diff --git a/man2/seccomp.2 b/man2/seccomp.2 index ac0070160..8ce1457ae 100644 --- a/man2/seccomp.2 +++ b/man2/seccomp.2 @@ -100,12 +100,17 @@ is allowed by the filter, the filters and constraints on permitted system calls are preserved across an .BR execve (2). -Prior to using this operation, the process must call -.IR "prctl(PR_SET_NO_NEW_PRIVS,\ 1)" -or run with +In order to use the +.BR SECCOMP_SET_MODE_FILTER +operation, either the caller must have the .BR CAP_SYS_ADMIN -privileges in its namespace. -If these are not true, the call will fail and return +capability or the call must be preceded by the call: + + prctl(PR_SET_NO_NEW_PRIVS, 1); + +Otherwise, the +.BR SECCOMP_SET_MODE_FILTER +operation will fail and return .BR EACCES in .IR errno .