Module: Seccomp::Notify::Features

Defined in:
lib/seccomp/notify/features.rb

Class Method Summary collapse

Class Method Details

.detect ⇒ Object 



10
11
12
13
14
15
16
17
18
19
20
 
# File 'lib/seccomp/notify/features.rb', line 10

def detect
  disabled = ENV.fetch("SECCOMP_NOTIFY_DISABLE_FEATURES", "").split(",").map(&:strip)
  result = {user_notif: supported?, continue: false, addfd: false, addfd_send: false, wait_killable_recv: false}
  return result.freeze unless result[:user_notif]

  result.update(probe_responses)
  result[:wait_killable_recv] = probe_install(Constants::SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
  disabled.each { |name| result[name.to_sym] = false if result.key?(name.to_sym) }
  result[:addfd_send] = false unless result[:addfd]
  result.freeze
end

.probe_addfd(listener, source, flags) ⇒ Object 



94
95
96
97
98
99
100
101
102
103
104
 
# File 'lib/seccomp/notify/features.rb', line 94

def probe_addfd(listener, source, flags)
  request = "\0" * Structs::NOTIF_SIZE
  Ioctl.call(listener, Ioctl::NOTIF_RECV, request)
  id = request.unpack1("Q<")
  injected = Ioctl.call(listener, Ioctl::NOTIF_ADDFD, [id, flags, source.fileno, 0, 0].pack(Structs::ADDFD_FORMAT))
  respond_to_probe(listener, id, injected) if flags.zero?
  true
rescue SystemCallError
  respond_to_probe(listener, id)
  false
end

.probe_install(flags) ⇒ Object 



61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
 
# File 'lib/seccomp/notify/features.rb', line 61

def probe_install(flags)
  parent, child = UNIXSocket.pair
  pid = fork do
    parent.close
    listener = Filter.install!(BPF::Builder.new(Policy.new { notify :getpid }).build, flags:)
    FdPassing.send_fd(child, listener)
    exit! 0
  rescue SystemCallError
    exit! 1
  end
  child.close
  listener = FdPassing.recv_fd(parent, timeout: 2)
  listener.close
  status = wait_for_probe(pid)
  status.success?
rescue EOFError, Timeout::Error
  terminate_probe(pid)
  false
ensure
  parent&.close unless parent&.closed?
end

.probe_response(listener, flags) ⇒ Object 



83
84
85
86
87
88
89
90
91
92
 
# File 'lib/seccomp/notify/features.rb', line 83

def probe_response(listener, flags)
  request = "\0" * Structs::NOTIF_SIZE
  Ioctl.call(listener, Ioctl::NOTIF_RECV, request)
  id = request.unpack1("Q<")
  Ioctl.call(listener, Ioctl::NOTIF_SEND, [id, 0, 0, flags].pack(Structs::RESPONSE_FORMAT))
  true
rescue SystemCallError
  respond_to_probe(listener, id)
  false
end

.probe_responses ⇒ Object 



29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/seccomp/notify/features.rb', line 29

def probe_responses
  parent, child = UNIXSocket.pair
  listener = nil
  pid = nil
  File.open("/dev/null") do |source|
    pid = fork do
      parent.close
      listener = Filter.install!(BPF::Builder.new(Policy.new { notify :getpid }).build)
      FdPassing.send_fd(child, listener)
      3.times { Libc::SYSCALL.call(Syscalls.number(:getpid), 0, 0, 0) }
      exit! 0
    rescue StandardError
      exit! 1
    end
    child.close
    listener = FdPassing.recv_fd(parent, timeout: 2)
    result = {
      continue: probe_response(listener, Constants::SECCOMP_USER_NOTIF_FLAG_CONTINUE),
      addfd: probe_addfd(listener, source, 0),
      addfd_send: probe_addfd(listener, source, Constants::SECCOMP_ADDFD_FLAG_SEND)
    }
    return result if wait_for_probe(pid).success?
  end
  {continue: false, addfd: false, addfd_send: false}
rescue SystemCallError, EOFError, Timeout::Error
  terminate_probe(pid)
  {continue: false, addfd: false, addfd_send: false}
ensure
  listener&.close unless listener&.closed?
  parent&.close unless parent&.closed?
end

.respond_to_probe(listener, id, value = 0) ⇒ Object 



106
107
108
 
# File 'lib/seccomp/notify/features.rb', line 106

def respond_to_probe(listener, id, value = 0)
  Ioctl.call(listener, Ioctl::NOTIF_SEND, [id, value, 0, 0].pack(Structs::RESPONSE_FORMAT)) if id
end

.supported? ⇒ Boolean

Returns:

  • (Boolean) 


22
23
24
25
26
27
 
# File 'lib/seccomp/notify/features.rb', line 22

def supported?
  Libc.notif_sizes
  true
rescue SystemCallError, NotSupportedError
  false
end

.terminate_probe(pid) ⇒ Object 



114
115
116
117
 
# File 'lib/seccomp/notify/features.rb', line 114

def terminate_probe(pid)
  Process.kill("KILL", pid) rescue nil
  Process.waitpid(pid) rescue nil
end

.wait_for_probe(pid) ⇒ Object 



110
111
112
 
# File 'lib/seccomp/notify/features.rb', line 110

def wait_for_probe(pid)
  Timeout.timeout(2) { Process.waitpid2(pid).last }
end