seccompy 0.1.0__tar.gz

seccompy-0.1.0/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: 0BSD
+
+* @Sudo-Ivan

seccompy-0.1.0/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5

seccompy-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: "9 7 * * 1"
+
+permissions: {}
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.11.32"
+          enable-cache: true
+
+      - run: uv sync --locked
+
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run bandit -r src/
+      - run: uv run mypy
+      - run: uvx ty check src tests
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.11.32"
+          enable-cache: true
+
+      - run: uv python install ${{ matrix.python }}
+      - run: uv sync --locked --python ${{ matrix.python }}
+      - run: uv run pytest --cov --cov-fail-under=80

seccompy-0.1.0/.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: "17 3 * * 4"
+
+permissions: {}
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          languages: python
+          queries: security-and-quality
+
+      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          category: "/language:python"

seccompy-0.1.0/.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency Review
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

seccompy-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,63 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions: {}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/seccompy
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.11.32"
+
+      - run: uv sync --locked
+
+      - name: Verify tag matches package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version="$(uv run python -c 'import seccompy; print(seccompy.__version__)')"
+          if [ "$tag" != "$version" ]; then
+            echo "tag $tag does not match package version $version" >&2
+            exit 1
+          fi
+
+      - run: uv build
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          attestations: true
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --verify-tag \
+            --title "${GITHUB_REF_NAME}" \
+            --generate-notes \
+            dist/*

seccompy-0.1.0/.github/workflows/scorecard.yml

@@ -0,0 +1,42 @@
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  push:
+    branches: [master]
+  workflow_dispatch:
+  schedule:
+    - cron: "42 5 * * 6"
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          sarif_file: results.sarif

seccompy-0.1.0/.github/workflows/zizmor.yml

@@ -0,0 +1,28 @@
+name: zizmor
+
+on:
+  push:
+    branches: [master]
+    paths: [.github/**]
+  pull_request:
+    paths: [.github/**]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false

seccompy-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.coverage*
+htmlcov/

seccompy-0.1.0/CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+
+## [Unreleased]
+
+## [0.1.0] - 2026-09-22
+
+Initial release.
+
+- Pure-Python classic BPF assembler for struct sock_filter programs,
+  with symbolic labels, forward-jump resolution and automatic JA
+  trampolines for conditional jumps beyond the 8-bit offset limit.
+- Filter API with a default action plus per-syscall rules: allow(),
+  kill() (KILL_PROCESS), kill_thread(), trap(), errno(), trace() and
+  log(), each optionally gated on equality of 64-bit syscall arguments.
+- Compiled programs always verify seccomp_data.arch against the native
+  AUDIT_ARCH_* value and kill foreign-ABI syscalls.
+- Raw ctypes bindings for seccomp(2) and prctl(PR_SET_NO_NEW_PRIVS),
+  with real kernel errnos preserved on SeccompError/UnsupportedError.
+- Kernel feature probes: supported(), action_supported() via
+  SECCOMP_GET_ACTION_AVAIL and flag_supported() via NULL-program flag
+  validation.
+- Full x86_64 and aarch64 syscall name/number tables generated from the
+  kernel UAPI headers, with syscall_nr() and syscall_name() helpers.
+- testing.probe() to run a callable under a filter in a forked child.

seccompy-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,19 @@
+# Contributing
+
+Report bugs through GitHub issues. Security reports go to
+security@quad4.io (see SECURITY.md).
+
+## Setup
+
+    uv sync
+    make check
+
+`make check` runs the full local gate: ruff lint and format, bandit,
+mypy strict, ty, and pytest with coverage.
+
+## Conventions
+
+- No runtime dependencies unless the project genuinely needs one.
+- Source files start with the SPDX license identifier.
+- Public API changes need tests.
+- Commit messages: short, imperative, formal.

