernel code and to provide a tiny speed-up in the execution of "
"sets of filters by avoiding a check for this uncommon case.)  The return "
"value for the evaluation of a given system call is the first-seen action "
"value of highest precedence (along with its accompanying data)  returned by "
"execution of all of the filters."
msgstr ""
"Si plusieurs filtres existent, ils sont I<tous> exécutés dans l'ordre "
"inverse de leur apparition dans l'arbre des filtres – si bien que le filtre "
"le plus récemment installé est exécuté en premier) (remarquez que tous les "
"filtres seront appelés même si l'un des premiers appelés renvoie "
"B<SECCOMP_RET_KILL>, cela pour simplifier le code du noyau et pour fournir "
"une petite accélération d’exécution d’ensembles de filtres en évitant la "
"vérification de ce cas rare). La valeur renvoyée de l'évaluation d'un appel "
"système donné est la première valeur vue de l'action de plus haute priorité "
"(ainsi que ses données associées) renvoyée par l'exécution de tous les "
"filtres."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"In decreasing order of precedence, the action values that may be returned by "
"a seccomp filter are:"
msgstr ""
"Dans l'ordre décroissant de priorité, les valeurs d'action qui peuvent être "
"renvoyées par un filtre seccomp sont :"

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_RET_KILL_PROCESS> (since Linux 4.14)"
msgstr "B<SECCOMP_RET_KILL_PROCESS> (depuis Linux 4.14)"

#.  commit 4d3b0b05aae9ee9ce0970dc4cc0fb3fad5e85945
#.  commit 0466bdb99e8744bc9befa8d62a317f0fd7fd7421
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"This value results in immediate termination of the process, with a core "
"dump.  The system call is not executed.  By contrast with "
"B<SECCOMP_RET_KILL_THREAD> below, all threads in the thread group are "
"terminated.  (For a discussion of thread groups, see the description of the "
"B<CLONE_THREAD> flag in B<clone>(2).)"
msgstr ""
"Cette valeur aboutit à la fin immédiate du processus, avec un vidage "
"mémoire. L'appel système n'est pas exécuté. Contrairement à "
"B<SECCOMP_RET_KILL_THREAD> ci-dessous, tous les threads du groupe de threads "
"sont terminés (pour un point sur les groupes de thread, voir la description "
"de l'attribut B<CLONE_THREAD> de B<clone>(2))."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The process terminates I<as though> killed by a B<SIGSYS> signal.  Even if a "
"signal handler has been registered for B<SIGSYS>, the handler will be "
"ignored in this case and the process always terminates.  To a parent process "
"that is waiting on this process (using B<waitpid>(2)  or similar), the "
"returned I<wstatus> will indicate that its child was terminated as though by "
"a B<SIGSYS> signal."
msgstr ""
"Le processus se termine I<parce que> il a été tué par un signal B<SIGSYS>. "
"Même si un gestionnaire de signal a été enregistré pour B<SIGSYS>, le "
"gestionnaire sera ignoré dans ce cas et le processus se termine toujours. Le "
"processus parent qui attend ce processus (en utilisant B<waitpid>(2) ou "
"équivalent) reçoit I<wstatus> qui indique que son enfant s'est terminé suite "
"à un signal B<SIGSYS>."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_RET_KILL_THREAD> (or B<SECCOMP_RET_KILL>)"
msgstr "B<SECCOMP_RET_KILL_THREAD> (ou B<SECCOMP_RET_KILL>)"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"This value results in immediate termination of the thread that made the "
"system call.  The system call is not executed.  Other threads in the same "
"thread group will continue to execute."
msgstr ""
"Cette valeur provoque la fin immédiate du thread qui a effectué l'appel "
"système. L'appel système n'est pas exécuté. Les autres threads du même "
"groupe de threads continueront à s'exécuter."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The thread terminates I<as though> killed by a B<SIGSYS> signal.  See "
"B<SECCOMP_RET_KILL_PROCESS> above."
msgstr ""
"Le thread s'est terminé I<comme> tué par un signal B<SIGSYS>. Voir "
"B<SECCOMP_RET_KILL_PROCESS> ci-dessus."

#.  See these commits:
#.  seccomp: dump core when using SECCOMP_RET_KILL
#.     (b25e67161c295c98acda92123b2dd1e7d8642901)
#.  seccomp: Only dump core when single-threaded
#.     (d7276e321ff8a53106a59c85ca46d03e34288893)
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Before Linux 4.11, any process terminated in this way would not trigger a "
"coredump (even though B<SIGSYS> is documented in B<signal>(7)  as having a "
"default action of termination with a core dump).  Since Linux 4.11, a single-"
"threaded process will dump core if terminated in this way."
msgstr ""
"Avant Linux 4.11, tout processus qui se terminait de cette manière ne "
"générait pas de vidage mémoire (bien que B<SIGSYS> soit documenté dans "
"B<signal>(7) pour avoir comme action par défaut celle de terminer avec un "
"vidage mémoire). Depuis Linux 4.11, un processus d'un seul thread créera un "
"vidage mémoire s'il se termine dans ce cadre."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"With the addition of B<SECCOMP_RET_KILL_PROCESS> in Linux 4.14, "
"B<SECCOMP_RET_KILL_THREAD> was added as a synonym for B<SECCOMP_RET_KILL>, "
"in order to more clearly distinguish the two actions."
msgstr ""
"Avec l'apparition de B<SECCOMP_RET_KILL_PROCESS> dans Linux 4.14, "
"B<SECCOMP_RET_KILL_THREAD> a été ajouté comme synonyme de "
"B<SECCOMP_RET_KILL>, afin de distinguer plus clairement les deux actions."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"B<Note>: the use of B<SECCOMP_RET_KILL_THREAD> to kill a single thread in a "
"multithreaded process is likely to leave the process in a permanently "
"inconsistent and possibly corrupt state."
msgstr ""
"B<Remarque :> l'utilisation de B<SECCOMP_RET_KILL_THREAD> pour tuer un "
"thread unique d'un processus de plusieurs threads va probablement mettre le "
"processus dans un état incohérent et corrompre pour toujours son état."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_RET_TRAP>"
msgstr "B<SECCOMP_RET_TRAP>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"This value results in the kernel sending a thread-directed B<SIGSYS> signal "
"to the triggering thread.  (The system call is not executed.)  Various "
"fields will be set in the I<siginfo_t> structure (see B<sigaction>(2))  "
"associated with signal:"
msgstr ""
"Cette valeur fait envoyer par le noyau un signal B<SIGSYS> adressé au thread "
"déclencheur (l'appel système n'est pas exécuté). Divers champs seront "
"positionnés dans la structure I<siginfo_t> (voir B<sigaction>(2)) associée "
"au signal :"

#. type: IP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "\\[bu]"
msgstr "-"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "I<si_signo> will contain B<SIGSYS>."
msgstr "I<si_signo> contiendra B<SIGSYS>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "I<si_call_addr> will show the address of the system call instruction."
msgstr ""
"I<si_call_addr> affichera l'adresse de l'instruction de l'appel système."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"I<si_syscall> and I<si_arch> will indicate which system call was attempted."
msgstr ""
"I<si_syscall> et I<si_arch> indiqueront l'appel système qui a été tenté."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "I<si_code> will contain B<SYS_SECCOMP>."
msgstr "I<si_code> contiendra B<SYS_SECCOMP>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"I<si_errno> will contain the B<SECCOMP_RET_DATA> portion of the filter "
"return value."
msgstr ""
"I<si_errno> contiendra la partie B<SECCOMP_RET_DATA> du code de retour du "
"filtre."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The program counter will be as though the system call happened (i.e., the "
"program counter will not point to the system call instruction).  The return "
"value register will contain an architecture-dependent value; if resuming "
"execution, set it to something appropriate for the system call.  (The "
"architecture dependency is because replacing it with B<ENOSYS> could "
"overwrite some useful information.)"
msgstr ""
"Le compteur du programme sera arrêté comme si l'appel système a été fait "
"(c'est-à-dire que le compteur du programme ne pointera pas vers "
"l'instruction de l'appel système). Le registre du code de retour contiendra "
"une valeur dépendante de l'architecture ; en cas de relance de l'exécution, "
"positionnez-la sur quelque chose adapté à l'appel système (la dépendance de "
"l'architecture provient du fait que son remplacement par B<ENOSYS> "
"écraserait des informations utiles)."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_RET_ERRNO>"
msgstr "B<SECCOMP_RET_ERRNO>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"This value results in the B<SECCOMP_RET_DATA> portion of the filter's return "
"value being passed to user space as the I<errno> value without executing the "
"system call."
msgstr ""
"Cette valeur fait passer la partie B<SECCOMP_RET_DATA> du code de retour du "
"filtre à l'espace utilisateur en tant que valeur I<errno> sans exécuter "
"l'appel système."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_RET_USER_NOTIF> (since Linux 5.0)"
msgstr "B<SECCOMP_RET_USER_NOTIF> (depuis Linux 5.0)"

