could not create filter

[18827555809]

ubuntu1~20.04
go version go1.20.6 linux/amd64
gcc version 9.4.0

package lib

import (
	"bytes"
	"encoding/binary"
	"log"
	"os"
	"syscall"
	"unsafe"

	sg "github.com/seccomp/libseccomp-golang"
)

func Seccomp(allowed_syscalls []int, allowed_not_kill_syscalls []int) error {
	log.Println("Starting Seccomp configuration")
	ctx, err := sg.NewFilter(sg.ActKillProcess)
	if err != nil {
		log.Printf("Failed to create new filter: %v", err)
		return err
	}

	reader, writer, err := os.Pipe()
	if err != nil {
		log.Printf("Failed to create pipe: %v", err)
		return err
	}
	defer reader.Close()
	defer writer.Close()

	for _, syscall := range allowed_syscalls {
		ctx.AddRule(sg.ScmpSyscall(syscall), sg.ActAllow)
	}

	for _, syscall := range allowed_not_kill_syscalls {
		ctx.AddRule(sg.ScmpSyscall(syscall), sg.ActErrno)
	}

	file := os.NewFile(uintptr(writer.Fd()), "pipe")
	ctx.ExportBPF(file)
	log.Println("BPF exported successfully")
	// read from pipe
	data := make([]byte, 4096)
	n, err := reader.Read(data)
	if err != nil {
		log.Printf("Failed to read from pipe: %v", err)
		return err
	}
	log.Printf("Read %d bytes from pipe", n)
	// load bpf
	sock_filters := make([]syscall.SockFilter, n/8)
	bytesBuffer := bytes.NewBuffer(data)
	err = binary.Read(bytesBuffer, binary.LittleEndian, &sock_filters)
	if err != nil {
		log.Printf("Failed to decode sock filters: %v", err)
		return err
	}
	log.Println("Sock filters decoded successfully")

	bpf := syscall.SockFprog{
		Len:    uint16(len(sock_filters)),
		Filter: &sock_filters[0],
	}

	_, _, err2 := syscall.Syscall(
		SYS_SECCOMP,
		uintptr(SeccompSetModeFilter),
		uintptr(SeccompFilterFlagTSYNC),
		uintptr(unsafe.Pointer(&bpf)),
	)

	if err2 != 0 {
		return err2
	}

	return nil
}

The above code is executed at "sg. NewFilter (sg. ActKillProcess)": "Failed to create new filter: could not create filter"

[kolyshkin]

This means that seccomp_init(3) failed. Note that sg.ActKillProcess requires API level 3 from the kernel -- this might be the reason for a failure.

You can get more information by using strace(1).