diff options
Diffstat (limited to 'vendor/github.com/seccomp/libseccomp-golang/seccomp.go')
| -rw-r--r-- | vendor/github.com/seccomp/libseccomp-golang/seccomp.go | 225 |
1 files changed, 24 insertions, 201 deletions
diff --git a/vendor/github.com/seccomp/libseccomp-golang/seccomp.go b/vendor/github.com/seccomp/libseccomp-golang/seccomp.go index e9b92e221..e489b9ebd 100644 --- a/vendor/github.com/seccomp/libseccomp-golang/seccomp.go +++ b/vendor/github.com/seccomp/libseccomp-golang/seccomp.go @@ -20,13 +20,6 @@ import ( // C wrapping code -// To compile libseccomp-golang against a specific version of libseccomp: -// cd ../libseccomp && mkdir -p prefix -// ./configure --prefix=$PWD/prefix && make && make install -// cd ../libseccomp-golang -// PKG_CONFIG_PATH=$PWD/../libseccomp/prefix/lib/pkgconfig/ make -// LD_PRELOAD=$PWD/../libseccomp/prefix/lib/libseccomp.so.2.5.0 PKG_CONFIG_PATH=$PWD/../libseccomp/prefix/lib/pkgconfig/ make test - // #cgo pkg-config: libseccomp // #include <stdlib.h> // #include <seccomp.h> @@ -41,25 +34,19 @@ type VersionError struct { minimum string } -func init() { - // This forces the cgo libseccomp to initialize its internal API support state, - // which is necessary on older versions of libseccomp in order to work - // correctly. - GetAPI() -} - func (e VersionError) Error() string { - messageStr := "" + format := "Libseccomp version too low: " if e.message != "" { - messageStr = e.message + ": " + format += e.message + ": " } - minimumStr := "" + format += "minimum supported is " if e.minimum != "" { - minimumStr = e.minimum + format += e.minimum + ": " } else { - minimumStr = "2.2.0" + format += "2.2.0: " } - return fmt.Sprintf("Libseccomp version too low: %sminimum supported is %s: detected %d.%d.%d", messageStr, minimumStr, verMajor, verMinor, verMicro) + format += "detected %d.%d.%d" + return fmt.Sprintf(format, verMajor, verMinor, verMicro) } // ScmpArch represents a CPU architecture. Seccomp can restrict syscalls on a @@ -82,61 +69,9 @@ type ScmpCondition struct { Operand2 uint64 `json:"operand_two,omitempty"` } -// Seccomp userspace notification structures associated with filters that use the ActNotify action. - -// ScmpSyscall identifies a Linux System Call by its number. +// ScmpSyscall represents a Linux System Call type ScmpSyscall int32 -// ScmpFd represents a file-descriptor used for seccomp userspace notifications. -type ScmpFd int32 - -// ScmpNotifData describes the system call context that triggered a notification. -// -// Syscall: the syscall number -// Arch: the filter architecture -// InstrPointer: address of the instruction that triggered a notification -// Args: arguments (up to 6) for the syscall -// -type ScmpNotifData struct { - Syscall ScmpSyscall `json:"syscall,omitempty"` - Arch ScmpArch `json:"arch,omitempty"` - InstrPointer uint64 `json:"instr_pointer,omitempty"` - Args []uint64 `json:"args,omitempty"` -} - -// ScmpNotifReq represents a seccomp userspace notification. See NotifReceive() for -// info on how to pull such a notification. -// -// ID: notification ID -// Pid: process that triggered the notification event -// Flags: filter flags (see seccomp(2)) -// Data: system call context that triggered the notification -// -type ScmpNotifReq struct { - ID uint64 `json:"id,omitempty"` - Pid uint32 `json:"pid,omitempty"` - Flags uint32 `json:"flags,omitempty"` - Data ScmpNotifData `json:"data,omitempty"` -} - -// ScmpNotifResp represents a seccomp userspace notification response. See NotifRespond() -// for info on how to push such a response. -// -// ID: notification ID (must match the corresponding ScmpNotifReq ID) -// Error: must be 0 if no error occurred, or an error constant from package -// syscall (e.g., syscall.EPERM, etc). In the latter case, it's used -// as an error return from the syscall that created the notification. -// Val: return value for the syscall that created the notification. Only -// relevant if Error is 0. -// Flags: userspace notification response flag (e.g., NotifRespFlagContinue) -// -type ScmpNotifResp struct { - ID uint64 `json:"id,omitempty"` - Error int32 `json:"error,omitempty"` - Val uint64 `json:"val,omitempty"` - Flags uint32 `json:"flags,omitempty"` -} - // Exported Constants const ( @@ -182,10 +117,6 @@ const ( ArchS390 ScmpArch = iota // ArchS390X represents 64-bit System z/390 syscalls ArchS390X ScmpArch = iota - // ArchPARISC represents 32-bit PA-RISC - ArchPARISC ScmpArch = iota - // ArchPARISC64 represents 64-bit PA-RISC - ArchPARISC64 ScmpArch = iota ) const ( @@ -199,9 +130,6 @@ const ( ActKill ScmpAction = iota // ActTrap throws SIGSYS ActTrap ScmpAction = iota - // ActNotify triggers a userspace notification. This action is only usable when - // libseccomp API level 6 or higher