diff options
Diffstat (limited to 'vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go')
| -rw-r--r-- | vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go | 176 |
1 files changed, 91 insertions, 85 deletions
diff --git a/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go b/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go index dbac0cc30..b0caac91b 100644 --- a/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go +++ b/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go @@ -20,15 +20,43 @@ import ( #include <seccomp.h> #if SCMP_VER_MAJOR < 2 -#error Minimum supported version of Libseccomp is v2.2.0 -#elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR < 2 -#error Minimum supported version of Libseccomp is v2.2.0 +#error Minimum supported version of Libseccomp is v2.1.0 +#elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR < 1 +#error Minimum supported version of Libseccomp is v2.1.0 #endif #define ARCH_BAD ~0 const uint32_t C_ARCH_BAD = ARCH_BAD; +#ifndef SCMP_ARCH_AARCH64 +#define SCMP_ARCH_AARCH64 ARCH_BAD +#endif + +#ifndef SCMP_ARCH_MIPS +#define SCMP_ARCH_MIPS ARCH_BAD +#endif + +#ifndef SCMP_ARCH_MIPS64 +#define SCMP_ARCH_MIPS64 ARCH_BAD +#endif + +#ifndef SCMP_ARCH_MIPS64N32 +#define SCMP_ARCH_MIPS64N32 ARCH_BAD +#endif + +#ifndef SCMP_ARCH_MIPSEL +#define SCMP_ARCH_MIPSEL ARCH_BAD +#endif + +#ifndef SCMP_ARCH_MIPSEL64 +#define SCMP_ARCH_MIPSEL64 ARCH_BAD +#endif + +#ifndef SCMP_ARCH_MIPSEL64N32 +#define SCMP_ARCH_MIPSEL64N32 ARCH_BAD +#endif + #ifndef SCMP_ARCH_PPC #define SCMP_ARCH_PPC ARCH_BAD #endif @@ -73,6 +101,12 @@ const uint32_t C_ACT_ERRNO = SCMP_ACT_ERRNO(0); const uint32_t C_ACT_TRACE = SCMP_ACT_TRACE(0); const uint32_t C_ACT_ALLOW = SCMP_ACT_ALLOW; +// If TSync is not supported, make sure it doesn't map to a supported filter attribute +// Don't worry about major version < 2, the minimum version checks should catch that case +#if SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR < 2 +#define SCMP_FLTATR_CTL_TSYNC _SCMP_CMP_MIN +#endif + const uint32_t C_ATTRIBUTE_DEFAULT = (uint32_t)SCMP_FLTATR_ACT_DEFAULT; const uint32_t C_ATTRIBUTE_BADARCH = (uint32_t)SCMP_FLTATR_ACT_BADARCH; const uint32_t C_ATTRIBUTE_NNP = (uint32_t)SCMP_FLTATR_CTL_NNP; @@ -90,61 +124,25 @@ const int C_VERSION_MAJOR = SCMP_VER_MAJOR; const int C_VERSION_MINOR = SCMP_VER_MINOR; const int C_VERSION_MICRO = SCMP_VER_MICRO; -#if SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 3 -unsigned int get_major_version() -{ - return seccomp_version()->major; -} - -unsigned int get_minor_version() -{ - return seccomp_version()->minor; -} - -unsigned int get_micro_version() -{ - return seccomp_version()->micro; -} -#else -unsigned int get_major_version() -{ - return (unsigned int)C_VERSION_MAJOR; -} - -unsigned int get_minor_version() -{ - return (unsigned int)C_VERSION_MINOR; -} - -unsigned int get_micro_version() -{ - return (unsigned int)C_VERSION_MICRO; -} -#endif - typedef struct scmp_arg_cmp* scmp_cast_t; -void* make_arg_cmp_array(unsigned int length) +// Wrapper to create an scmp_arg_cmp struct +void* +make_struct_arg_cmp( + unsigned int arg, + int compare, + uint64_t a, + uint64_t b + ) { - return calloc(length, sizeof(struct