#.  commit 6a21cc50f0c7f87dae5259f6cfefe024412313f6
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Forward the system call to an attached user-space supervisor process to "
"allow that process to decide what to do with the system call.  If there is "
"no attached supervisor (either because the filter was not installed with the "
"B<SECCOMP_FILTER_FLAG_NEW_LISTENER> flag or because the file descriptor was "
"closed), the filter returns B<ENOSYS> (similar to what happens when a filter "
"returns B<SECCOMP_RET_TRACE> and there is no tracer).  See "
"B<seccomp_unotify>(2)  for further details."
msgstr ""
"Faire suivre l'appel système à un processus de superviseur attaché de "
"l'espace utilisateur attaché pour permettre à ce processus de décider quoi "
"faire de l'appel système. Si il n'y a pas de superviseur attaché (soit parce "
"que le filtre n'a pas été installé avec l'attribut "
"B<SECCOMP_FILTER_FLAG_NEW_LISTENER> ou parce que le descripteur de fichier "
"était fermé), le filtre renvoie B<ENOSYS> (c'est similaire à ce qui se "
"produit quand un filtre renvoie B<SECCOMP_RET_TRACE> et qu'il n'y a pas "
"d'observateur). Consultez B<seccomp_unotify>(2) pour plus de détails."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Note that the supervisor process will not be notified if another filter "
"returns an action value with a precedence greater than "
"B<SECCOMP_RET_USER_NOTIF>."
msgstr ""
"Remarquez que le processus de superviseur ne sera pas notifié si un autre "
"filtre renvoie une valeur d'action ayant une priorité supérieure à "
"B<SECCOMP_RET_USER_NOTIF>."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_RET_TRACE>"
msgstr "B<SECCOMP_RET_TRACE>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"When returned, this value will cause the kernel to attempt to notify a "
"B<ptrace>(2)-based tracer prior to executing the system call.  If there is "
"no tracer present, the system call is not executed and returns a failure "
"status with I<errno> set to B<ENOSYS>."
msgstr ""
"Quand cette valeur est renvoyée, le noyau essaiera de notifier à un "
"observateur basé sur B<ptrace>(2) avant d'exécuter l'appel système. Si aucun "
"observateur n'est présent, l'appel système n'est pas exécuté et renvoie un "
"échec en positionnant I<errno> sur B<ENOSYS>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"A tracer will be notified if it requests B<PTRACE_O_TRACESECCOMP> using "
"I<ptrace(PTRACE_SETOPTIONS)>.  The tracer will be notified of a "
"B<PTRACE_EVENT_SECCOMP> and the B<SECCOMP_RET_DATA> portion of the filter's "
"return value will be available to the tracer via B<PTRACE_GETEVENTMSG>."
msgstr ""
"Un observateur sera notifié s'il demande B<PTRACE_O_TRACESECCOMP> en "
"utilisant I<ptrace(PTRACE_SETOPTIONS)>. Il sera notifié d'un "
"B<PTRACE_EVENT_SECCOMP> et la partie B<SECCOMP_RET_DATA> du code de retour "
"du filtre sera mise à la disposition de l'observateur à l'aide de "
"B<PTRACE_GETEVENTMSG>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The tracer can skip the system call by changing the system call number to "
"-1.  Alternatively, the tracer can change the system call requested by "
"changing the system call to a valid system call number.  If the tracer asks "
"to skip the system call, then the system call will appear to return the "
"value that the tracer puts in the return value register."
msgstr ""
"L'observateur peut ignorer l'appel système en modifiant le numéro de l'appel "
"système à B<-1>. Autrement, l'observateur peut modifier l'appel système "
"demandé en le passant à un numéro d'appel système valable. Si l'observateur "
"demande à ignorer l'appel système, ce dernier renverra la valeur que "
"l'observateur place dans le registre du code de retour."

#.  This was changed in ce6526e8afa4.
#.  A related hole, using PTRACE_SYSCALL instead of SECCOMP_RET_TRACE, was
#.  changed in arch-specific commits, e.g. 93e35efb8de4 for X86 and
#.  0f3912fd934c for ARM.
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Before Linux 4.8, the seccomp check will not be run again after the tracer "
"is notified.  (This means that, on older kernels, seccomp-based sandboxes "
"B<must not> allow use of B<ptrace>(2)\\[em]even of other sandboxed "
"processes\\[em]without extreme care; ptracers can use this mechanism to "
"escape from the seccomp sandbox.)"
msgstr ""
"Avant Linux 4.8, la vérification seccomp ne sera pas refaite après que "
"l'observateur ait reçu une notification (cela signifie que sur les anciens "
"noyaux, les conteneurs basés sur seccomp B<ne doivent pas> autoriser "
"l'utilisation de B<ptrace>(2) – même sur d'autres processus encapsulés – "
"sans une prudence extrême ; les ptracers peuvent utiliser ce mécanisme pour "
"sortir d'un conteneur seccomp)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Note that a tracer process will not be notified if another filter returns an "
"action value with a precedence greater than B<SECCOMP_RET_TRACE>."
msgstr ""
"Remarquez que le processus d'un observateur ne sera pas notifié si un autre "
"filtre renvoie une valeur d'action ayant une priorité supérieure à "
"B<SECCOMP_RET_TRACE>."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_RET_LOG> (since Linux 4.14)"
msgstr "B<SECCOMP_RET_LOG> (depuis Linux 4.14)"

#.  commit 59f5cf44a38284eb9e76270c786fb6cc62ef8ac4
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"This value results in the system call being executed after the filter return "
"action is logged.  An administrator may override the logging of this action "
"via the I</proc/sys/kernel/seccomp/actions_logged> file."
msgstr ""
"Cette valeur fait exécuter l'appel système après l'enregistrement de "
"l'action de retour du filtre. Un administrateur peut supplanter la "
"journalisation de cette action à l'aide du fichier I</proc/sys/kernel/"
"seccomp/actions_logged>."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<SECCOMP_RET_ALLOW>"
msgstr "B<SECCOMP_RET_ALLOW>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "This value results in the system call being executed."
msgstr "Cette valeur provoque l'exécution de l'appel système."

#.  commit 4d3b0b05aae9ee9ce0970dc4cc0fb3fad5e85945
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"If an action value other than one of the above is specified, then the filter "
"action is treated as either B<SECCOMP_RET_KILL_PROCESS> (since Linux 4.14)  "
"or B<SECCOMP_RET_KILL_THREAD> (in Linux 4.13 and earlier)."
msgstr ""
"Si on indique un code d'action différent de ceux ci-dessus, l'action de "
"filtre est traitée soit comme un B<SECCOMP_RET_KILL_PROCESS> (depuis "
"Linux 4.14), soit comme un B<SECCOMP_RET_KILL_THREAD> (dans Linux 4.13 et "
"antérieurs)."