is supported. - ActNotify ScmpAction = iota // ActErrno causes the syscall to return a negative error code. This // code can be set with the SetReturnCode method ActErrno ScmpAction = iota @@ -253,21 +181,6 @@ const ( CompareMaskedEqual ScmpCompareOp = iota ) -var ( - // ErrSyscallDoesNotExist represents an error condition where - // libseccomp is unable to resolve the syscall - ErrSyscallDoesNotExist = fmt.Errorf("could not resolve syscall name") -) - -const ( - // Userspace notification response flags - - // NotifRespFlagContinue tells the kernel to continue executing the system - // call that triggered the notification. Must only be used when the notication - // response's error is 0. - NotifRespFlagContinue uint32 = 1 -) - // Helpers for types // GetArchFromString returns an ScmpArch constant from a string representing an @@ -310,10 +223,6 @@ func GetArchFromString(arch string) (ScmpArch, error) { return ArchS390, nil case "s390x": return ArchS390X, nil - case "parisc": - return ArchPARISC, nil - case "parisc64": - return ArchPARISC64, nil default: return ArchInvalid, fmt.Errorf("cannot convert unrecognized string %q", arch) } @@ -354,10 +263,6 @@ func (a ScmpArch) String() string { return "s390" case ArchS390X: return "s390x" - case ArchPARISC: - return "parisc" - case ArchPARISC64: - return "parisc64" case ArchNative: return "native" case ArchInvalid: @@ -405,8 +310,6 @@ func (a ScmpAction) String() string { case ActTrace: return fmt.Sprintf("Action: Notify tracing processes with code %d", (a >> 16)) - case ActNotify: - return "Action: Notify userspace" case ActLog: return "Action: Log system call" case ActAllow: @@ -446,7 +349,7 @@ func GetLibraryVersion() (major, minor, micro uint) { // Returns a positive int containing the API level, or 0 with an error if the // API level could not be detected due to the library being older than v2.4.0. // See the seccomp_api_get(3) man page for details on available API levels: -// https://github.com/seccomp/libseccomp/blob/main/doc/man/man3/seccomp_api_get.3 +// https://github.com/seccomp/libseccomp/blob/master/doc/man/man3/seccomp_api_get.3 func GetAPI() (uint, error) { return getAPI() } @@ -456,7 +359,7 @@ func GetAPI() (uint, error) { // Returns an error if the API level could not be set. An error is always // returned if the library is older than v2.4.0 // See the seccomp_api_get(3) man page for details on available API levels: -// https://github.com/seccomp/libseccomp/blob/main/doc/man/man3/seccomp_api_get.3 +// https://github.com/seccomp/libseccomp/blob/master/doc/man/man3/seccomp_api_get.3 func SetAPI(api uint) error { return setAPI(api) } @@ -483,7 +386,7 @@ func (s ScmpSyscall) GetNameByArch(arch ScmpArch) (string, error) { cString := C.seccomp_syscall_resolve_num_arch(arch.toNative(), C.int(s)) if cString == nil { - return "", ErrSyscallDoesNotExist + return "", fmt.Errorf("could not resolve syscall name for %#x", int32(s)) } defer C.free(unsafe.Pointer(cString)) @@ -506,7 +409,7 @@ func GetSyscallFromName(name string) (ScmpSyscall, error) { result := C.seccomp_syscall_resolve_name(cString) if result == scmpError { - return 0, ErrSyscallDoesNotExist + return 0, fmt.Errorf("could not resolve name to syscall: %q", name) } return ScmpSyscall(result), nil @@ -530,7 +433,7 @@ func GetSyscallFromNameByArch(name string, arch ScmpArch) (ScmpSyscall, error) { result := C.seccomp_syscall_resolve_name_arch(arch.toNative(), cString) if result == scmpError { - return 0, ErrSyscallDoesNotExist + return 0, fmt.Errorf("could not resolve name to syscall: %q on %v", name, arch) } return ScmpSyscall(result), nil @@ -603,10 +506,11 @@ type ScmpFilter struct { lock sync.Mutex } -// NewFilter creates and returns a new filter context. Accepts a default action to be -// taken for syscalls which match no rules in the filter. -// Returns a reference to a valid filter context, or nil and an error -// if the filter context could not be created or an invalid default action was given. +// NewFilter creates and returns a new filter context. +// Accepts a default action to be taken for syscalls which match no rules in +// the filter. +// Returns a reference to a valid filter context, or nil and an error if the +// filter context could not be created or an invalid default action was given. func NewFilter(defaultAction ScmpAction) (*ScmpFilter, error) { if err := ensureSupportedVersion(); err != nil { return nil, err @@ -626,8 +530,8 @@ func NewFilter(defaultAction ScmpAction) (*ScmpFilter, error) { filter.valid = true runtime.SetFinalizer(filter, filterFinalizer) - // Enable TSync so all goroutines will receive the same rules. - // If the kernel does not support TSYNC, allow us to continue without error. + // Enable TSync so all goroutines will receive