Class: SeccompTools::Audit

Inherits:
Object
  • Object
show all
Defined in:
lib/seccomp-tools/audit.rb,
lib/seccomp-tools/audit/checks.rb,
lib/seccomp-tools/audit/policy.rb,
lib/seccomp-tools/audit/report.rb,
lib/seccomp-tools/audit/catalog.rb,
lib/seccomp-tools/audit/finding.rb,
lib/seccomp-tools/audit/checks/orw_chain.rb,
lib/seccomp-tools/audit/checks/x32_guard.rb,
lib/seccomp-tools/audit/checks/arch_unchecked.rb,
lib/seccomp-tools/audit/checks/dangerous_allow.rb,
lib/seccomp-tools/audit/checks/syscall_alt_gap.rb,
lib/seccomp-tools/audit/checks/permissive_default.rb

Overview

Assesses a seccomp filter for weaknesses / escape routes and reports them as a Report.

It runs the generic Symbolic::Executor over the filter (the same walk Explain uses), splits the leaves per architecture with Explain::Analysis, and runs each Checks rule against the per-arch Policy. Every supported architecture is assessed; architecture-specific quirks (e.g. amd64's x32 ABI) are registered per arch in Checks, never special-cased inline.

Examples:

insts = SeccompTools::Disasm.to_bpf(raw, :amd64).map(&:inst)
puts SeccompTools::Audit.new(insts, arch: :amd64, source: 'a.out').audit

Defined Under Namespace

Modules: Catalog, Checks Classes: Finding, Policy, Report

Constant Summary collapse

SEVERITIES =

Severities, most to least severe. Drives ordering and (for human output) coloring.

%i[high medium low].freeze

Instance Method Summary collapse

Constructor Details

#initialize(instructions, arch:, source: nil) ⇒ Audit

Returns a new instance of Audit.

Parameters:

  • instructions (Array<Instruction::Base>) —

    The filter, as SeccompTools::Disasm.to_bpf(raw, arch).map(&:inst).

  • arch (Symbol) —

    The architecture the filter is written for, used when it does not itself branch on arch.

  • source (String?) (defaults to: nil) —

    A label for the filter (e.g. a filename) shown in the report.



27
28
29
30
31
 
# File 'lib/seccomp-tools/audit.rb', line 27

def initialize(instructions, arch:, source: nil)
  @instructions = instructions
  @arch = arch
  @source = source
end

Instance Method Details

#audit ⇒ Report

Walks the filter, runs every check, and returns the Report.

Returns:



35
36
37
38
39
40
41
42
43
44
45
46
 
# File 'lib/seccomp-tools/audit.rb', line 35

def audit
  leaves, truncated = Symbolic::Executor.new(@instructions).run
  analysis = Explain::Analysis.new(leaves)
  policies = analysis.sections(@arch).map { |section| Policy.new(analysis, section) }

  findings = Checks::FILTER.flat_map { |check| check.call(analysis) }
  policies.each do |policy|
    Checks.section_checks(policy.arch_sym).each { |check| findings.concat(check.call(policy)) }
  end

  Report.new(source: @source, arches: policies.map(&:arch_name), findings:, truncated:)
end