1 files changed, 51 insertions, 0 deletions
diff --git a/helper/seccomp/api.go b/helper/seccomp/api.go
new file mode 100644
index 00000000..5b4a42c3
--- /dev/null
+++ b/helper/seccomp/api.go
@@ -0,0 +1,51 @@
+package seccomp
+
+import (
+	"errors"
+	"io"
+	"os"
+	"syscall"
+)
+
+func Export(opts SyscallOpts) (f *os.File, err error) {
+	if f, err = tmpfile(); err != nil {
+		return
+	}
+	if err = exportFilter(f.Fd(), opts); err != nil {
+		return
+	}
+	_, err = f.Seek(0, io.SeekStart)
+	return
+}
+
+/*
+An Encoder writes a BPF program to an output stream.
+
+Methods of Encoder are not safe for concurrent use.
+
+An Encoder must not be copied after first use.
+*/
+type Encoder struct {
+	*exporter
+}
+
+func (e *Encoder) Read(p []byte) (n int, err error) {
+	if err = e.prepare(); err != nil {
+		return
+	}
+	return e.r.Read(p)
+}
+
+func (e *Encoder) Close() error {
+	if e.r == nil {
+		return syscall.EINVAL
+	}
+
+	// this hangs if the cgo thread fails to exit
+	return errors.Join(e.closeWrite(), <-e.exportErr)
+}
+
+// New returns an inactive Encoder instance.
+func New(opts SyscallOpts) *Encoder {
+	return &Encoder{newExporter(opts)}
+}