Merge pull request #2969 from brauner/2019-05-01/seccomp_fixes

[mirror_lxc.git] / doc / api-extensions.md

diff --git a/doc/api-extensions.md b/doc/api-extensions.md
index 14a57235221e2fc1695cc8ef9b82d0b9cc9f507c..d5a0a3af74abd21811d77ec7f20ca01eb8e5bdab 100644 (file)
--- a/doc/api-extensions.md
+++ b/doc/api-extensions.md
@@ -33,8 +33,35 @@ This adds support for injecting and removing mounts into/from a running
 containers. Two new API functions `mount()` and `umount()` are added. They
 mirror the current mount and umount API of the kernel.
 
+## seccomp\_allow\_nesting
+
+This adds support for seccomp filters to be stacked regardless of whether a seccomp profile is
+already loaded. This allows nested containers to load their own seccomp profile.
+
+## seccomp\_notify
+
+This adds "notify" as seccomp action that will cause LXC to register a seccomp listener and retrieve
+a listener file descriptor from the kernel. When a syscall is made that is registered as "notify"
+the kernel will generate a poll event and send a message over the file descriptor.
+
+The caller can read this message, inspect the syscalls including its arguments. Based on this information the caller is expected to send back a message informing the kernel which action to take. Until that message is sent the kernel will block the calling process. The format of the messages to read and sent is documented in seccomp itself.
+
 ## network\_veth\_routes
 
 This introduces the `lxc.net.[i].veth.ipv4.route` and `lxc.net.[i].veth.ipv6.route` properties
 on `veth` type network interfaces. This allows adding static routes on host to the container's
 network interface.
+
+## network\_ipvlan
+
+This introduces the `ipvlan` network type.
+
+Example usage:
+
+```
+lxc.net[i].type=ipvlan
+lxc.net[i].ipvlan.mode=[l3|l3s|l2] (defaults to l3)
+lxc.net[i].ipvlan.isolation=[bridge|private|vepa] (defaults to bridge)
+lxc.net[i].link=eth0
+lxc.net[i].flags=up
+```