#. type: SS
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "/proc interfaces"
msgstr "/proc interfaces"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The files in the directory I</proc/sys/kernel/seccomp> provide additional "
"seccomp information and configuration:"
msgstr ""
"Les fichiers du répertoire I</proc/sys/kernel/seccomp> offrent des "
"informations et des configurations seccomp supplémentaires :"

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "I<actions_avail> (since Linux 4.14)"
msgstr "I<actions_avail> (depuis Linux 4.14)"

#.  commit 8e5f1ad116df6b0de65eac458d5e7c318d1c05af
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"A read-only ordered list of seccomp filter return actions in string form.  "
"The ordering, from left-to-right, is in decreasing order of precedence.  The "
"list represents the set of seccomp filter return actions supported by the "
"kernel."
msgstr ""
"Une liste ordonnée en lecture seule d'actions de renvoi de filtre seccomp "
"sous la forme d'une chaîne. L'ordre, de gauche à droite, est décroissant "
"pour la priorité. La liste représente l'ensemble des actions de renvoi de "
"filtre seccomp gérées par le noyau."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "I<actions_logged> (since Linux 4.14)"
msgstr "I<actions_logged> (depuis Linux 4.14)"

#.  commit 0ddec0fc8900201c0897b87b762b7c420436662f
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"A read-write ordered list of seccomp filter return actions that are allowed "
"to be logged.  Writes to the file do not need to be in ordered form but "
"reads from the file will be ordered in the same way as the I<actions_avail> "
"file."
msgstr ""
"Une liste ordonnée en lecture-écriture d'actions de renvoi de filtre seccomp "
"autorisées pour la journalisation. Les écritures dans le fichier n'ont pas "
"besoin d'être ordonnées, mais les lectures se feront dans le même ordre que "
"pour I<actions_avail>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"It is important to note that the value of I<actions_logged> does not prevent "
"certain filter return actions from being logged when the audit subsystem is "
"configured to audit a task.  If the action is not found in the "
"I<actions_logged> file, the final decision on whether to audit the action "
"for that task is ultimately left up to the audit subsystem to decide for all "
"filter return actions other than B<SECCOMP_RET_ALLOW>."
msgstr ""
"Il est important de remarquer que la valeur de I<actions_logged> n'empêche "
"pas certaines actions de renvoi de filtre d'être enregistrées quand le sous-"
"système d'audit est configuré pour auditer une tâche. Si l'action n'est pas "
"retrouvée dans le fichier I<actions_logged>, la décision finale d'auditer "
"l'action de cette tâche revient au sous-système d'audit pour toutes les "
"actions de renvoi de filtre autres que B<SECCOMP_RET_ALLOW>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The \"allow\" string is not accepted in the I<actions_logged> file as it is "
"not possible to log B<SECCOMP_RET_ALLOW> actions.  Attempting to write "
"\"allow\" to the file will fail with the error B<EINVAL>."
msgstr ""
"La chaîne « allow » n'est pas acceptée dans le fichier I<actions_logged> car "
"il n'est pas possible d'enregistrer les actions B<SECCOMP_RET_ALLOW>. "
"Essayer d'écrire « allow » dans le fichier échouera avec l'erreur B<EINVAL>."

#. type: SS
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "Audit logging of seccomp actions"
msgstr "Enregistrement d'audit des actions seccomp"

#.  commit 59f5cf44a38284eb9e76270c786fb6cc62ef8ac4
#.  or auditing could be enabled via the netlink API (AUDIT_SET)
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Since Linux 4.14, the kernel provides the facility to log the actions "
"returned by seccomp filters in the audit log.  The kernel makes the decision "
"to log an action based on the action type, whether or not the action is "
"present in the I<actions_logged> file, and whether kernel auditing is "
"enabled (e.g., via the kernel boot option I<audit=1>).  The rules are as "
"follows:"
msgstr ""
"Depuis Linux 4.14, le noyau offre la possibilité d'enregistrer les actions "
"renvoyées par des filtres seccomp dans le compte-rendu d'audit. Le noyau "
"prend la décision d'enregistrer une action à partir du type d'action, de sa "
"présence dans le fichier I<actions_logged> et de l'activation de l'audit du "
"noyau (par exemple avec l'option d'amorçage du noyau I<audit=1>). Les règles "
"sont les suivantes :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "If the action is B<SECCOMP_RET_ALLOW>, the action is not logged."
msgstr "Si l'action est B<SECCOMP_RET_ALLOW>, l'action n'est pas enregistrée."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Otherwise, if the action is either B<SECCOMP_RET_KILL_PROCESS> or "
"B<SECCOMP_RET_KILL_THREAD>, and that action appears in the I<actions_logged> "
"file, the action is logged."
msgstr ""
"Sinon, si l'action est B<SECCOMP_RET_KILL_PROCESS> ou "
"B<SECCOMP_RET_KILL_THREAD> et si elle apparaît dans le fichier "
"I<actions_logged>, l'action est enregistrée."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Otherwise, if the filter has requested logging (the "
"B<SECCOMP_FILTER_FLAG_LOG> flag)  and the action appears in the "
"I<actions_logged> file, the action is logged."
msgstr ""
"Sinon, si le filtre a demandé l'enregistrement (l'attribut "
"B<SECCOMP_FILTER_FLAG_LOG>) et si elle apparaît dans le fichier "
"I<actions_logged>, l'action est enregistrée."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Otherwise, if kernel auditing is enabled and the process is being audited "
"(B<autrace>(8)), the action is logged."
msgstr ""
"Sinon, si l'audit du noyau est activé et si le processus doit être audité "
"(B<autrace>(8)), l'action est enregistrée."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "Otherwise, the action is not logged."
msgstr "Sinon, l'action n'est pas enregistrée."

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "RETURN VALUE"
msgstr "VALEUR RENVOYÉE"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"On success, B<seccomp>()  returns 0.  On error, if "
"B<SECCOMP_FILTER_FLAG_TSYNC> was used, the return value is the ID of the "
"thread that caused the synchronization failure.  (This ID is a kernel thread "
"ID of the type returned by B<clone>(2)  and B<gettid>(2).)  On other errors, "
"-1 is returned, and I<errno> is set to indicate the error."
msgstr ""
"En cas de succès, B<seccomp>() renvoie B<0>. En cas d'erreur, si "
"B<SECCOMP_FILTER_FLAG_TSYNC> a été utilisé, le code de retour est "
"l'identifiant du thread à l'origine de l'échec de la synchronisation (cet "
"identifiant est un identifiant de thread du noyau du type renvoyé par "
"B<clone>(2) et B<gettid>(2)). Si une autre erreur arrive, B<-1> est renvoyé "
"et I<errno> est positionné pour indiquer l'erreur."

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "ERRORS"
msgstr "ERREURS"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "B<seccomp>()  can fail for the following reasons:"
msgstr "B<seccomp>() peut échouer pour les raisons suivantes :"

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<EACCES>"
msgstr "B<EACCES>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The caller did not have the B<CAP_SYS_ADMIN> capability in its user "
"namespace, or had not set I<no_new_privs> before using "
"B<SECCOMP_SET_MODE_FILTER>."
msgstr ""
"L'appelant n'avait pas la capacité B<CAP_SYS_ADMIN> dans son espace de noms "
"utilisateur ou n'avait pas positionné I<no_new_privs> avant d'utiliser "
"B<SECCOMP_SET_MODE_FILTER>."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<EBUSY>"
msgstr "B<EBUSY>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"While installing a new filter, the B<SECCOMP_FILTER_FLAG_NEW_LISTENER> flag "
"was specified, but a previous filter had already been installed with that "
"flag."
msgstr ""
"Pendant l'installation d'un nouveau filtre, l'attribut "
"B<SECCOMP_FILTER_FLAG_NEW_LISTENER> a été indiqué, mais un filtre précédent "
"a déjà été installé avec cet attribut."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<EFAULT>"
msgstr "B<EFAULT>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "I<args> was not a valid address."
msgstr "I<args> n'était pas une adresse valable."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<EINVAL>"
msgstr "B<EINVAL>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"I<operation> is unknown or is not supported by this kernel version or "
"configuration."
msgstr ""
"L'I<opération> est inconnue ou n'est pas prise en charge par cette version "
"ou cette configuration du noyau."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "The specified I<flags> are invalid for the given I<operation>."
msgstr ""
"Les I<flags> spécifiés ne sont pas valables pour l'I<opération> donnée."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"I<operation> included B<BPF_ABS>, but the specified offset was not aligned "
"to a 32-bit boundary or exceeded I<sizeof(struct\\ seccomp_data)>."
msgstr ""
"L'I<opération> comprenait B<BPF_ABS>, mais la position indiquée n'était pas "
"alignée sur une limite 32 bits ou elle dépassait I<sizeof(struct\\ "
"seccomp_data)>."

#.  See kernel/seccomp.c::seccomp_may_assign_mode() in Linux 3.18 sources
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"A secure computing mode has already been set, and I<operation> differs from "
"the existing setting."
msgstr ""
"Un mode de calcul sécurisé a déjà été défini et l'I<opération> diffère du "
"paramétrage existant."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"I<operation> specified B<SECCOMP_SET_MODE_FILTER>, but the filter program "
"pointed to by I<args> was not valid or the length of the filter program was "
"zero or exceeded B<BPF_MAXINSNS> (4096) instructions."
msgstr ""
"I<opération> indiquait B<SECCOMP_SET_MODE_FILTER> mais le programme de "
"filtre vers lequel pointait I<args> n'était pas valable ou sa longueur était "
"de zéro ou dépassait B<BPF_MAXINSNS> instructions (4096)."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<ENOMEM>"
msgstr "B<ENOMEM>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "Out of memory."
msgstr "Plus assez de mémoire."

