Repository navigation
RFE: Support for addfd to secomp user notifier #380
Description
The feature of addfd[1][2] allows the supervisor to install file descriptors into the intercepted task. By implementing this
feature via seccomp the supervisor effectively instructs the supervisee to install a set of file descriptors into its own file descriptor table during the intercepted syscall.
This feature is actullay used to accelerate the container network[3].
We want to need the support of addfd in libseccomp.
At first, I create the issue although @ManaSugi and I don't have enough time to implement it currently.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/seccomp.c?id=7cf97b12545503992020796c74bd84078eb39299
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/seccomp.c?id=0ae71c7720e3ae3aabd2e8a072d27f7bd173d25c
[3] https://github.com/rootless-containers/bypass4netns
Activity
brauner commentedon Apr 28, 2022
Yeah, it would be good to have this in libseccomp. We currently use this as well in an open-coded version in LXD https://github.com/lxc/lxd/blob/98935b925c0caffc9d4a083c191671d553739313/lxd/seccomp/seccomp.go#L395
it needs a nice API. And note usually this is paired with
pidfd_getfd().pcmoore commentedon Apr 28, 2022
Thanks for the issue, this has been in the back of my mind but I haven't had the chance to work on it yet. Having this as an issue should help a bit. I've gone ahead and added it to the v2.6.0 milestone too.
A quick word of caution if anyone else is looking into implementing this in libseccomp: before you simply copy the lxd code in Christian's reply, please note the license differences between the two projects.
brauner commentedon Apr 28, 2022
The seccomp selftests upstream also have the basic logic in there fwiw.
RichardDorian commentedon Oct 28, 2026
Hello, quite interested in this. What's the current state of this issue? Is this being worked on?
KentaTada commentedon Oct 28, 2026
@RichardDorian
Thank you for your interest. Currently, no work is being done on this issue.
RichardDorian commentedon Oct 28, 2026
After a quick look at the code base it seems implemented already (cf 6e12822). It's just unreleased.