I've read that priority can be a value between 0 and 255 (http://man7.org/linux/man-pages/man3/seccomp_syscall_priority.3.html). Why using seccomp_export_pfc the baseline priority is 65535???
# filter for syscall "exit_group" (231) [priority: 65535]
if ($syscall == 231)
action ALLOW;
# filter for syscall "exit" (60) [priority: 65535]
if ($syscall == 60)
action ALLOW;
They are two different things: with seccomp_syscall_priority
, you provide a priority hint, whereas seccomp_export_pfc
outputs libseccomp's internal priority.
As explained in the source code comments, the internal priority contains your priority hint, if any, as the first 16 bits. The last 16 bits are useful is case of tie (i.e., two filters have the same upper 16 bits), in which case libseccomp gives higher priority to filters that are easier to evaluate.
So, in your case, since you did not provide any hint, the internal priority is equal to 0x0000FFFF
, or 65535.