#.  ENOMEM in kernel/seccomp.c::seccomp_attach_filter() in Linux 3.18 sources
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The total length of all filter programs attached to the calling thread would "
"exceed B<MAX_INSNS_PER_PATH> (32768) instructions.  Note that for the "
"purposes of calculating this limit, each already existing filter program "
"incurs an overhead penalty of 4 instructions."
msgstr ""
"La taille totale de tous les programmes de filtre rattachés au thread "
"appelant dépasserait B<MAX_INSNS_PER_PATH> instructions (32768). Remarquez "
"qu'afin de calculer cette limite, chaque programme de filtre déjà existant "
"intègre une pénalité de dépassement de B<4> instructions."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<EOPNOTSUPP>"
msgstr "B<EOPNOTSUPP>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"I<operation> specified B<SECCOMP_GET_ACTION_AVAIL>, but the kernel does not "
"support the filter return action specified by I<args>."
msgstr ""
"I<opération> indiquait B<SECCOMP_GET_ACTION_AVAIL> mais le noyau ne gère pas "
"l'action de renvoi de filtre indiquée par I<args>."

#. type: TP
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "B<ESRCH>"
msgstr "B<ESRCH>"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Another thread caused a failure during thread sync, but its ID could not be "
"determined."
msgstr ""
"Un autre thread a provoqué un échec pendant la synchronisation, mais son "
"identifiant n'a pas pu être déterminé."

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "STANDARDS"
msgstr "STANDARDS"

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
#: opensuse-leap-15-6 opensuse-tumbleweed
msgid "Linux."
msgstr "Linux."

#. type: SH
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
#: opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "HISTORY"
msgstr "HISTORIQUE"

#.  FIXME . Add glibc version
#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
#: opensuse-leap-15-6 opensuse-tumbleweed
msgid "Linux 3.17."
msgstr "Linux 3.17."

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "NOTES"
msgstr "NOTES"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Rather than hand-coding seccomp filters as shown in the example below, you "
"may prefer to employ the I<libseccomp> library, which provides a front-end "
"for generating seccomp filters."
msgstr ""
"Au lieu de coder à la main des filtres seccomp comme démontré dans l'exemple "
"ci-dessous, vous pourriez préférer utiliser la bibliothèque I<libseccomp> "
"qui fournit une interface de génération de filtres seccomp."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The I<Seccomp> field of the I</proc/>pidI</status> file provides a method of "
"viewing the seccomp mode of a process; see B<proc>(5)."
msgstr ""
"Le champ I<Seccomp> du fichier I</proc/>pidI</status> offre une méthode de "
"visualisation du mode seccomp du processus ; voir B<proc>(5)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"B<seccomp>()  provides a superset of the functionality provided by the "
"B<prctl>(2)  B<PR_SET_SECCOMP> operation (which does not support I<flags>)."
msgstr ""
"B<seccomp>() fournit un sur-ensemble de fonctionnalités de l'opération "
"B<PR_SET_SECCOMP> de B<prctl>(2) (qui ne prend pas en charge les I<flags>)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Since Linux 4.4, the B<ptrace>(2)  B<PTRACE_SECCOMP_GET_FILTER> operation "
"can be used to dump a process's seccomp filters."
msgstr ""
"Depuis Linux 4.4, l'opération B<PTRACE_SECCOMP_GET_FILTER> de B<ptrace>(2) "
"peut être utilisée pour obtenir les filtres seccomp d'un processus."

#. type: SS
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "Architecture support for seccomp BPF"
msgstr "Gestion d'architecture pour le BPF seccomp"

#.  Check by grepping for HAVE_ARCH_SECCOMP_FILTER in Kconfig files in
#.  kernel source. Last checked in Linux 4.16-rc source.
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Architecture support for seccomp BPF filtering is available on the following "
"architectures:"
msgstr ""
"La gestion d'architecture pour le filtrage de BPF seccomp est disponible sur "
"les architectures suivantes :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "x86-64, i386, x32 (since Linux 3.5)"
msgstr "x86-64, i386, x32 (depuis Linux 3.5)"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "ARM (since Linux 3.8)"
msgstr "ARM (depuis Linux 3.8)"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "s390 (since Linux 3.8)"
msgstr "s390 (depuis Linux 3.8)"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "MIPS (since Linux 3.16)"
msgstr "MIPS (depuis Linux 3.16)"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "ARM-64 (since Linux 3.19)"
msgstr "ARM-64 (depuis Linux 3.19)"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "PowerPC (since Linux 4.3)"
msgstr "PowerPC (depuis Linux 4.3)"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "Tile (since Linux 4.3)"
msgstr "Tile (depuis Linux 4.3)"

#.  User mode Linux since Linux 4.6
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "PA-RISC (since Linux 4.6)"
msgstr "PA-RISC (depuis Linux 4.6)"

#. type: SS
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "Caveats"
msgstr "Mises en garde"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"There are various subtleties to consider when applying seccomp filters to a "
"program, including the following:"
msgstr ""
"Il y a beaucoup de subtilités à prendre en compte lorsqu'on applique des "
"filtres seccomp à un programme, notamment :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Some traditional system calls have user-space implementations in the "
"B<vdso>(7)  on many architectures.  Notable examples include "
"B<clock_gettime>(2), B<gettimeofday>(2), and B<time>(2).  On such "
"architectures, seccomp filtering for these system calls will have no "
"effect.  (However, there are cases where the B<vdso>(7)  implementations may "
"fall back to invoking the true system call, in which case seccomp filters "
"would see the system call.)"
msgstr ""
"Certains appels système traditionnels ont des implémentations dans l'espace "
"utilisateur dans le B<vdso>(7) de nombreuses architectures. Parmi les "
"exemples remarquables, se trouvent B<clock_gettime>(2), B<gettimeofday>(2) "
"et B<time>(2). Sur de telles architectures, le filtrage seccomp de ces "
"appels système sera sans effet (il y a cependant des cas où les "
"implémentations B<vdso>(7) se rabattent sur le véritable appel système, "
"alors les filtres seccomp verraient l'appel système)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Seccomp filtering is based on system call numbers.  However, applications "
"typically do not directly invoke system calls, but instead call wrapper "
"functions in the C library which in turn invoke the system calls.  "
"Consequently, one must be aware of the following:"
msgstr ""
"Le filtrage seccomp s'appuie sur les numéros d'appel système. Cependant, les "
"applications n'appellent généralement pas directement les appels système, "
"mais plutôt les fonctions enveloppe de la bibliothèque C qui appellent à "
"leur tour les appels système. Par conséquent, vous devez garder en tête ce "
"qui suit :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The glibc wrappers for some traditional system calls may actually employ "
"system calls with different names in the kernel.  For example, the "
"B<exit>(2)  wrapper function actually employs the B<exit_group>(2)  system "
"call, and the B<fork>(2)  wrapper function actually calls B<clone>(2)."
msgstr ""
"Les enveloppes de la glibc pour certains appels système traditionnels "
"peuvent utiliser des appels système ayant des noms différents dans le noyau. "
"Par exemple, la fonction enveloppe B<exit>(2) utilise en fait l'appel "
"système B<exit_group>(2) et la fonction B<fork>(2) utilise en réalité les "
"appels B<clone>(2)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The behavior of wrapper functions may vary across architectures, according "
"to the range of system calls provided on those architectures.  In other "
"words, the same wrapper function may invoke different system calls on "
"different architectures."
msgstr ""
"Le comportement des fonctions enveloppe peut changer en fonction des "
"architectures, selon la plage d'appels système fournie sur ces "
"architectures. Autrement dit, la même fonction enveloppe peut appeler "
"différents appels système selon les architectures."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Finally, the behavior of wrapper functions can change across glibc "
"versions.  For example, in older versions, the glibc wrapper function for "
"B<open>(2)  invoked the system call of the same name, but starting in glibc "
"2.26, the implementation switched to calling B<openat>(2)  on all "
"architectures."
msgstr ""
"Enfin, le comportement des fonctions enveloppe peut changer selon les "
"versions de la glibc. Par exemple, dans d'anciennes versions, la fonction "
"enveloppe de la glibc de B<open>(2) appelait l'appel système du même nom, "
"mais à partir de la 2.26, l'implémentation est passée à l'appel B<openat>(2) "
"sur toutes les architectures."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The consequence of the above points is that it may be necessary to filter "
"for a system call other than might be expected.  Various manual pages in "
"Section 2 provide helpful details about the differences between wrapper "
"functions and the underlying system calls in subsections entitled I<C "
"library/kernel differences>."
msgstr ""
"La conséquence des points ci-dessus est qu'il pourrait être nécessaire de "
"filtrer un appel système autre que celui prévu. Plusieurs pages de manuel de "
"la section 2 donnent des détails utiles sur les différences entre les "
"fonctions enveloppe et les appels système sous-jacents dans les sous-"
"sections intitulées I<Différences entre le noyau et la bibliothèque C>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Furthermore, note that the application of seccomp filters even risks causing "
"bugs in an application, when the filters cause unexpected failures for "
"legitimate operations that the application might need to perform.  Such bugs "
"may not easily be discovered when testing the seccomp filters if the bugs "
"occur in rarely used application code paths."
msgstr ""
"En outre, remarquez que l'application de filtres seccomp risque même de "
"provoquer des bogues dans une application, quand les filtres provoquent des "
"échecs inattendus d'opérations légitimes que l'application a besoin "
"d'effectuer. De tels bogues pourraient ne pas être facilement identifiés "
"lors d'un test des filtres seccomp s'ils se produisent à des endroits du "
"code rarement utilisés."