scmp_arg_cmp)); -} + struct scmp_arg_cmp *s = malloc(sizeof(struct scmp_arg_cmp)); -// Wrapper to add an scmp_arg_cmp struct to an existing arg_cmp array -void add_struct_arg_cmp( - struct scmp_arg_cmp* arr, - unsigned int pos, - unsigned int arg, - int compare, - uint64_t a, - uint64_t b - ) -{ - arr[pos].arg = arg; - arr[pos].op = compare; - arr[pos].datum_a = a; - arr[pos].datum_b = b; + s->arg = arg; + s->op = compare; + s->datum_a = a; + s->datum_b = b; - return; + return s; } */ import "C" @@ -179,23 +177,23 @@ var ( // Error thrown on bad filter context errBadFilter = fmt.Errorf("filter is invalid or uninitialized") // Constants representing library major, minor, and micro versions - verMajor = uint(C.get_major_version()) - verMinor = uint(C.get_minor_version()) - verMicro = uint(C.get_micro_version()) + verMajor = int(C.C_VERSION_MAJOR) + verMinor = int(C.C_VERSION_MINOR) + verMicro = int(C.C_VERSION_MICRO) ) // Nonexported functions // Check if library version is greater than or equal to the given one -func checkVersionAbove(major, minor, micro uint) bool { +func checkVersionAbove(major, minor, micro int) bool { return (verMajor > major) || (verMajor == major && verMinor > minor) || (verMajor == major && verMinor == minor && verMicro >= micro) } -// Ensure that the library is supported, i.e. >= 2.2.0. +// Ensure that the library is supported, i.e. >= 2.1.0. func ensureSupportedVersion() error { - if !checkVersionAbove(2, 2, 0) { + if !checkVersionAbove(2, 1, 0) { return VersionError{} } return nil @@ -217,6 +215,13 @@ func (f *ScmpFilter) getFilterAttr(attr scmpFilterAttr) (C.uint32_t, error) { return 0x0, errBadFilter } + if !checkVersionAbove(2, 2, 0) && attr == filterAttrTsync { + return 0x0, VersionError{ + message: "thread synchronization attribute is not supported", + minimum: "2.2.0", + } + } + var attribute C.uint32_t retCode := C.seccomp_attr_get(f.filterCtx, attr.toNative(), &attribute) @@ -236,6 +241,13 @@ func (f *ScmpFilter) setFilterAttr(attr scmpFilterAttr, value C.uint32_t) error return errBadFilter } + if !checkVersionAbove(2, 2, 0) && attr == filterAttrTsync { + return VersionError{ + message: "thread synchronization attribute is not supported", + minimum: "2.2.0", + } + } + retCode := C.seccomp_attr_set(f.filterCtx, attr.toNative(), value) if retCode != 0 { return syscall.Errno(-1 * retCode) @@ -247,9 +259,12 @@ func (f *ScmpFilter) setFilterAttr(attr scmpFilterAttr, value C.uint32_t) error // DOES NOT LOCK OR CHECK VALIDITY // Assumes caller has already done this // Wrapper for seccomp_rule_add_... functions -func (f *ScmpFilter) addRuleWrapper(call ScmpSyscall, action ScmpAction, exact bool, length C.uint, cond C.scmp_cast_t) error { - if length != 0 && cond == nil { - return fmt.Errorf("null conditions list, but length is nonzero") +func (f *ScmpFilter) addRuleWrapper(call ScmpSyscall, action ScmpAction, exact bool, cond C.scmp_cast_t) error { + var length C.uint + if cond != nil { + length = 1 + } else { + length = 0 } var retCode C.int @@ -260,11 +275,9 @@ func (f *ScmpFilter) addRuleWrapper(call ScmpSyscall, action ScmpAction, exact b } if syscall.Errno(-1*retCode) == syscall.EFAULT { - return fmt.Errorf("unrecognized syscall %#x", int32(call)) + return