Convert man pages to markdown

Signed-off-by: Lucas Ramage <[email protected]>

doc/man/man1/scmp_sys_resolver.1.md

@@ -0,0 +1,62 @@
+NAME
+====
+
+scmp\_sys\_resolver - Resolve system calls
+
+SYNOPSIS
+========
+
+**scmp\_sys\_resolver** \[-h\] \[-a *ARCH* \] \[-t\] *SYSCALL\_NAME* \|
+*SYSCALL\_NUMBER*
+
+DESCRIPTION
+===========
+
+This command resolves both system call names and numbers with respect to
+the given architecture supplied in the optional *ARCH* argument. If the
+architecture is not supplied on the command line then the native
+architecture is used. If the \"-t\" argument is specified along with a
+system call name, then the system call will be translated as necessary
+for the given architecture. The \"-t\" argument has no effect if a
+system call number is specified.
+
+In some combinations of architecture and system call, a negative system
+call number will be displayed. A negative system call number indicates
+that the system call is not defined for the given architecture and is
+treated in a special manner by libseccomp depending on the operation.
+
+**-a *ARCH***
+
+:   The architecture to use for resolving the system call. Valid *ARCH*
+    values are \"x86\", \"x86\_64\", \"x32\", \"arm\", \"aarch64\",
+    \"mips\", \"mipsel\", \"mips64\", \"mipsel64\", \"mips64n32\",
+    \"mipsel64n32\", \"parisc\", \"parisc64\", \"ppc\", \"ppc64\",
+    \"ppc64le\", \"s390\" and \"s390x\".
+
+**-t**
+
+:   If necessary, translate the system call name to the proper system
+    call number, even if the system call name is different, e.g.
+    socket(2) on x86.
+
+**-h**
+
+:   A simple one-line usage display.
+
+EXIT STATUS
+===========
+
+Returns zero on success, errno values on failure.
+
+NOTES
+=====
+
+The libseccomp project site, with more information and the source code
+repository, can be found at https://github.com/seccomp/libseccomp. This
+tool, as well as the libseccomp library, is currently under development,
+please report any bugs at the project site or directly to the author.
+
+AUTHOR
+======
+
+Paul Moore \<paul\@paul-moore.com\>

doc/man/man3/seccomp_api_get.3.md

@@ -0,0 +1,104 @@
+NAME
+====
+
+seccomp\_api\_get, seccomp\_api\_set - Manage the libseccomp API level
+
+SYNOPSIS
+========
+
+    #include <seccomp.h>
+
+    const unsigned int seccomp_api_get(void);
+    int seccomp_api_set(unsigned int level);
+
+    Link with -lseccomp.
+
+DESCRIPTION
+===========
+
+The **seccomp\_api\_get**() function returns an integer representing the
+functionality (\"API level\") provided by the current running kernel. It
+is important to note that while **seccomp\_api\_get**() can be called
+multiple times, the kernel is only probed the first time to see what
+functionality is supported, all following calls to
+**seccomp\_api\_get**() return a cached value.
+
+The **seccomp\_api\_set**() function allows callers to force the API
+level to the provided value; however, this is almost always a bad idea
+and use of this function is strongly discouraged.
+
+The different API level values are described below:
+
+**0**
+
+:   Reserved value, not currently used.
+
+**1**
+
+:   Base level support.
+
+**2**
+
+:   The SCMP\_FLTATR\_CTL\_TSYNC filter attribute is supported and
+    libseccomp uses the **seccomp(2)** syscall to load the seccomp
+    filter into the kernel.
+
+**3**
+
+:   The SCMP\_FLTATR\_CTL\_LOG filter attribute and the SCMP\_ACT\_LOG
+    action are supported.
+
+**4**
+
+:   The SCMP\_FLTATR\_CTL\_SSB filter attribute is supported.
+
+**5**
+
+:   The SCMP\_ACT\_NOTIFY action is supported.
+
+RETURN VALUE
+============
+
+The **seccomp\_api\_get**() function returns an integer representing the
+supported API level. The **seccomp\_api\_set**() function returns zero
+on success, negative values on failure.
+
+EXAMPLES
+========
+
+    #include <seccomp.h>
+
+    int main(int argc, char *argv[])
+    {
+    	unsigned int api;
+
+    	api = seccomp_api_get();
+    	switch (api) {
+    	case 2:
+    		/* ... */
+    	default:
+    		/* ... */
+    	}
+
+    	return 0;
+
+    err:
+    	return -1;
+    }
+
+NOTES
+=====
+
+While the seccomp filter can be generated independent of the kernel,
+kernel support is required to load and enforce the seccomp filter
+generated by libseccomp.
+
+The libseccomp project site, with more information and the source code
+repository, can be found at https://github.com/seccomp/libseccomp. This
+tool, as well as the libseccomp library, is currently under development,
+please report any bugs at the project site or directly to the author.
+
+AUTHOR
+======
+
+Paul Moore \<paul\@paul-moore.com\>

