SC-FILTERGEN:(8)

NAME
sc-filtergen - Seccomp filter generation made easy.

SYNOPSIS
sc-filtergen [options]

DESCRIPTION
sc-filtergen provides an easy to use interface for seccomp filter generation. sc-filtergen supports the use of templates and policy groups to quickly profile an application. Please note that while this tool can help with policy generation, its utility is dependent on the quality of the templates, policy groups and abstractions used. Also, this tool may create policy which is less restricted than creating policy by hand.

OPTIONS
sc-filtergen accepts the following arguments:

-t TEMPLATE, --template=TEMPLATE, --security-template=TEMPLATE
    Specify which system template to use from from /usr/share/seccomp/templates use. If not specified, use /usr/share/seccomp/templates/default.

-p POLICYGROUPS, --policy-groups=POLICYGROUPS, --caps=POLICYGROUPS
    Specify POLICYGROUPS as a comma-separated list of policy groups. The available policy groups are in /usr/share/seccomp/policygroups.

--syscalls=SYSCALLS
    Specify SYSCALLS as a comma-separated list of syscalls.

--policy-dir=PATH
    Use PATH instead of /usr/share/seccomp.

--include-policy-dir=PATH
    Use PATH instead of /var/lib/snappy/seccomp when searching for templates and policy groups in addition to the system policy. System policy will match before those in PATH.

--policy-version=VERSION
    Must be used with --policy-vendor and is used to specify the version of policy groups and templates. When specified, sc-filtergen looks for the subdirectory VENDOR/VERSION within the policy-groups and templates directory. The specified version must be a positive decimal number. Eg, when using:
      $ sc-filtergen --policy-dir=/usr/share/seccomp \
                     --policy-vendor="foo" \
                     --policy-version=1.0 Then /usr/share/seccomp/templates/foo/1.0 will be searched for templates and /usr/share/seccomp/policygroups/foo/1.0 for policy groups.

--policy-vendor=VENDOR
    Must be used with --policy-version and is used to specify the vendor for policy groups and templates. See --policy-version for more information.

-m MANIFEST, --manifest=MANIFEST
    sc-filtergen also supports using a Yaml manifest file for specifying options related to policy. The structure of the Yaml is:
      policy_vendor: ubuntu-core
      policy_version: 15.04
      caps:
        - bar
        - baz
      security-template: norf
      syscalls:
        - qux
        - quux A manifest file does not have to include all the fields.

-o FILE, --output-file=FILE
    Specify output file for profile. If unspecified, policy is sent to stdout.

BUGS

If you find any additional bugs, please report them to Launchpad at https://bugs.launchpad.net/ubuntu-core-security/+filebug.

SEE ALSO

scmp_sys_resolver(1)