Module: SeccompTools::Audit::Checks::X32Guard

Defined in:
lib/seccomp-tools/audit/checks/x32_guard.rb

Overview

amd64's x32 ABI quirk: x32 syscalls share AUDIT_ARCH_X86_64 but number as nr | 0x40000000. Without a sys_number >= 0x40000000 (or jset 0x40000000) guard, a syscall blocked by its native number is still reachable through its x32 number. Registered only for amd64, so no other architecture is ever mis-flagged.

Class Method Summary collapse

Class Method Details

.call(policy) ⇒ Array<Audit::Finding>

Parameters:

Returns:



17
18
19
20
21
22
23
24
25
26
27
 
# File 'lib/seccomp-tools/audit/checks/x32_guard.rb', line 17

def call(policy)
  sharp = policy.table.filter_map do |name, nr|
    next if name.to_s.start_with?('x32_')

    x = policy.number(:"x32_#{name}")
    name if x && policy.reachable_as_allow?(x) && !policy.reachable_as_allow?(nr)
  end
  return [] if sharp.empty?

  [finding(policy, sharp)]
end