get_filters (seccomp.rs)

Applies seccomp BPF filters to the calling thread for syscall sandboxing and restrictions.

// Source: https://github.com/nerdy-tech-com-gitub/firecracker | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
// Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
use std::fmt::Debug;
use std::fs::File;
use std::io::{BufReader, Read};
use std::path::Path;

use seccompiler::{deserialize_binary, BpfThreadMap, DeserializationError};
use vmm::seccomp_filters::get_empty_filters;

const THREAD_CATEGORIES: [&str; 3] = ["vmm", "api", "vcpu"];

// This byte limit is passed to `bincode` to guard against a potential memory
// allocation DOS caused by binary filters that are too large.
// This limit can be safely determined since t

... (truncated -- full source via MCP)