Module: SeccompTools::Audit::Checks::ArchUnchecked

Defined in:
lib/seccomp-tools/audit/checks/arch_unchecked.rb

Overview

The filter does not validate the architecture, or lets an unlisted one reach ALLOW. Syscall numbers are ABI-relative, so number-only rules are dodged by invoking under another ABI.

Class Method Summary collapse

Class Method Details

.call(analysis) ⇒ Array<Audit::Finding>

Parameters:

Returns:



16
17
18
19
20
21
22
23
24
25
26
27
28
29
 
# File 'lib/seccomp-tools/audit/checks/arch_unchecked.rb', line 16

def call(analysis)
  if analysis.arch_values.empty?
    [finding('Architecture is never validated',
             'The filter checks syscall numbers without ever comparing data[4] (arch). ' \
             'Numbers mean different syscalls under another AUDIT_ARCH, so the checks can be ' \
             'dodged by invoking through a different ABI (e.g. i386 numbering on amd64).')]
  elsif analysis.other_leaves.any? { |l| Explain::Verdict.label(l.ret) == 'ALLOW' }
    [finding('Unlisted architectures reach ALLOW',
             'Some paths reach ALLOW on an architecture the filter does not explicitly ' \
             'check, so a different-ABI call can slip past the syscall-number rules.')]
  else
    []
  end
end