fmt.Errorf("unrecognized syscall") } else if syscall.Errno(-1*retCode) == syscall.EPERM { return fmt.Errorf("requested action matches default action of filter") - } else if syscall.Errno(-1*retCode) == syscall.EINVAL { - return fmt.Errorf("two checks on same syscall argument") } else if retCode != 0 { return syscall.Errno(-1 * retCode) } @@ -282,7 +295,7 @@ func (f *ScmpFilter) addRuleGeneric(call ScmpSyscall, action ScmpAction, exact b } if len(conds) == 0 { - if err := f.addRuleWrapper(call, action, exact, 0, nil); err != nil { + if err := f.addRuleWrapper(call, action, exact, nil); err != nil { return err } } else { @@ -294,20 +307,13 @@ func (f *ScmpFilter) addRuleGeneric(call ScmpSyscall, action ScmpAction, exact b } } - argsArr := C.make_arg_cmp_array(C.uint(len(conds))) - if argsArr == nil { - return fmt.Errorf("error allocating memory for conditions") - } - defer C.free(argsArr) - - for i, cond := range conds { - C.add_struct_arg_cmp(C.scmp_cast_t(argsArr), C.uint(i), - C.uint(cond.Argument), cond.Op.toNative(), - C.uint64_t(cond.Operand1), C.uint64_t(cond.Operand2)) - } + for _, cond := range conds { + cmpStruct := C.make_struct_arg_cmp(C.uint(cond.Argument), cond.Op.toNative(), C.uint64_t(cond.Operand1), C.uint64_t(cond.Operand2)) + defer C.free(cmpStruct) - if err := f.addRuleWrapper(call, action, exact, C.uint(len(conds)), C.scmp_cast_t(argsArr)); err != nil { - return err + if err := f.addRuleWrapper(call, action, exact, C.scmp_cast_t(cmpStruct)); err != nil { + return err + } } } @@ -319,11 +325,11 @@ func (f *ScmpFilter) addRuleGeneric(call ScmpSyscall, action ScmpAction, exact b // Helper - Sanitize Arch token input func sanitizeArch(in ScmpArch) error { if in < archStart || in > archEnd { - return fmt.Errorf("unrecognized architecture %#x", uint(in)) + return fmt.Errorf("unrecognized architecture") } if in.toNative() == C.C_ARCH_BAD { - return fmt.Errorf("architecture %v is not supported on this version of the library", in) + return fmt.Errorf("architecture is not supported on this version of the library") } return nil @@ -332,7 +338,7 @@ func sanitizeArch(in ScmpArch) error { func sanitizeAction(in ScmpAction) error { inTmp := in & 0x0000FFFF if inTmp < actionStart || inTmp > actionEnd { - return fmt.Errorf("unrecognized action %#x", uint(inTmp)) + return fmt.Errorf("unrecognized action") } if inTmp != ActTrace && inTmp != ActErrno && (in&0xFFFF0000) != 0 { @@ -344,7 +350,7 @@ func sanitizeAction(in ScmpAction) error { func sanitizeCompareOp(in ScmpCompareOp) error { if in < compareOpStart || in > compareOpEnd { - return fmt.Errorf("unrecognized comparison operator %#x", uint(in)) + return fmt.Errorf("unrecognized comparison operator") } return nil @@ -387,7 +393,7 @@ func archFromNative(a C.uint32_t) (ScmpArch, error) { case C.C_ARCH_S390X: return ArchS390X, nil default: - return 0x0, fmt.Errorf("unrecognized architecture %#x", uint32(a)) + return 0x0, fmt.Errorf("unrecognized architecture") } } @@ -469,7 +475,7 @@ func actionFromNative(a C.uint32_t) (ScmpAction, error) { case C.C_ACT_ALLOW: return ActAllow, nil default: - return 0x0, fmt.Errorf("unrecognized action %#x", uint32(a)) + return 0x0, fmt.Errorf("unrecognized action") } } |