prctl.2 man page (man-pages-3.30) wrote:
PR_SET_SECCOMP ... After the secure computing mode has been set to 1,
the only system calls that the thread is permitted to make are read(2),
write(2), _exit(2), and sigreturn(2),
but _exit(2) wrapper from 2.3 does not call _exit() sysscall but invokes
exit_group(2) syscall(see exit.2). This may lead to misunderstanding.
prctl.2 man page may contain some note about this fact too.
The patch which adds this note to prctl is attached
Ivana HUtarova Varekova
diff -up man-pages-3.30/man2/prctl.2.pom man-pages-3.30/man2/prctl.2
--- man-pages-3.30/man2/prctl.2.pom 2010-11-01 15:55:38.000000000 +0100
+++ man-pages-3.30/man2/prctl.2 2010-11-18 14:42:50.000000000 +0100
@@ -236,9 +236,15 @@ After the secure computing mode has been
the only system calls that the thread is permitted to make are
.BR read (2),
.BR write (2),
-.BR _exit (2),
+.BR sigreturn (2)
and
-.BR sigreturn (2).
+.BR _exit (2).
+In glibc up to version 2.3, the
+.BR _exit()
+wrapper function invoked the kernel system call of the same name.
+Since glibc 2.3, the wrapper function
+invokes
+.BR exit_group(2).
Other system calls result in the delivery of a
.BR SIGKILL
signal.
