Module: Seccomp::LowLevel

Defined in:

lib/seccomp/low_level.rb

Overview

Thin C-compatible API. Methods return negative errno values unless documented otherwise.

Defined Under Namespace

Classes: Context

Class Method Summary

• .api_get ⇒ Integer

  Runtime API level.

• .api_set(level) ⇒ Integer

  Raw return code.

• .arch_add(context, arch) ⇒ Integer

  Raw return code.

• .arch_exist(context, arch) ⇒ Integer

  Raw return code.

• .arch_native ⇒ Integer

  Native architecture token.

• .arch_remove(context, arch) ⇒ Integer

  Raw return code.

• .arch_resolve_name(name) ⇒ Integer

  Architecture token, or zero.

• .attr_get(context, attribute) ⇒ Array(Integer, Integer)

  Raw return code and value.

• .attr_set(context, attribute, value) ⇒ Integer

  Raw return code.

• .closed?(context) ⇒ Boolean
• .export_bpf(context, fd) ⇒ Integer

  Raw return code.

• .export_bpf_mem(context) ⇒ Array(Integer, String)

  Raw return code and BPF.

• .export_pfc(context, fd) ⇒ Integer

  Raw return code.

• .init(action) ⇒ Context
• .load(context) ⇒ Integer

  Raw return code.

• .loaded?(context) ⇒ Boolean
• .merge(destination, source) ⇒ Integer

  Raw return code.

• .notify_addfd(fd, id, flags, source_fd, newfd, newfd_flags) ⇒ Integer

  Installed fd or negative errno.

• .notify_fd(context) ⇒ Integer

  Listener fd or negative errno.

• .notify_id_valid(fd, id) ⇒ Integer

  Raw return code.

• .notify_receive(fd) ⇒ Array(Integer, Hash)

  Raw return code and request.

• .notify_respond(fd, id, value, error, flags) ⇒ Integer

  Raw return code.

• .precompute(context) ⇒ Integer

  Raw return code.

• .release(context) ⇒ nil
• .reset(context, action) ⇒ Integer

  Raw return code.

• .rule_add_array(context, action, syscall, comparisons) ⇒ Integer

  Raw return code.

• .rule_add_exact_array(context, action, syscall, comparisons) ⇒ Integer

  Raw return code.

• .supports?(feature) ⇒ Boolean
• .syscall_priority(context, syscall, priority) ⇒ Integer

  Raw return code.

• .syscall_resolve_name(name) ⇒ Integer

  Syscall number.

• .syscall_resolve_name_arch(arch, name) ⇒ Integer

  Syscall number.

• .syscall_resolve_name_rewrite(arch, name) ⇒ Integer

  Rewritten syscall number.

• .syscall_resolve_num_arch(arch, number) ⇒ String^?

  Syscall name.

• .transaction_commit(context) ⇒ Integer

  Raw return code.

• .transaction_reject(context) ⇒ Integer

  Zero.

• .transaction_start(context) ⇒ Integer

  Raw return code.

• .version ⇒ Array<Integer>

  Major, minor, and micro version.

Class Method Details

.api_get ⇒ Integer

Returns runtime API level.

Examples:

LowLevel.api_get

Returns:

• (Integer) —

  runtime API level

# File 'lib/seccomp/low_level.rb', line 10

.api_set(level) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.api_set(6)

Parameters:

• level (Integer)

Returns:

• (Integer) —

  raw return code

Raises:

• (RangeError) —

  for an invalid integer

# File 'lib/seccomp/low_level.rb', line 10

.arch_add(context, arch) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.arch_add(context, Arch::X86)

Parameters:

• context (Context)
• arch (Integer)

Returns:

• (Integer) —

  raw return code

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.arch_exist(context, arch) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.arch_exist(context, Arch::X86)

Parameters:

• context (Context)
• arch (Integer)

Returns:

• (Integer) —

  raw return code

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.arch_native ⇒ Integer

Returns native architecture token.

Examples:

LowLevel.arch_native

Returns:

• (Integer) —

  native architecture token

# File 'lib/seccomp/low_level.rb', line 10

.arch_remove(context, arch) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.arch_remove(context, Arch::X86)

Parameters:

• context (Context)
• arch (Integer)

Returns:

• (Integer) —

  raw return code

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.arch_resolve_name(name) ⇒ Integer

Returns architecture token, or zero.