doc/man/man3/seccomp_api_set.3.md

@@ -0,0 +1 @@
+

doc/man/man3/seccomp_arch_add.3.md

@@ -0,0 +1,114 @@
+NAME
+====
+
+seccomp\_arch\_add, seccomp\_arch\_remove, seccomp\_arch\_exist,
+seccomp\_arch\_native - Manage seccomp filter architectures
+
+SYNOPSIS
+========
+
+    #include <seccomp.h>
+
+    typedef void * scmp_filter_ctx;
+
+    #define SCMP_ARCH_NATIVE
+    #define SCMP_ARCH_X86
+    #define SCMP_ARCH_X86_64
+
+    uint32_t seccomp_arch_resolve_name(const char *arch_name);
+    uint32_t seccomp_arch_native();
+    int seccomp_arch_exist(const scmp_filter_ctx ctx, uint32_t arch_token);
+    int seccomp_arch_add(scmp_filter_ctx ctx, uint32_t arch_token);
+    int seccomp_arch_remove(scmp_filter_ctx ctx, uint32_t arch_token);
+
+    Link with -lseccomp.
+
+DESCRIPTION
+===========
+
+The **seccomp\_arch\_exist**() function tests to see if a given
+architecture has been added to the seccomp filter in *ctx* , where the
+**seccomp\_arch\_add**() and **seccomp\_arch\_remove**() add and remove,
+respectively, architectures from the seccomp filter. In all three
+functions, the architecture values given in *arch\_token* should be the
+**SCMP\_ARCH\_\*** defined constants; with the **SCMP\_ARCH\_NATIVE**
+constant always referring to the native compiled architecture. The
+**seccomp\_arch\_native**() function returns the system\'s architecture
+such that it will match one of the **SCMP\_ARCH\_\*** constants. While
+the **seccomp\_arch\_resolve\_name**() function also returns a
+**SCMP\_ARCH\_\*** constant, the returned token matches the name of the
+architecture passed as an argument to the function.
+
+When a seccomp filter is initialized with the call to
+**seccomp\_init**(3) the native architecture is automatically added to
+the filter.
+
+While it is possible to remove all architectures from a filter, most of
+the libseccomp APIs will fail if the filter does not contain at least
+one architecture.
+
+When adding a new architecture to an existing filter, the existing rules
+will not be added to the new architecture. However, rules added after
+adding the new architecture will be added to all of the architectures in
+the filter.
+
+RETURN VALUE
+============
+
+The **seccomp\_arch\_add**() and **seccomp\_arch\_remove**() functions
+return zero on success, negative errno values on failure. The
+**seccomp\_arch\_exist**() function returns zero if the architecture
+exists, -EEXIST if it does not, and other negative errno values on
+failure.
+
+EXAMPLES
+========
+
+    #include <seccomp.h>
+
+    int main(int argc, char *argv[])
+    {
+    	int rc = -1;
+    	scmp_filter_ctx ctx;
+
+    	ctx = seccomp_init(SCMP_ACT_KILL);
+    	if (ctx == NULL)
+    		goto out;
+
+    	if (seccomp_arch_exist(ctx, SCMP_ARCH_X86) == -EEXIST) {
+    		rc = seccomp_arch_add(ctx, SCMP_ARCH_X86);
+    		if (rc != 0)
+    			goto out_all;
+    		rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
+    		if (rc != 0)
+    			goto out_all;
+    	}
+
+    	/* ... */
+
+    out:
+    	seccomp_release(ctx);
+    	return -rc;
+    }
+
+NOTES
+=====
+
+While the seccomp filter can be generated independent of the kernel,
+kernel support is required to load and enforce the seccomp filter
+generated by libseccomp.
+
+The libseccomp project site, with more information and the source code
+repository, can be found at https://github.com/seccomp/libseccomp. This
+tool, as well as the libseccomp library, is currently under development,
+please report any bugs at the project site or directly to the author.
+
+AUTHOR
+======
+
+Paul Moore \<paul\@paul-moore.com\>
+
+SEE ALSO
+========
+
+**seccomp\_init**(3), **seccomp\_reset**(3), **seccomp\_merge**(3)

doc/man/man3/seccomp_arch_exist.3.md

@@ -0,0 +1 @@
+

doc/man/man3/seccomp_arch_native.3.md

@@ -0,0 +1 @@
+

doc/man/man3/seccomp_arch_remove.3.md

@@ -0,0 +1 @@
+

doc/man/man3/seccomp_arch_resolve_name.3.md

@@ -0,0 +1 @@
+

doc/man/man3/seccomp_attr_get.3.md

@@ -0,0 +1 @@
+