Module: SeccompTools

Defined in:: lib/seccomp-tools.rb,
lib/seccomp-tools/bpf.rb,
lib/seccomp-tools/util.rb,
lib/seccomp-tools/audit.rb,
lib/seccomp-tools/const.rb,
lib/seccomp-tools/error.rb,
lib/seccomp-tools/dumper.rb,
lib/seccomp-tools/logger.rb,
lib/seccomp-tools/asm/asm.rb,
lib/seccomp-tools/cli/asm.rb,
lib/seccomp-tools/cli/cli.rb,
lib/seccomp-tools/cli/emu.rb,
lib/seccomp-tools/explain.rb,
lib/seccomp-tools/syscall.rb,
lib/seccomp-tools/version.rb,
lib/seccomp-tools/cli/base.rb,
lib/seccomp-tools/cli/dump.rb,
lib/seccomp-tools/emulator.rb,
lib/seccomp-tools/asm/token.rb,
lib/seccomp-tools/cli/audit.rb,
lib/seccomp-tools/asm/scalar.rb,
lib/seccomp-tools/cli/disasm.rb,
lib/seccomp-tools/asm/scanner.rb,
lib/seccomp-tools/cli/explain.rb,
lib/seccomp-tools/asm/compiler.rb,
lib/seccomp-tools/asm/sasm.tab.rb,
lib/seccomp-tools/audit/checks.rb,
lib/seccomp-tools/audit/policy.rb,
lib/seccomp-tools/audit/report.rb,
lib/seccomp-tools/cli/dumpable.rb,
lib/seccomp-tools/asm/statement.rb,
lib/seccomp-tools/audit/catalog.rb,
lib/seccomp-tools/audit/finding.rb,
lib/seccomp-tools/disasm/disasm.rb,
lib/seccomp-tools/explain/qword.rb,
lib/seccomp-tools/symbolic/expr.rb,
lib/seccomp-tools/cli/completion.rb,
lib/seccomp-tools/instruction/ld.rb,
lib/seccomp-tools/instruction/st.rb,
lib/seccomp-tools/symbolic/state.rb,
lib/seccomp-tools/explain/summary.rb,
lib/seccomp-tools/explain/verdict.rb,
lib/seccomp-tools/instruction/alu.rb,
lib/seccomp-tools/instruction/jmp.rb,
lib/seccomp-tools/instruction/ldx.rb,
lib/seccomp-tools/instruction/ret.rb,
lib/seccomp-tools/instruction/stx.rb,
lib/seccomp-tools/cli/filter_input.rb,
lib/seccomp-tools/explain/analysis.rb,
lib/seccomp-tools/explain/renderer.rb,
lib/seccomp-tools/instruction/base.rb,
lib/seccomp-tools/instruction/misc.rb,
lib/seccomp-tools/symbolic/executor.rb,
lib/seccomp-tools/explain/path_facts.rb,
lib/seccomp-tools/symbolic/constraint.rb,
lib/seccomp-tools/audit/checks/orw_chain.rb,
lib/seccomp-tools/audit/checks/x32_guard.rb,
lib/seccomp-tools/audit/checks/arch_unchecked.rb,
lib/seccomp-tools/audit/checks/dangerous_allow.rb,
lib/seccomp-tools/audit/checks/syscall_alt_gap.rb,
lib/seccomp-tools/audit/checks/permissive_default.rb,
ext/ptrace/ptrace.c

Overview

Toolkit for working with seccomp BPF filters.

The library entry points are Asm.asm to compile assembly into raw BPF, Disasm.disasm to turn raw BPF back into readable assembly, Dumper.dump to capture the filters a process installs, and Emulator to run a filter against a hypothetical syscall.

Examples:

raw = SeccompTools::Asm.asm("return ALLOW\n", arch: :amd64)
SeccompTools::Disasm.disasm(raw, arch: :amd64, display_bpf: false)
#=> "0000: return ALLOW\n"

Defined Under Namespace

Modules: Asm, CLI, Const, Disasm, Dumper, Instruction, Logger, Ptrace, Symbolic, Util Classes: Audit, BPF, BackwardJumpError, DuplicateLabelError, Emulator, Error, Explain, LongJumpError, ParseError, Syscall, UndefinedLabelError, UnrecognizedTokenError

Constant Summary collapse

VERSION = Gem version.

'1.7.0'