Examples:

LowLevel.arch_resolve_name("x86_64")

Parameters:

• name (String)

Returns:

• (Integer) —

  architecture token, or zero

# File 'lib/seccomp/low_level.rb', line 10

.attr_get(context, attribute) ⇒ Array(Integer, Integer)

Returns raw return code and value.

Examples:

LowLevel.attr_get(context, FilterAttr::CTL_NNP)

Parameters:

• context (Context)
• attribute (Integer)

Returns:

• (Array(Integer, Integer)) —

  raw return code and value

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.attr_set(context, attribute, value) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.attr_set(context, FilterAttr::CTL_NNP, 1)

Parameters:

• context (Context)
• attribute (Integer)
• value (Integer)

Returns:

• (Integer) —

  raw return code

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.closed?(context) ⇒ Boolean

Examples:

LowLevel.closed?(context)

Parameters:

• context (Context)

Returns:

• (Boolean)

# File 'lib/seccomp/low_level.rb', line 10

.export_bpf(context, fd) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.export_bpf(context, io.fileno)

Parameters:

• context (Context)
• fd (Integer)

Returns:

• (Integer) —

  raw return code

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.export_bpf_mem(context) ⇒ Array(Integer, String)

Returns raw return code and BPF.

Examples:

LowLevel.export_bpf_mem(context)

Parameters:

• context (Context)

Returns:

• (Array(Integer, String)) —

  raw return code and BPF

Raises:

• (NotSupportedError) —

  when unavailable

# File 'lib/seccomp/low_level.rb', line 10

.export_pfc(context, fd) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.export_pfc(context, io.fileno)

Parameters:

• context (Context)
• fd (Integer)

Returns:

• (Integer) —

  raw return code

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.init(action) ⇒ Context

Examples:

LowLevel.init(Action::ALLOW)

Parameters:

• action (Integer)

Returns:

• (Context)

Raises:

• (OutOfMemoryError) —

  if allocation fails

# File 'lib/seccomp/low_level.rb', line 10

.load(context) ⇒ Integer

Returns raw return code.

Examples:

fork { LowLevel.load(context) }

Parameters:

• context (Context)

Returns:

• (Integer) —

  raw return code

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.loaded?(context) ⇒ Boolean

Examples:

LowLevel.loaded?(context)

Parameters:

• context (Context)

Returns:

• (Boolean)

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.merge(destination, source) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.merge(destination, source)

Parameters:

• destination (Context)
• source (Context)

Returns:

• (Integer) —

  raw return code

Raises:

• (ClosedFilterError) —

  if either context is released

# File 'lib/seccomp/low_level.rb', line 10

.notify_addfd(fd, id, flags, source_fd, newfd, newfd_flags) ⇒ Integer

Returns installed fd or negative errno.

Examples:

LowLevel.notify_addfd(fd, id, 0, source.fileno, 0, 0)

Parameters:

• fd (Integer)
• id (Integer)
• flags (Integer)
• source_fd (Integer)
• newfd (Integer)
• newfd_flags (Integer)

Returns:

• (Integer) —

  installed fd or negative errno

Raises:

• (NotSupportedError) —

  when unavailable

# File 'lib/seccomp/low_level.rb', line 10

.notify_fd(context) ⇒ Integer

Returns listener fd or negative errno.

Examples:

LowLevel.notify_fd(context)

Parameters:

• context (Context)

Returns:

• (Integer) —

  listener fd or negative errno

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.notify_id_valid(fd, id) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.notify_id_valid(fd, id)

Parameters:

• fd (Integer)
• id (Integer)

Returns:

• (Integer) —

  raw return code

# File 'lib/seccomp/low_level.rb', line 10

.notify_receive(fd) ⇒ Array(Integer, Hash)

Returns raw return code and request.

Examples:

LowLevel.notify_receive(fd)

Parameters:

• fd (Integer)

Returns:

• (Array(Integer, Hash)) —

  raw return code and request

# File 'lib/seccomp/low_level.rb', line 10

.notify_respond(fd, id, value, error, flags) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.notify_respond(fd, id, 0, 0, 0)

Parameters:

• fd (Integer)
• id (Integer)
• value (Integer)
• error (Integer)
• flags (Integer)

Returns:

• (Integer) —

  raw return code

# File 'lib/seccomp/low_level.rb', line 10

.precompute(context) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.precompute(context)

Parameters:

• context (Context)

Returns:

• (Integer) —

  raw return code

Raises:

• (NotSupportedError) —

  when unavailable

# File 'lib/seccomp/low_level.rb', line 10

.release(context) ⇒ nil

Examples:

LowLevel.release(context)

Parameters:

• context (Context)

Returns:

• (nil)

# File 'lib/seccomp/low_level.rb', line 10

.reset(context, action) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.reset(context, Action::ALLOW)

Parameters:

• context (Context)
• action (Integer)

Returns:

• (Integer) —

  raw return code

Raises:

• (ClosedFilterError) —

  if released

# File 'lib/seccomp/low_level.rb', line 10

.rule_add_array(context, action, syscall, comparisons) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.rule_add_array(context, Action::ALLOW, 1, [])

Parameters:

• context (Context)
• action (Integer)
• syscall (Integer)
• comparisons (Array<Array<Integer>>)

Returns:

• (Integer) —

  raw return code

Raises:

• (ArgumentError) —

  for malformed comparisons

# File 'lib/seccomp/low_level.rb', line 10

.rule_add_exact_array(context, action, syscall, comparisons) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.rule_add_exact_array(context, Action::ALLOW, 1, [])

Parameters:

• context (Context)
• action (Integer)
• syscall (Integer)
• comparisons (Array<Array<Integer>>)

Returns:

• (Integer) —

  raw return code

Raises:

• (ArgumentError) —

  for malformed comparisons

# File 'lib/seccomp/low_level.rb', line 10

.supports?(feature) ⇒ Boolean

Examples:

LowLevel.supports?(:notify)

Parameters:

• feature (Symbol)

Returns:

• (Boolean)

# File 'lib/seccomp/low_level.rb', line 10

.syscall_priority(context, syscall, priority) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.syscall_priority(context, 1, 100)

Parameters:

• context (Context)
• syscall (Integer)
• priority (Integer)

Returns:

• (Integer) —

  raw return code

Raises:

• (RangeError) —

  outside 0..255

# File 'lib/seccomp/low_level.rb', line 10

.syscall_resolve_name(name) ⇒ Integer

Returns syscall number.

Examples:

LowLevel.syscall_resolve_name("write")

Parameters:

• name (String)

Returns:

• (Integer) —

  syscall number

# File 'lib/seccomp/low_level.rb', line 10

.syscall_resolve_name_arch(arch, name) ⇒ Integer

Returns syscall number.

Examples:

LowLevel.syscall_resolve_name_arch(Arch::X86, "write")

Parameters:

• arch (Integer)
• name (String)

Returns:

• (Integer) —

  syscall number

# File 'lib/seccomp/low_level.rb', line 10

.syscall_resolve_name_rewrite(arch, name) ⇒ Integer

Returns rewritten syscall number.

Examples:

LowLevel.syscall_resolve_name_rewrite(Arch::X86, "socket")

Parameters:

• arch (Integer)
• name (String)

Returns:

• (Integer) —

  rewritten syscall number

# File 'lib/seccomp/low_level.rb', line 10

.syscall_resolve_num_arch(arch, number) ⇒ String^?

Returns syscall name.

Examples:

LowLevel.syscall_resolve_num_arch(Arch::X86_64, 1)

Parameters:

• arch (Integer)
• number (Integer)

Returns:

• (String, nil) —

  syscall name

# File 'lib/seccomp/low_level.rb', line 10

.transaction_commit(context) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.transaction_commit(context)

Parameters:

• context (Context)

Returns:

• (Integer) —

  raw return code

Raises:

• (NotSupportedError) —

  when unavailable

# File 'lib/seccomp/low_level.rb', line 10

.transaction_reject(context) ⇒ Integer

Returns zero.

Examples:

LowLevel.transaction_reject(context)

Parameters:

• context (Context)

Returns:

• (Integer) —

  zero

Raises:

• (NotSupportedError) —

  when unavailable

# File 'lib/seccomp/low_level.rb', line 10

.transaction_start(context) ⇒ Integer

Returns raw return code.

Examples:

LowLevel.transaction_start(context)

Parameters:

• context (Context)

Returns:

• (Integer) —

  raw return code

Raises:

• (NotSupportedError) —

  when unavailable

# File 'lib/seccomp/low_level.rb', line 10

.version ⇒ Array<Integer>

Returns major, minor, and micro version.

Examples:

LowLevel.version #=> [2, 6, 1]

Returns:

• (Array<Integer>) —

  major, minor, and micro version

# File 'lib/seccomp/low_level.rb', line 10