seccomp.2: Note that vDSO implementations sometimes fall back to real syscalls

Reported-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

diff --git a/man2/seccomp.2 b/man2/seccomp.2
index 7e6268eefdfc1a444b43cb7bb43958776033235d..7060ee5f1b5eab9ff25d556fd5aba2bb6c82c80f 100644 (file)
--- a/man2/seccomp.2
+++ b/man2/seccomp.2
@@ -709,6 +709,10 @@ and
 .BR time (2).
 On such architectures,
 seccomp filtering for these system calls will have no effect.
+(However, there are cases where the
+.BR vdso (7)
+implementations may fall back to invoking the true system call,
+in which case seccomp filters would see the system call.)
 .IP *
 Seccomp filtering is based on system call numbers.
 However, applications typically do not directly invoke system calls,