---
name: "PR_SET_SECCOMP"
section: "2const"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/PR_SET_SECCOMP"
---

# PR\_SET\_SECCOMP(2const)

set the secure computing mode

## NAME

PR\_SET\_SECCOMP - set the secure computing mode

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <linux/prctl.h>  /* Definition of PR_* constants */
#include <sys/prctl.h>
```

**\[\[deprecated\]\]** **int prctl(PR\_SET\_SECCOMP, long** *mode***, ...);**

**\[\[deprecated\]\]** **int prctl(PR\_SET\_SECCOMP, SECCOMP\_MODE\_STRICT);** **\[\[deprecated\]\]** **int prctl(PR\_SET\_SECCOMP, SECCOMP\_MODE\_FILTER,**           **struct sock\_fprog \****filter***);**

## DESCRIPTION

Set the secure computing (seccomp) mode for the calling thread, to limit the available system calls. The more recent [**seccomp**(2)](/seccomp/2.md) system call provides a superset of the functionality of **PR\_SET\_SECCOMP**, and is the preferred interface for new applications.

The seccomp mode is selected via *mode*. The seccomp constants are defined in *\<linux/seccomp.h\>*. The following values can be specified:

- **SECCOMP\_MODE\_STRICT** (since Linux 2.6.23)

  See the description of **SECCOMP\_SET\_MODE\_STRICT** in [**seccomp**(2)](/seccomp/2.md).

-

  This operation is available only if the kernel is configured with **CONFIG\_SECCOMP** enabled.

- **SECCOMP\_MODE\_FILTER** (since Linux 3.5)

  The allowed system calls are defined by a pointer to a Berkeley Packet Filter passed in *filter*. It can be designed to filter arbitrary system calls and system call arguments. See the description of **SECCOMP\_SET\_MODE\_FILTER** in [**seccomp**(2)](/seccomp/2.md).

-

  This operation is available only if the kernel is configured with **CONFIG\_SECCOMP\_FILTER** enabled.

## RETURN VALUE

On success, 0 is returned. On error, -1 is returned, and *errno* is set to indicate the error.

## ERRORS

- **EACCES**

  *mode* is **SECCOMP\_MODE\_FILTER**, but the process does not have the **CAP\_SYS\_ADMIN** capability or has not set the *no\_new\_privs* attribute (see [**PR\_SET\_NO\_NEW\_PRIVS**(2const)](/PR_SET_NO_NEW_PRIVS/2const.md)).

- **EFAULT**

  *mode* is **SECCOMP\_MODE\_FILTER**, and *filter* is an invalid address.

- **EINVAL**

  *mode* is not a valid value.

- **EINVAL**

  The kernel was not configured with **CONFIG\_SECCOMP**.

- **EINVAL**

  *mode* is **SECCOMP\_MODE\_FILTER**, and the kernel was not configured with **CONFIG\_SECCOMP\_FILTER**.

## STANDARDS

Linux.

## HISTORY

Linux 2.6.23.

## SEE ALSO

[**prctl**(2)](/prctl/2.md), [**PR\_GET\_SECCOMP**(2const)](/PR_GET_SECCOMP/2const.md), [**seccomp**(2)](/seccomp/2.md)