Module: Seccomp

Defined in:
lib/libseccomp.rb,
lib/seccomp/arg.rb,
lib/seccomp/dsl.rb,
lib/seccomp/arch.rb,
lib/seccomp/action.rb,
lib/seccomp/errors.rb,
lib/seccomp/filter.rb,
lib/seccomp/syscall.rb,
lib/seccomp/version.rb,
lib/seccomp/notifier.rb,
lib/seccomp/low_level.rb,
lib/seccomp/attributes.rb,
lib/seccomp/notification.rb

Overview

Native bindings and Ruby-friendly APIs for libseccomp.

Defined Under Namespace

Modules: Action, Arch, Arg, Attributes, DSL, LowLevel, Syscall Classes: ArchError, ArgCmp, ClosedFilterError, Error, ExistsError, Filter, InvalidArgumentError, KernelError, LibraryVersion, NotFoundError, NotSupportedError, Notification, NotificationCanceledError, NotificationError, Notifier, OutOfMemoryError, PermissionError, ThreadSyncError, UnknownSyscallError, ValueRangeError

Constant Summary collapse

VERSION =

Gem version.

"0.1.0"

Class Method Summary collapse

Class Method Details

.api_level ⇒ Integer

Returns runtime libseccomp API level.

Examples:

Seccomp.api_level #=> 6

Returns:

  • (Integer) —

    runtime libseccomp API level



40
41
42
 
# File 'lib/libseccomp.rb', line 40

def api_level
  LowLevel.api_get
end

.api_level=(level) ⇒ Integer

Returns assigned level.

Examples:

Seccomp.api_level = 6

Parameters:

  • level (Integer) —

    process-global API level

Returns:

  • (Integer) —

    assigned level

Raises:

  • (Error) —

    if libseccomp rejects the level



48
49
50
51
 
# File 'lib/libseccomp.rb', line 48

def api_level=(level)
  Error.check!(LowLevel.api_set(level), call: "seccomp_api_set")
  level
end

.filter(default: :kill_process) {|Filter| ... } ⇒ Filter

Returns configured filter.

Examples:

Seccomp.filter(default: :allow) { deny :ptrace }

Parameters:

  • default (Symbol, Integer) (defaults to: :kill_process) —

    default action

Yields:

  • (Filter) —

    configured filter for arity-one blocks

Returns:

  • (Filter) —

    configured filter

Raises:

  • (Error) —

    if configuration fails



66
67
68
69
70
71
72
73
74
75
 
# File 'lib/libseccomp.rb', line 66

def filter(default: :kill_process, &block)
  filter = Filter.new(default)
  return filter unless block

  block.arity.zero? ? filter.instance_eval(&block) : block.call(filter)
  completed = true
  filter
ensure
  filter&.close if block && !completed
end

.library_version ⇒ LibraryVersion

Returns linked library version.

Examples:

Seccomp.library_version.major

Returns:



34
35
36
 
# File 'lib/libseccomp.rb', line 34

def library_version
  LibraryVersion.new(*LowLevel.version)
end

.supports?(feature) ⇒ Boolean

Returns whether the linked build provides it.

Examples:

Seccomp.supports?(:transaction)

Parameters:

  • feature (Symbol) —

    feature name

Returns:

  • (Boolean) —

    whether the linked build provides it



56
57
58
59
 
# File 'lib/libseccomp.rb', line 56

def supports?(feature)
  required = FEATURE_API_LEVELS[feature]
  LowLevel.supports?(feature) && (!required || api_level >= required)
end