seccompy-0.1.0/LICENSE

@@ -0,0 +1,12 @@
+Copyright (c) 2026 Quad4
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

seccompy-0.1.0/Makefile

@@ -0,0 +1,16 @@
+.PHONY: check lint test build
+
+check: lint test
+
+lint:
+	uv run ruff check .
+	uv run ruff format --check .
+	uv run bandit -r src/
+	uv run mypy
+	uvx ty check src tests
+
+test:
+	uv run pytest --cov --cov-report=term-missing
+
+build:
+	uv build

seccompy-0.1.0/PKG-INFO

@@ -0,0 +1,78 @@
+Metadata-Version: 2.5
+Name: seccompy
+Version: 0.1.0
+Summary: Python bindings for Linux seccomp-BPF syscall filtering
+Project-URL: Homepage, https://quad4.io
+Project-URL: Repository, https://github.com/Quad4-Software/seccompy
+Project-URL: Issues, https://github.com/Quad4-Software/seccompy/issues
+Project-URL: Changelog, https://github.com/Quad4-Software/seccompy/blob/master/CHANGELOG.md
+Author: Quad4
+License-Expression: 0BSD
+License-File: LICENSE
+Keywords: bpf,linux,sandbox,seccomp,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# seccompy
+
+[![CI](https://github.com/Quad4-Software/seccompy/actions/workflows/ci.yml/badge.svg)](https://github.com/Quad4-Software/seccompy/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/Quad4-Software/seccompy/actions/workflows/codeql.yml/badge.svg)](https://github.com/Quad4-Software/seccompy/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Quad4-Software/seccompy/badge)](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/seccompy)
+[![PyPI](https://img.shields.io/pypi/v/seccompy.svg)](https://pypi.org/project/seccompy/)
+[![License: 0BSD](https://img.shields.io/badge/license-0BSD-blue)](LICENSE)
+
+Dependency-free Python bindings for Linux seccomp-BPF syscall filtering.
+Filters are assembled in pure Python from symbolic instructions, checked
+against the native architecture to block ABI confusion, and installed
+through seccomp(2) with prctl(PR_SET_NO_NEW_PRIVS), so no compiler,
+libbpf or privileges are needed.
+
+Requires Python 3.10+ and Linux 3.17+ on x86_64 or aarch64.
+
+## Install
+
+    pip install seccompy
+
+## Usage
+
+```python
+import errno
+
+from seccompy import Action, Filter
+
+filt = Filter(default=Action.ALLOW)
+filt.errno("openat", errno.EACCES)
+filt.kill("ptrace")
+filt.log("mount")
+filt.load()
+
+# openat now fails with EACCES for this thread and its children,
+# ptrace kills the process, mount is allowed but logged
+```
+
+Rules can also match on 64-bit syscall arguments:
+
+```python
+filt.errno("write", errno.EIO, args={0: 1})  # deny write() on fd 1 only
+```
+
+`seccompy.supported()` reports whether the running kernel can install
+filters, `seccompy.action_supported(Action.X)` probes a return action
+and `seccompy.flag_supported(FilterFlag.X)` probes a load flag. The
+compiled BPF program is available as `filt.program` for inspection, and
+`seccompy.testing.probe()` runs a callable under a filter in a forked
+child to preview enforcement.
+
+## Documentation
+
+- API: docstrings in `src/seccompy/`, mostly `filter.py`
+- seccomp reference: https://docs.kernel.org/userspace-api/seccomp_filter.html
+- seccomp(2) man page: https://man7.org/linux/man-pages/man2/seccomp.2.html
+
+License: 0BSD.