#. type: SS
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "Seccomp-specific BPF details"
msgstr "Détails BPF spécifiques à seccomp"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid "Note the following BPF details specific to seccomp filters:"
msgstr ""
"Remarquez que les détails BPF suivants sont spécifiques aux filtres seccomp :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The B<BPF_H> and B<BPF_B> size modifiers are not supported: all operations "
"must load and store (4-byte) words (B<BPF_W>)."
msgstr ""
"Les modificateurs de taille B<BPF_H> et B<BPF_B> ne sont pas pris en "
"charge : toutes les opérations doivent charger et stocker des mots "
"(4 octets) (B<BPF_W>)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"To access the contents of the I<seccomp_data> buffer, use the B<BPF_ABS> "
"addressing mode modifier."
msgstr ""
"Pour accéder au contenu du tampon I<seccomp_data>, utilisez le modificateur "
"du mode d'adressage B<BPF_ABS>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The B<BPF_LEN> addressing mode modifier yields an immediate mode operand "
"whose value is the size of the I<seccomp_data> buffer."
msgstr ""
"Le modificateur du mode d'adressage B<BPF_LEN> produit un opérande de mode "
"immédiatement dont la valeur est la taille du tampon I<seccomp_data>."

#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "EXAMPLES"
msgstr "EXEMPLES"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The program below accepts four or more arguments.  The first three arguments "
"are a system call number, a numeric architecture identifier, and an error "
"number.  The program uses these values to construct a BPF filter that is "
"used at run time to perform the following checks:"
msgstr ""
"Le programme ci-dessous accepte quatre paramètres ou plus. Les trois "
"premiers sont un numéro d'appel système, un identifiant numérique "
"d'architecture et un numéro d'erreur. Le programme utilise ces valeurs pour "
"construire un filtre BPF utilisé lors de l'exécution pour effectuer les "
"vérifications suivantes :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"If the program is not running on the specified architecture, the BPF filter "
"causes system calls to fail with the error B<ENOSYS>."
msgstr ""
"Si le programme ne tourne pas sur l'architecture indiquée, le filtre BPF "
"fait échouer les appels système avec l'erreur B<ENOSYS>."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"If the program attempts to execute the system call with the specified "
"number, the BPF filter causes the system call to fail, with I<errno> being "
"set to the specified error number."
msgstr ""
"Si le programme essaie d'exécuter l'appel système ayant le numéro indiqué, "
"le filtre BPF fait échouer l'appel système en positionnant I<errno> sur le "
"numéro d'erreur indiqué."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The remaining command-line arguments specify the pathname and additional "
"arguments of a program that the example program should attempt to execute "
"using B<execv>(3)  (a library function that employs the B<execve>(2)  system "
"call).  Some example runs of the program are shown below."
msgstr ""
"Les autres paramètres de la ligne de commande indiquent le chemin et les "
"paramètres supplémentaires d'un programme que notre exemple doit essayer "
"d'exécuter en utilisant B<execv>(3) (une fonction de bibliothèque qui "
"utilise l'appel système B<execve>(2)). Certains exemples d’exécution du "
"programme sont présentés ci-dessous."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"First, we display the architecture that we are running on (x86-64)  and then "
"construct a shell function that looks up system call numbers on this "
"architecture:"
msgstr ""
"Tout d'abord, on affiche l'architecture sur laquelle on est (x86-64) puis on "
"construit une fonction d’interpréteur qui cherche les numéros d'appels "
"système sur cette architecture :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"$ B<uname -m>\n"
"x86_64\n"
"$ B<syscall_nr() {\n"
"    cat /usr/src/linux/arch/x86/syscalls/syscall_64.tbl | \\e\n"
"    awk \\[aq]$2 != \"x32\" && $3 == \"\\[aq]$1\\[aq]\" { print $1 }\\[aq]\n"
"}>\n"
msgstr ""
"$ B<uname -m>\n"
"x86_64\n"
"$ B<syscall_nr() {\n"
"    cat /usr/src/linux/arch/x86/syscalls/syscall_64.tbl | \\e\n"
"    awk \\[aq]$2 != \"x32\" && $3 == \"\\[aq]$1\\[aq]\" { print $1 }\\[aq]\n"
"}>\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"When the BPF filter rejects a system call (case [2] above), it causes the "
"system call to fail with the error number specified on the command line.  In "
"the experiments shown here, we'll use error number 99:"
msgstr ""
"Quand le filtre BPF rejette un appel système (cas n° 2 ci-dessus), il fait "
"échouer l'appel système avec le numéro d'erreur indiqué sur la ligne de "
"commande. Dans les exemples présentés ici, nous utiliserons le numéro "
"d'erreur 99 :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"$ B<errno 99>\n"
"EADDRNOTAVAIL 99 Cannot assign requested address\n"
msgstr ""
"$ B<errno 99>\n"
"EADDRNOTAVAIL 99 Ne peut pas affecter l'adresse demandée\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"In the following example, we attempt to run the command B<whoami>(1), but "
"the BPF filter rejects the B<execve>(2)  system call, so that the command is "
"not even executed:"
msgstr ""
"Dans l'exemple suivant, on essaie d'exécuter la commande B<whoami>(1), mais "
"le filtre BPF rejette l'appel système B<execve>(2), donc la commande n'est "
"même pas exécutée :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"$ B<syscall_nr execve>\n"
"59\n"
"$ B<./a.out>\n"
"Usage: ./a.out E<lt>syscall_nrE<gt> E<lt>archE<gt> E<lt>errnoE<gt> E<lt>progE<gt> [E<lt>argsE<gt>]\n"
"Hint for E<lt>archE<gt>: AUDIT_ARCH_I386: 0x40000003\n"
"                 AUDIT_ARCH_X86_64: 0xC000003E\n"
"$ B<./a.out 59 0xC000003E 99 /bin/whoami>\n"
"execv: Cannot assign requested address\n"
msgstr ""
"$ B<syscall_nr execve>\n"
"59\n"
"$ B<./a.out>\n"
"Utilisation : ./a.out E<lt>syscall_nrE<gt> E<lt>archE<gt> E<lt>errnoE<gt> E<lt>progE<gt> [E<lt>argsE<gt>]\n"
"Astuce pour E<lt>archE<gt> : AUDIT_ARCH_I386: 0x40000003\n"
"                 AUDIT_ARCH_X86_64 : 0xC000003E\n"
"$ B<./a.out 59 0xC000003E 99 /bin/whoami>\n"
"execv : Ne peut pas affecter l'adresse demandée\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"In the next example, the BPF filter rejects the B<write>(2)  system call, so "
"that, although it is successfully started, the B<whoami>(1)  command is not "
"able to write output:"
msgstr ""
"Dans le prochain exemple, le filtre BPF rejette l'appel système B<write>(2) "
"pour que, même si elle a pu démarrer, la commande B<whoami>(1) ne puisse pas "
"écrire de sortie :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"$ B<syscall_nr write>\n"
"1\n"
"$ B<./a.out 1 0xC000003E 99 /bin/whoami>\n"
msgstr ""
"$ B<syscall_nr write>\n"
"1\n"
"$ B<./a.out 1 0xC000003E 99 /bin/whoami>\n"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"In the final example, the BPF filter rejects a system call that is not used "
"by the B<whoami>(1)  command, so it is able to successfully execute and "
"produce output:"
msgstr ""
"Dans le dernier exemple, le filtre BPF rejette un appel système qui n'est "
"pas utilisé par la commande B<whoami>(1), elle peut donc s'exécuter et "
"produire une sortie :"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid ""
"$ B<syscall_nr preadv>\n"
"295\n"
"$ B<./a.out 295 0xC000003E 99 /bin/whoami>\n"
"cecilia\n"
msgstr ""
"$ B<syscall_nr preadv>\n"
"295\n"
"$ B<./a.out 295 0xC000003E 99 /bin/whoami>\n"
"cecilia\n"

