pyseccomp_filter_init_with_kill_default_allow_write.py

1import seccomp
2import sys
3
4# Initialize the filter with the default action to kill the process 
5# if a syscall is made that does not match any of the rules.
6f = seccomp.SyscallFilter(defaction=seccomp.KILL)
7
8# Add a rule to allow the 'write' syscall.
9# This allows the process to output data to stdout/stderr.
10f.add_rule(seccomp.ALLOW, "write")
11
12# Load the filter into the kernel. 
13# After this call, any syscall not explicitly allowed will result in the process being killed.
14f.load()
15
16# Test the filter: this should work because 'write' is allowed.
17print("This message is allowed.")
18
19# Attempting an unallowed syscall (like 'open' or 'getpid' depending on environment) 
20# will now cause the kernel to terminate the process.