Repository navigation
support SECCOMP_IOCTL_NOTIF_ADDFD operation #126
Description
want to use SECCOMP_IOCTL_NOTIF_ADDED operation.
https://man7.org/linux/man-pages/man2/seccomp_unotify.2.html
SECCOMP_IOCTL_NOTIF_ADDFD
The SECCOMP_IOCTL_NOTIF_ADDFD operation (available since Linux
5.9) allows the supervisor to install a file descriptor into the
target's file descriptor table. Much like the use of SCM_RIGHTS
messages described in [unix(7)](https://man7.org/linux/man-pages/man7/unix.7.html), this operation is semantically
equivalent to duplicating a file descriptor from the supervisor's
file descriptor table into the target's file descriptor table.
https://github.com/seccomp/libseccomp/blob/main/include/seccomp.h.in#L415
Activity
kolyshkin commentedon Jul 21, 2026
@alban @rata PTAL (I will be happy to help)
rata commentedon Jul 21, 2026
@kolyshkin thanks!
@ukai this is supported for ~5years. It was added here: 78c92cb
This code was/is using it, if you want an example: https://github.com/kinvolk/seccompagent
ukai commentedon Jul 21, 2026
78c92cb
is just for seccomp notification, but it doesn't include NOTIF_ADDFD, does it?
kolyshkin commentedon Jul 21, 2026
Looks like
SECCOMP_IOCTL_NOTIF_ADDEDsupport can/should be added to x/sys/unixukai commentedon Jul 21, 2026
https://cs.opensource.google/go/x/sys/+/master:unix/zerrors_linux_amd64.go;l=318?q=NOTIF_ADDFD etc?
kolyshkin commentedon Jul 22, 2026
@ukai yes, the needed constants are there, but the needed structures (e.g.
seccomp_notif_addfd) is not there yet. This is the reason why I said "support can/should be added to x/sys/unix" earlier. Or, they might be added to this repo.Anyway, can you please describe your use case in greater details?
rata commentedon Jul 23, 2026
@ukai Ohhh, sorry, I misread your message. Yeap, I agree it makes sense, this should be simple to use from golang :)
@kolyshkin IMHO the use case is just using it. It can be like in the seccomp agent I showed or something else. If you want to use seccomp notify to hijack the socket() syscall, for example (interesting for IPv4 to IPv6 migrations or so).
I should add, though, that when we add support for this in the golang bindings, we should also support this flag: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v7.2-rc4&id=0ae71c7720e3ae3aabd2e8a072d27f7bd173d25c.
I did that patch basically because if the target program is in golang you always hit a race condition (because the runtime interrupts the processes with SIGUSR or so, for scheduling goroutines) and it's unusable in practice otherwise. With that flag, the agent can add an fd atomically, so it works fine when the target is golang.