#. type: SS
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "Program source"
msgstr "Source du programme"

#. type: Plain text
#: archlinux debian-unstable fedora-40 fedora-rawhide mageia-cauldron
#: opensuse-tumbleweed
#, no-wrap
msgid ""
"#include E<lt>linux/audit.hE<gt>\n"
"#include E<lt>linux/filter.hE<gt>\n"
"#include E<lt>linux/seccomp.hE<gt>\n"
"#include E<lt>stddef.hE<gt>\n"
"#include E<lt>stdio.hE<gt>\n"
"#include E<lt>stdlib.hE<gt>\n"
"#include E<lt>sys/prctl.hE<gt>\n"
"#include E<lt>sys/syscall.hE<gt>\n"
"#include E<lt>unistd.hE<gt>\n"
"\\&\n"
"#define X32_SYSCALL_BIT 0x40000000\n"
"#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))\n"
"\\&\n"
"static int\n"
"install_filter(int syscall_nr, unsigned int t_arch, int f_errno)\n"
"{\n"
"    unsigned int upper_nr_limit = 0xffffffff;\n"
"\\&\n"
"    /* Assume that AUDIT_ARCH_X86_64 means the normal x86-64 ABI\n"
"       (in the x32 ABI, all system calls have bit 30 set in the\n"
"       \\[aq]nr\\[aq] field, meaning the numbers are E<gt>= X32_SYSCALL_BIT). */\n"
"    if (t_arch == AUDIT_ARCH_X86_64)\n"
"        upper_nr_limit = X32_SYSCALL_BIT - 1;\n"
"\\&\n"
"    struct sock_filter filter[] = {\n"
"        /* [0] Load architecture from \\[aq]seccomp_data\\[aq] buffer into\n"
"               accumulator. */\n"
"        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,\n"
"                 (offsetof(struct seccomp_data, arch))),\n"
"\\&\n"
"        /* [1] Jump forward 5 instructions if architecture does not\n"
"               match \\[aq]t_arch\\[aq]. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, t_arch, 0, 5),\n"
"\\&\n"
"        /* [2] Load system call number from \\[aq]seccomp_data\\[aq] buffer into\n"
"               accumulator. */\n"
"        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,\n"
"                 (offsetof(struct seccomp_data, nr))),\n"
"\\&\n"
"        /* [3] Check ABI - only needed for x86-64 in deny-list use\n"
"               cases.  Use BPF_JGT instead of checking against the bit\n"
"               mask to avoid having to reload the syscall number. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, upper_nr_limit, 3, 0),\n"
"\\&\n"
"        /* [4] Jump forward 1 instruction if system call number\n"
"               does not match \\[aq]syscall_nr\\[aq]. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, syscall_nr, 0, 1),\n"
"\\&\n"
"        /* [5] Matching architecture and system call: don\\[aq]t execute\n"
"           the system call, and return \\[aq]f_errno\\[aq] in \\[aq]errno\\[aq]. */\n"
"        BPF_STMT(BPF_RET | BPF_K,\n"
"                 SECCOMP_RET_ERRNO | (f_errno & SECCOMP_RET_DATA)),\n"
"\\&\n"
"        /* [6] Destination of system call number mismatch: allow other\n"
"               system calls. */\n"
"        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),\n"
"\\&\n"
"        /* [7] Destination of architecture mismatch: kill process. */\n"
"        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),\n"
"    };\n"
"\\&\n"
"    struct sock_fprog prog = {\n"
"        .len = ARRAY_SIZE(filter),\n"
"        .filter = filter,\n"
"    };\n"
"\\&\n"
"    if (syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog)) {\n"
"        perror(\"seccomp\");\n"
"        return 1;\n"
"    }\n"
"\\&\n"
"    return 0;\n"
"}\n"
"\\&\n"
"int\n"
"main(int argc, char *argv[])\n"
"{\n"
"    if (argc E<lt> 5) {\n"
"        fprintf(stderr, \"Usage: \"\n"
"                \"%s E<lt>syscall_nrE<gt> E<lt>archE<gt> E<lt>errnoE<gt> E<lt>progE<gt> [E<lt>argsE<gt>]\\en\"\n"
"                \"Hint for E<lt>archE<gt>: AUDIT_ARCH_I386: 0x%X\\en\"\n"
"                \"                 AUDIT_ARCH_X86_64: 0x%X\\en\"\n"
"                \"\\en\", argv[0], AUDIT_ARCH_I386, AUDIT_ARCH_X86_64);\n"
"        exit(EXIT_FAILURE);\n"
"    }\n"
"\\&\n"
"    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {\n"
"        perror(\"prctl\");\n"
"        exit(EXIT_FAILURE);\n"
"    }\n"
"\\&\n"
"    if (install_filter(strtol(argv[1], NULL, 0),\n"
"                       strtoul(argv[2], NULL, 0),\n"
"                       strtol(argv[3], NULL, 0)))\n"
"        exit(EXIT_FAILURE);\n"
"\\&\n"
"    execv(argv[4], &argv[4]);\n"
"    perror(\"execv\");\n"
"    exit(EXIT_FAILURE);\n"
"}\n"
msgstr ""
"#include E<lt>linux/audit.hE<gt>\n"
"#include E<lt>linux/filter.hE<gt>\n"
"#include E<lt>linux/seccomp.hE<gt>\n"
"#include E<lt>stddef.hE<gt>\n"
"#include E<lt>stdio.hE<gt>\n"
"#include E<lt>stdlib.hE<gt>\n"
"#include E<lt>sys/prctl.hE<gt>\n"
"#include E<lt>sys/syscall.hE<gt>\n"
"#include E<lt>unistd.hE<gt>\n"
"\\&\n"
"#define X32_SYSCALL_BIT 0x40000000\n"
"#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))\n"
"\\&\n"
"static int\n"
"install_filter(int syscall_nr, unsigned int t_arch, int f_errno)\n"
"{\n"
"    unsigned int upper_nr_limit = 0xffffffff;\n"
"\\&\n"
"    /* On suppose que AUDIT_ARCH_X86_64 renvoie à l'ABI x86-64 normale\n"
"       (dans l'ABI x32, tous les appels système ont le bit 30 positionné\n"
"       dans le champ \\[aq]nr\\[aq], donc les numéros sont\n"
"       E<gt>= X32_SYSCALL_BIT). */\n"
"    if (t_arch == AUDIT_ARCH_X86_64)\n"
"        upper_nr_limit = X32_SYSCALL_BIT - 1;\n"
"\\&\n"
"    struct sock_filter filter[] = {\n"
"        /* [0] Charger l'architecture depuis le tampon \\[aq]seccomp_data\\[aq]\n"
"               dans l'accumulateur. */\n"
"        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,\n"
"                 (offsetof(struct seccomp_data, arch))),\n"
"\\&\n"
"        /* [1] Avancer de 5 instructions si l'architecture ne \n"
"               correspond pas à \\[aq]t_arch\\[aq]. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, t_arch, 0, 5),\n"
"\\&\n"
"        /* [2] Charger le numéro d'appel système depuis le tampon\n"
"               \\[aq]seccomp_data\\[aq] dans l'accumulateur. */\n"
"        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,\n"
"                 (offsetof(struct seccomp_data, nr))),\n"
"\\&\n"
"        /* [3] Vérifier l'ABI - nécessaire seulement pour x86-64 si on\n"
"               utilise une liste d'interdictions. Utiliser BPF_JGT au lieu de\n"
"               vérifier par rapport au masque de bits pour ne pas devoir\n"
"               recharger le numéro d'appel système. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, upper_nr_limit, 3, 0),\n"
"\\&\n"
"        /* [4] Avancer d'une instruction si le numéro d'appel système\n"
"               ne correspond pas à \\[aq]syscall_nr\\[aq]. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, syscall_nr, 0, 1),\n"
"\\&\n"
"        /* [5] Architecture et appel système correspondants : ne pas\n"
"           exécuter l'appel système et renvoyer \\[aq]f_errno\\[aq] dans\n"
"           \\[aq]errno\\[aq]. */\n"
"        BPF_STMT(BPF_RET | BPF_K,\n"
"                 SECCOMP_RET_ERRNO | (f_errno & SECCOMP_RET_DATA)),\n"
"\\&\n"
"        /* [6] Cible du numéro d’appel système inadéquate :\n"
"               autoriser d'autres appels système. */\n"
"        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),\n"
"\\&\n"
"        /* [7] Cible de l’architecture inadéquate : tuer le processus. */\n"
"        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),\n"
"    };\n"
"\\&\n"
"    struct sock_fprog prog = {\n"
"        .len = ARRAY_SIZE(filter),\n"
"        .filter = filter,\n"
"    };\n"
"\\&\n"
"    if (syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog)) {\n"
"        perror(\"seccomp\");\n"
"        return 1;\n"
"    }\n"
"\\&\n"
"    return 0;\n"
"}\n"
"\\&\n"
"int\n"
"main(int argc, char *argv[])\n"
"{\n"
"    if (argc E<lt> 5) {\n"
"        fprintf(stderr, \"Utilisation : \"\n"
"                \"%s E<lt>syscall_nrE<gt> E<lt>archE<gt> E<lt>errnoE<gt> E<lt>progE<gt> [E<lt>argsE<gt>]\\en\"\n"
"                \"Astuce pour E<lt>archE<gt> : AUDIT_ARCH_I386: 0x%X\\en\"\n"
"                \"                 AUDIT_ARCH_X86_64: 0x%X\\en\"\n"
"                \"\\en\", argv[0], AUDIT_ARCH_I386, AUDIT_ARCH_X86_64);\n"
"        exit(EXIT_FAILURE);\n"
"    }\n"
"\\&\n"
"    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {\n"
"        perror(\"prctl\");\n"
"        exit(EXIT_FAILURE);\n"
"    }\n"
"\\&\n"
"    if (install_filter(strtol(argv[1], NULL, 0),\n"
"                       strtoul(argv[2], NULL, 0),\n"
"                       strtol(argv[3], NULL, 0)))\n"
"        exit(EXIT_FAILURE);\n"
"\\&\n"
"    execv(argv[4], &argv[4]);\n"
"    perror(\"execv\");\n"
"    exit(EXIT_FAILURE);\n"
"}\n"

