Module: SeccompTools::Audit::Checks

Defined in:
lib/seccomp-tools/audit/checks.rb,
lib/seccomp-tools/audit/checks/orw_chain.rb,
lib/seccomp-tools/audit/checks/x32_guard.rb,
lib/seccomp-tools/audit/checks/arch_unchecked.rb,
lib/seccomp-tools/audit/checks/dangerous_allow.rb,
lib/seccomp-tools/audit/checks/syscall_alt_gap.rb,
lib/seccomp-tools/audit/checks/permissive_default.rb

Overview

The registries the SeccompTools::Audit engine runs. A check is anything answering call and returning Findings; which registry it is listed in decides both how often it runs and what it is handed, so adding one is a single entry here rather than a change to the engine.

  • FILTER - asked once about the whole filter, and handed the Explain::Analysis. For questions no single architecture can answer, such as whether the filter checks the architecture at all.
  • SECTION / SECTION_BY_ARCH - asked once per architecture, and handed that architecture's Policy. SECTION_BY_ARCH keeps a quirk confined to the architecture that has it, so it is a one-line entry rather than a branch inside a check.

Defined Under Namespace

Modules: ArchUnchecked, DangerousAllow, OrwChain, PermissiveDefault, SyscallAltGap, X32Guard

Constant Summary collapse

FILTER =

Whole-filter checks; each takes the Explain::Analysis.

[ArchUnchecked].freeze
SECTION =

Per-architecture checks that apply everywhere; each takes a Policy.

[PermissiveDefault, SyscallAltGap, OrwChain, DangerousAllow].freeze
SECTION_BY_ARCH =

Per-architecture checks that apply only to the keyed architecture (amd64's x32 is the exemplar).

{ amd64: [X32Guard] }.freeze

Class Method Summary collapse

Class Method Details

.section_checks(arch_sym) ⇒ Array

The per-architecture checks to run for arch_sym: the common ones plus any it alone has.

Parameters:

  • arch_sym (Symbol?)

Returns:

  • (Array) 


37
38
39
 
# File 'lib/seccomp-tools/audit/checks.rb', line 37

def section_checks(arch_sym)
  SECTION + SECTION_BY_ARCH.fetch(arch_sym, [])
end