seccompy-0.1.0/README.md

@@ -0,0 +1,57 @@
+# seccompy
+
+[![CI](https://github.com/Quad4-Software/seccompy/actions/workflows/ci.yml/badge.svg)](https://github.com/Quad4-Software/seccompy/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/Quad4-Software/seccompy/actions/workflows/codeql.yml/badge.svg)](https://github.com/Quad4-Software/seccompy/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Quad4-Software/seccompy/badge)](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/seccompy)
+[![PyPI](https://img.shields.io/pypi/v/seccompy.svg)](https://pypi.org/project/seccompy/)
+[![License: 0BSD](https://img.shields.io/badge/license-0BSD-blue)](LICENSE)
+
+Dependency-free Python bindings for Linux seccomp-BPF syscall filtering.
+Filters are assembled in pure Python from symbolic instructions, checked
+against the native architecture to block ABI confusion, and installed
+through seccomp(2) with prctl(PR_SET_NO_NEW_PRIVS), so no compiler,
+libbpf or privileges are needed.
+
+Requires Python 3.10+ and Linux 3.17+ on x86_64 or aarch64.
+
+## Install
+
+    pip install seccompy
+
+## Usage
+
+```python
+import errno
+
+from seccompy import Action, Filter
+
+filt = Filter(default=Action.ALLOW)
+filt.errno("openat", errno.EACCES)
+filt.kill("ptrace")
+filt.log("mount")
+filt.load()
+
+# openat now fails with EACCES for this thread and its children,
+# ptrace kills the process, mount is allowed but logged
+```
+
+Rules can also match on 64-bit syscall arguments:
+
+```python
+filt.errno("write", errno.EIO, args={0: 1})  # deny write() on fd 1 only
+```
+
+`seccompy.supported()` reports whether the running kernel can install
+filters, `seccompy.action_supported(Action.X)` probes a return action
+and `seccompy.flag_supported(FilterFlag.X)` probes a load flag. The
+compiled BPF program is available as `filt.program` for inspection, and
+`seccompy.testing.probe()` runs a callable under a filter in a forked
+child to preview enforcement.
+
+## Documentation
+
+- API: docstrings in `src/seccompy/`, mostly `filter.py`
+- seccomp reference: https://docs.kernel.org/userspace-api/seccomp_filter.html
+- seccomp(2) man page: https://man7.org/linux/man-pages/man2/seccomp.2.html
+
+License: 0BSD.

seccompy-0.1.0/SECURITY.md

@@ -0,0 +1,6 @@
+# Security policy
+
+Only the latest release is supported.
+
+Report vulnerabilities to security@quad4.io. Do not open public issues for
+security reports.

seccompy-0.1.0/pyproject.toml

@@ -0,0 +1,107 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "seccompy"
+dynamic = ["version"]
+description = "Python bindings for Linux seccomp-BPF syscall filtering"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "0BSD"
+authors = [{ name = "Quad4" }]
+keywords = ["seccomp", "bpf", "sandbox", "security", "linux"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: BSD License",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://quad4.io"
+Repository = "https://github.com/Quad4-Software/seccompy"
+Issues = "https://github.com/Quad4-Software/seccompy/issues"
+Changelog = "https://github.com/Quad4-Software/seccompy/blob/master/CHANGELOG.md"
+
+[tool.hatch.version]
+path = "src/seccompy/__init__.py"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+    "pytest-cov>=7.1.0",
+    "hypothesis>=6.140",
+    "ruff>=0.16.8",
+    "bandit>=1.9.4",
+    "mypy>=2.3.1",
+]
+
+[tool.ruff]
+target-version = "py310"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = [
+    "E", "W",   # pycodestyle
+    "F",        # pyflakes
+    "I",        # isort
+    "N",        # pep8-naming
+    "UP",       # pyupgrade
+    "YTT",      # sys.version misuse
+    "FA",       # future annotations
+    "A",        # builtins shadowing
+    "B",        # flake8-bugbear
+    "BLE",      # blind except
+    "C4",       # comprehensions
+    "C90",      # mccabe complexity
+    "DTZ",      # timezone-aware datetimes
+    "ERA",      # commented-out code
+    "FURB",     # refurb
+    "G",        # logging format
+    "ICN",      # import conventions
+    "ISC",      # implicit string concat
+    "LOG",      # logging
+    "PERF",     # perflint
+    "PGH",      # pygrep hooks
+    "PIE",      # misc lints
+    "PT",       # pytest style
+    "PTH",      # pathlib
+    "RET",      # return
+    "RSE",      # raise/return
+    "S",        # bandit rules
+    "SIM",      # simplify
+    "SLOT",     # __slots__
+    "T20",      # print
+    "TRY",      # exception handling
+    "RUF",      # ruff-specific
+]
+ignore = [
+    "ISC001",  # single-line implicit concat conflicts with the formatter
+    "TRY003",  # long messages in raise calls are fine
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = ["S101", "S603"]
+
+[tool.mypy]
+strict = true
+files = ["src", "tests"]
+
+[tool.bandit]
+exclude_dirs = ["tests"]
+
+[tool.coverage.run]
+branch = true
+source = ["src/seccompy"]
+
+[tool.coverage.report]
+show_missing = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+xfail_strict = true
+filterwarnings = ["error"]