#.  SRC END
#. type: SH
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
#, no-wrap
msgid "SEE ALSO"
msgstr "VOIR AUSSI"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"B<bpfc>(1), B<strace>(1), B<bpf>(2), B<prctl>(2), B<ptrace>(2), "
"B<seccomp_unotify>(2), B<sigaction>(2), B<proc>(5), B<signal>(7), "
"B<socket>(7)"
msgstr ""
"B<bpfc>(1), B<strace>(1), B<bpf>(2), B<prctl>(2), B<ptrace>(2), "
"B<seccomp_unotify>(2), B<sigaction>(2), B<proc>(5), B<signal>(7), "
"B<socket>(7)"

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"Various pages from the I<libseccomp> library, including: "
"B<scmp_sys_resolver>(1), B<seccomp_export_bpf>(3), B<seccomp_init>(3), "
"B<seccomp_load>(3), and B<seccomp_rule_add>(3)."
msgstr ""
"Plusieurs pages de la bibliothèque I<libseccomp>, dont : "
"B<scmp_sys_resolver>(1), B<seccomp_export_bpf>(3), B<seccomp_init>(3), "
"B<seccomp_load>(3) et B<seccomp_rule_add>(3)."

#.  commit c061f33f35be0ccc80f4b8e0aea5dfd2ed7e01a3
#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"The kernel source files I<Documentation/networking/filter.txt> and "
"I<Documentation/userspace-api/seccomp_filter.rst> (or I<Documentation/prctl/"
"seccomp_filter.txt> before Linux 4.13)."
msgstr ""
"Les fichiers I<Documentation/networking/filter.txt> et I<Documentation/"
"userspace-api/seccomp_filter.rst> des sources du noyau (ou I<Documentation/"
"prctl/seccomp_filter.txt> avant Linux 4.13)."

#. type: Plain text
#: archlinux debian-bookworm debian-unstable fedora-40 fedora-rawhide
#: mageia-cauldron opensuse-leap-15-6 opensuse-tumbleweed
msgid ""
"McCanne, S.\\& and Jacobson, V.\\& (1992)  I<The BSD Packet Filter: A New "
"Architecture for User-level Packet Capture>, Proceedings of the USENIX "
"Winter 1993 Conference E<.UR http://www.tcpdump.org/papers/bpf-usenix93.pdf> "
"E<.UE>"
msgstr ""
"McCanne, S.\\& et Jacobson, V.\\& (1992)  I<The BSD Packet Filter : une "
"nouvelle architecture de captation de paquets au niveau utilisateur>, "
"colloque de la conférence USENIX à l'hiver 1993 E<.UR http://www.tcpdump.org/"
"papers/bpf-usenix93.pdf> E<.UE>"

#. type: TH
#: debian-bookworm
#, no-wrap
msgid "2023-02-05"
msgstr "5 février 2023"

#. type: TH
#: debian-bookworm
#, no-wrap
msgid "Linux man-pages 6.03"
msgstr "Pages du manuel de Linux 6.03"

#. type: SH
#: debian-bookworm
#, no-wrap
msgid "VERSIONS"
msgstr "VERSIONS"

#.  FIXME . Add glibc version
#. type: Plain text
#: debian-bookworm
msgid "The B<seccomp>()  system call first appeared in Linux 3.17."
msgstr ""
"L'appel système B<seccomp>() est apparu pour la première fois dans Linux "
"3.17."

#. type: Plain text
#: debian-bookworm
msgid "The B<seccomp>()  system call is a nonstandard Linux extension."
msgstr "L'appel système B<seccomp>() est une extension Linux non standard."

