Module: SeccompTools::CLI::Dumpable

Included in:
FilterInput
Defined in:
lib/seccomp-tools/cli/dumpable.rb

Overview

Shared helpers for the commands that dump seccomp filters via ptrace (Dump and Explain).

Instance Method Summary collapse

Instance Method Details

#dump_seccomp(command:, pid:, limit:, timeout:) {|bpf, arch| ... } ⇒ Array

Dumps the seccomp filters from a command run via sh, or from an existing process, yielding each installed filter.

When pid is given the process is traced (requiring CAP_SYS_ADMIN); otherwise command is executed. On a permission error while tracing a pid, #dump_permission_error exits. Warns when nothing was installed, so a caller that produces no output still tells the user why.

Parameters:

  • command (String?) —

    The command to run, when pid is nil.

  • pid (Integer?) —

    The process to trace, or nil to run command.

  • limit (Integer) —

    Stop after this many installed filters.

  • timeout (Float?) —

    Seconds to wait for command, ignored when tracing a pid.

Yield Parameters:

  • bpf (String) —

    One installed filter, as raw bytes.

  • arch (Symbol?) —

    The architecture of the traced process, if known.

Returns:

  • (Array) —

    One entry per filter: the block's return values. Empty when nothing was installed.



32
33
34
35
36
37
38
39
40
 
# File 'lib/seccomp-tools/cli/dumpable.rb', line 32

def dump_seccomp(command:, pid:, limit:, timeout:, &)
  filters = if pid
              dump_seccomp_by_pid(pid, limit, &)
            else
              SeccompTools::Dumper.dump('/bin/sh', '-c', command, limit:, timeout:, &)
            end
  Logger.warn('No seccomp filter was installed.') if filters.empty?
  filters
end

#dumping_supported? ⇒ Boolean

Whether tracer-based dumping is available on this platform (Linux only). Logs an error when it is not, so callers can guard with return unless dumping_supported?.

Returns:

  • (Boolean) 


45
46
47
48
49
50
 
# File 'lib/seccomp-tools/cli/dumpable.rb', line 45

def dumping_supported?
  return true if SeccompTools::Dumper::SUPPORTED

  Logger.error('Dumping a filter from an executable or process is only available on Linux.')
  false
end