Emelia/Emi on Nostr: The only way to invoke child processes on linux is via exec() and friends, so if ...

The only way to invoke child processes on linux is via exec() and friends, so if you're invoking bwrap via popen() (even if via an abstraction) all you need to do is clear the O_CLOEXIT flag on a memfd you stuff the BPF code into (which would ideally be done by the abstraction, of course)

bwrap does it that way because seccomp stuff is "a bit too unwieldy" to describe in command line parameters, since it takes compiled BPF bytecode directly. Much easier to make a memfd and pass the blob along that way. (If I had to guess, the reason it takes an fd over a filename is because you can use anonymous memfds without needing a writeable tempdir? not sure why there's not a "from file" option though; at least there's *probably* a bash-fu way to pass an fd for a file to something. Never had a need to, so don't know off the top of my head)