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"#include E<lt>linux/audit.hE<gt>\n"
"#include E<lt>linux/filter.hE<gt>\n"
"#include E<lt>linux/seccomp.hE<gt>\n"
"#include E<lt>stddef.hE<gt>\n"
"#include E<lt>stdio.hE<gt>\n"
"#include E<lt>stdlib.hE<gt>\n"
"#include E<lt>sys/prctl.hE<gt>\n"
"#include E<lt>sys/syscall.hE<gt>\n"
"#include E<lt>unistd.hE<gt>\n"
msgstr ""
"#include E<lt>linux/audit.hE<gt>\n"
"#include E<lt>linux/filter.hE<gt>\n"
"#include E<lt>linux/seccomp.hE<gt>\n"
"#include E<lt>stddef.hE<gt>\n"
"#include E<lt>stdio.hE<gt>\n"
"#include E<lt>stdlib.hE<gt>\n"
"#include E<lt>sys/prctl.hE<gt>\n"
"#include E<lt>sys/syscall.hE<gt>\n"
"#include E<lt>unistd.hE<gt>\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"#define X32_SYSCALL_BIT 0x40000000\n"
"#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))\n"
msgstr ""
"#define X32_SYSCALL_BIT 0x40000000\n"
"#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"static int\n"
"install_filter(int syscall_nr, unsigned int t_arch, int f_errno)\n"
"{\n"
"    unsigned int upper_nr_limit = 0xffffffff;\n"
msgstr ""
"static int\n"
"install_filter(int syscall_nr, unsigned int t_arch, int f_errno)\n"
"{\n"
"    unsigned int upper_nr_limit = 0xffffffff;\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"    /* Assume that AUDIT_ARCH_X86_64 means the normal x86-64 ABI\n"
"       (in the x32 ABI, all system calls have bit 30 set in the\n"
"       \\[aq]nr\\[aq] field, meaning the numbers are E<gt>= X32_SYSCALL_BIT). */\n"
"    if (t_arch == AUDIT_ARCH_X86_64)\n"
"        upper_nr_limit = X32_SYSCALL_BIT - 1;\n"
msgstr ""
"    /* On suppose que AUDIT_ARCH_X86_64 renvoie à l'ABI x86-64 normale\n"
"       (dans l'ABI x32, tous les appels système ont le bit 30 positionné\n"
"       dans le champ \\[aq]nr\\[aq], donc les numéros sont\n"
"       E<gt>= X32_SYSCALL_BIT). */\n"
"    if (t_arch == AUDIT_ARCH_X86_64)\n"
"        upper_nr_limit = X32_SYSCALL_BIT - 1;\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"    struct sock_filter filter[] = {\n"
"        /* [0] Load architecture from \\[aq]seccomp_data\\[aq] buffer into\n"
"               accumulator. */\n"
"        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,\n"
"                 (offsetof(struct seccomp_data, arch))),\n"
msgstr ""
"    struct sock_filter filter[] = {\n"
"        /* [0] Charger l'architecture depuis le tampon \\[aq]seccomp_data\\[aq]\n"
"               dans l'accumulateur. */\n"
"        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,\n"
"                 (offsetof(struct seccomp_data, arch))),\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"        /* [1] Jump forward 5 instructions if architecture does not\n"
"               match \\[aq]t_arch\\[aq]. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, t_arch, 0, 5),\n"
msgstr ""
"        /* [1] Avancer de 5 instructions si l'architecture ne \n"
"               correspond pas à \\[aq]t_arch\\[aq]. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, t_arch, 0, 5),\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"        /* [2] Load system call number from \\[aq]seccomp_data\\[aq] buffer into\n"
"               accumulator. */\n"
"        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,\n"
"                 (offsetof(struct seccomp_data, nr))),\n"
msgstr ""
"        /* [2] Charger le numéro d'appel système depuis le tampon\n"
"               \\[aq]seccomp_data\\[aq] dans l'accumulateur. */\n"
"        BPF_STMT(BPF_LD | BPF_W | BPF_ABS,\n"
"                 (offsetof(struct seccomp_data, nr))),\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"        /* [3] Check ABI - only needed for x86-64 in deny-list use\n"
"               cases.  Use BPF_JGT instead of checking against the bit\n"
"               mask to avoid having to reload the syscall number. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, upper_nr_limit, 3, 0),\n"
msgstr ""
"        /* [3] Vérifier l'ABI - nécessaire seulement pour x86-64 si on\n"
"               utilise une liste d'interdictions. Utiliser BPF_JGT au lieu de\n"
"               vérifier par rapport au masque de bits pour ne pas devoir\n"
"               recharger le numéro d'appel système. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JGT | BPF_K, upper_nr_limit, 3, 0),\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"        /* [4] Jump forward 1 instruction if system call number\n"
"               does not match \\[aq]syscall_nr\\[aq]. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, syscall_nr, 0, 1),\n"
msgstr ""
"        /* [4] Avancer d'une instruction si le numéro d'appel système\n"
"               ne correspond pas à \\[aq]syscall_nr\\[aq]. */\n"
"        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, syscall_nr, 0, 1),\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"        /* [5] Matching architecture and system call: don\\[aq]t execute\n"
"           the system call, and return \\[aq]f_errno\\[aq] in \\[aq]errno\\[aq]. */\n"
"        BPF_STMT(BPF_RET | BPF_K,\n"
"                 SECCOMP_RET_ERRNO | (f_errno & SECCOMP_RET_DATA)),\n"
msgstr ""
"        /* [5] Architecture et appel système correspondants : ne pas\n"
"           exécuter l'appel système et renvoyer \\[aq]f_errno\\[aq] dans\n"
"           \\[aq]errno\\[aq]. */\n"
"        BPF_STMT(BPF_RET | BPF_K,\n"
"                 SECCOMP_RET_ERRNO | (f_errno & SECCOMP_RET_DATA)),\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"        /* [6] Destination of system call number mismatch: allow other\n"
"               system calls. */\n"
"        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),\n"
msgstr ""
"        /* [6] Cible du numéro d’appel système inadéquate :\n"
"               autoriser d'autres appels système. */\n"
"        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"        /* [7] Destination of architecture mismatch: kill process. */\n"
"        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),\n"
"    };\n"
msgstr ""
"        /* [7] Cible de l’architecture inadéquate : tuer le processus. */\n"
"        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),\n"
"    };\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"    struct sock_fprog prog = {\n"
"        .len = ARRAY_SIZE(filter),\n"
"        .filter = filter,\n"
"    };\n"
msgstr ""
"    struct sock_fprog prog = {\n"
"        .len = ARRAY_SIZE(filter),\n"
"        .filter = filter,\n"
"    };\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"    if (syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog)) {\n"
"        perror(\"seccomp\");\n"
"        return 1;\n"
"    }\n"
msgstr ""
"    if (syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog)) {\n"
"        perror(\"seccomp\");\n"
"        return 1;\n"
"    }\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"    return 0;\n"
"}\n"
msgstr ""
"    return 0;\n"
"}\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"int\n"
"main(int argc, char *argv[])\n"
"{\n"
"    if (argc E<lt> 5) {\n"
"        fprintf(stderr, \"Usage: \"\n"
"                \"%s E<lt>syscall_nrE<gt> E<lt>archE<gt> E<lt>errnoE<gt> E<lt>progE<gt> [E<lt>argsE<gt>]\\en\"\n"
"                \"Hint for E<lt>archE<gt>: AUDIT_ARCH_I386: 0x%X\\en\"\n"
"                \"                 AUDIT_ARCH_X86_64: 0x%X\\en\"\n"
"                \"\\en\", argv[0], AUDIT_ARCH_I386, AUDIT_ARCH_X86_64);\n"
"        exit(EXIT_FAILURE);\n"
"    }\n"
msgstr ""
"int\n"
"main(int argc, char *argv[])\n"
"{\n"
"    if (argc E<lt> 5) {\n"
"        fprintf(stderr, \"Utilisation : \"\n"
"                \"%s E<lt>syscall_nrE<gt> E<lt>archE<gt> E<lt>errnoE<gt> E<lt>progE<gt> [E<lt>argsE<gt>]\\en\"\n"
"                \"Astuce pour E<lt>archE<gt> : AUDIT_ARCH_I386: 0x%X\\en\"\n"
"                \"                 AUDIT_ARCH_X86_64: 0x%X\\en\"\n"
"                \"\\en\", argv[0], AUDIT_ARCH_I386, AUDIT_ARCH_X86_64);\n"
"        exit(EXIT_FAILURE);\n"
"    }\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {\n"
"        perror(\"prctl\");\n"
"        exit(EXIT_FAILURE);\n"
"    }\n"
msgstr ""
"    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {\n"
"        perror(\"prctl\");\n"
"        exit(EXIT_FAILURE);\n"
"    }\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"    if (install_filter(strtol(argv[1], NULL, 0),\n"
"                       strtoul(argv[2], NULL, 0),\n"
"                       strtol(argv[3], NULL, 0)))\n"
"        exit(EXIT_FAILURE);\n"
msgstr ""
"    if (install_filter(strtol(argv[1], NULL, 0),\n"
"                       strtoul(argv[2], NULL, 0),\n"
"                       strtol(argv[3], NULL, 0)))\n"
"        exit(EXIT_FAILURE);\n"

#. type: Plain text
#: debian-bookworm opensuse-leap-15-6
#, no-wrap
msgid ""
"    execv(argv[4], &argv[4]);\n"
"    perror(\"execv\");\n"
"    exit(EXIT_FAILURE);\n"
"}\n"
msgstr ""
"    execv(argv[4], &argv[4]);\n"
"    perror(\"execv\");\n"
"    exit(EXIT_FAILURE);\n"
"}\n"

#. type: TH
#: fedora-40 fedora-rawhide mageia-cauldron
#, no-wrap
msgid "2023-10-31"
msgstr "31 octobre 2023"

#. type: TH
#: fedora-40 mageia-cauldron
#, no-wrap
msgid "Linux man-pages 6.06"
msgstr "Pages du manuel de Linux 6.06"

#. type: TH
#: fedora-rawhide
#, no-wrap
msgid "Linux man-pages 6.7"
msgstr "Pages du manuel de Linux 6.7"

#. type: TH
#: opensuse-leap-15-6
#, no-wrap
msgid "2023-03-30"
msgstr "30 mars 2023"

#. type: TH
#: opensuse-leap-15-6
#, no-wrap
msgid "Linux man-pages 6.04"
msgstr "Pages du manuel de Linux 6.04"

#. type: TH
#: opensuse-tumbleweed
#, no-wrap
msgid "Linux man-pages (unreleased)"
msgstr "Pages du manuel de Linux (non publiées)"