the same rules + // If the kernel does not support TSYNC, allow us to continue without error if err := filter.setFilterAttr(filterAttrTsync, 0x1); err != nil && err != syscall.ENOTSUP { filter.Release() return nil, fmt.Errorf("could not create filter - error setting tsync bit: %v", err) @@ -874,9 +778,8 @@ func (f *ScmpFilter) GetNoNewPrivsBit() (bool, error) { func (f *ScmpFilter) GetLogBit() (bool, error) { log, err := f.getFilterAttr(filterAttrLog) if err != nil { - // Ignore error, if not supported returns apiLevel == 0 - apiLevel, _ := GetAPI() - if apiLevel < 3 { + api, apiErr := getAPI() + if (apiErr != nil && api == 0) || (apiErr == nil && api < 3) { return false, fmt.Errorf("getting the log bit is only supported in libseccomp 2.4.0 and newer with API level 3 or higher") } @@ -890,30 +793,6 @@ func (f *ScmpFilter) GetLogBit() (bool, error) { return true, nil } -// GetSSB returns the current state the SSB bit will be set to on the filter -// being loaded, or an error if an issue was encountered retrieving the value. -// The SSB bit tells the kernel that a seccomp user is not interested in enabling -// Speculative Store Bypass mitigation. -// The SSB bit is only usable when libseccomp API level 4 or higher is -// supported. -func (f *ScmpFilter) GetSSB() (bool, error) { - ssb, err := f.getFilterAttr(filterAttrSSB) - if err != nil { - api, apiErr := getAPI() - if (apiErr != nil && api == 0) || (apiErr == nil && api < 4) { - return false, fmt.Errorf("getting the SSB flag is only supported in libseccomp 2.5.0 and newer with API level 4 or higher") - } - - return false, err - } - - if ssb == 0 { - return false, nil - } - - return true, nil -} - // SetBadArchAction sets the default action taken on a syscall for an // architecture not in the filter, or an error if an issue was encountered // setting the value. @@ -953,32 +832,9 @@ func (f *ScmpFilter) SetLogBit(state bool) error { err := f.setFilterAttr(filterAttrLog, toSet) if err != nil { - // Ignore error, if not supported returns apiLevel == 0 - apiLevel, _ := GetAPI() - if apiLevel < 3 { - return fmt.Errorf("setting the log bit is only supported in libseccomp 2.4.0 and newer with API level 3 or higher") - } - } - - return err -} - -// SetSSB sets the state of the SSB bit, which will be applied on filter -// load, or an error if an issue was encountered setting the value. -// The SSB bit is only usable when libseccomp API level 4 or higher is -// supported. -func (f *ScmpFilter) SetSSB(state bool) error { - var toSet C.uint32_t = 0x0 - - if state { - toSet = 0x1 - } - - err := f.setFilterAttr(filterAttrSSB, toSet) - if err != nil { api, apiErr := getAPI() - if (apiErr != nil && api == 0) || (apiErr == nil && api < 4) { - return fmt.Errorf("setting the SSB flag is only supported in libseccomp 2.5.0 and newer with API level 4 or higher") + if (apiErr != nil && api == 0) || (apiErr == nil && api < 3) { + return fmt.Errorf("setting the log bit is only supported in libseccomp 2.4.0 and newer with API level 3 or higher") } } @@ -1091,36 +947,3 @@ func (f *ScmpFilter) ExportBPF(file *os.File) error { return nil } - -// Userspace Notification API - -// GetNotifFd returns the userspace notification file descriptor associated with the given -// filter context. Such a file descriptor is only valid after the filter has been loaded -// and only when the filter uses the ActNotify action. The file descriptor can be used to -// retrieve and respond to notifications associated with the filter (see NotifReceive(), -// NotifRespond(), and NotifIDValid()). -func (f *ScmpFilter) GetNotifFd() (ScmpFd, error) { - return f.getNotifFd() -} - -// NotifReceive retrieves a seccomp userspace notification from a filter whose ActNotify -// action has triggered. The caller is expected to process the notification and return a -// response via NotifRespond(). Each invocation of this function returns one -// notification. As multiple notifications may be pending at any time, this function is -// normally called within a polling loop. -func NotifReceive(fd ScmpFd) (*ScmpNotifReq, error) { - return notifReceive(fd) -} - -// NotifRespond responds to a notification retrieved via NotifReceive(). The response Id -// must match that of the corresponding notification retrieved via NotifReceive(). -func NotifRespond(fd ScmpFd, scmpResp *ScmpNotifResp) error { - return notifRespond(fd, scmpResp) -} - -// NotifIDValid checks if a notification is still valid. An return value of nil means the -// notification is still valid. Otherwise the notification is not valid. This can be used -// to mitigate time-of-check-time-of-use (TOCTOU) attacks as described in seccomp_notify_id_valid(2). -func NotifIDValid(fd ScmpFd, id uint64) error { - return notifIDValid(fd, id) -} |