Module: SeccompTools::Audit::Checks::SyscallAltGap

Defined in:
lib/seccomp-tools/audit/checks/syscall_alt_gap.rb

Overview

An equivalent-syscall gap: a group member is singled out for denial while a sibling with the same capability still reaches ALLOW (blocked execve but not execveat, open but not openat, fork but not clone).

Class Method Summary collapse

Class Method Details

.call(policy) ⇒ Array<Audit::Finding>

Parameters:

Returns:



17
18
19
20
21
22
23
24
25
26
 
# File 'lib/seccomp-tools/audit/checks/syscall_alt_gap.rb', line 17

def call(policy)
  Catalog.alt_groups(policy.arch_sym).filter_map do |group, names|
    present = names.filter_map { |n| [n, policy.number(n)] if policy.number(n) }
    denied = present.select { |_n, nr| policy.explicitly_denied?(nr) }.map(&:first)
    allowed = present.select { |_n, nr| policy.reachable_as_allow?(nr) }.map(&:first)
    next if denied.empty? || allowed.empty?

    finding(policy, group, denied, allowed)
  end
end