Module: SeccompTools::Const::BPF

Included in:

Instruction::Base

Defined in:

lib/seccomp-tools/const.rb

Overview

For BPF / seccomp.

Defined Under Namespace

Modules: SeccompData

Constant Summary

SIZEOF_SECCOMP_DATA =

sizeof(struct seccomp_data)

SeccompData::SIZE

PR_SET_SECCOMP =

option set seccomp

22

SECCOMP_MODE_STRICT =

strict mode

1

SECCOMP_MODE_FILTER =

filter mode

2

SECCOMP_SET_MODE_STRICT =

For syscall seccomp

0

SECCOMP_SET_MODE_FILTER =

For syscall seccomp

1

SECCOMP_RET_ACTION_FULL =

mask of return action

0xffff0000

SECCOMP_RET_DATA =

mask of return data

0x0000ffff

COMMAND =

bpf command classes

{
  ld: 0x0,
  ldx: 0x1,
  st: 0x2,
  stx: 0x3,
  alu: 0x4,
  jmp: 0x5,
  ret: 0x6,
  misc: 0x7
}.freeze

JMP =

types in jmp command

{
  ja: 0x00,
  jeq: 0x10,
  jgt: 0x20,
  jge: 0x30,
  jset: 0x40
}.freeze

SRC =

register

{
  k: 0x0,
  x: 0x8,
  a: 0x10
}.freeze

ACTION =

seccomp action values

{
  KILL_PROCESS: 0x80000000,
  KILL_THREAD: 0x00000000,
  KILL: 0x00000000, # alias of KILL_THREAD
  TRAP: 0x00030000,
  ERRNO: 0x00050000,
  USER_NOTIF: 0x7fc00000,
  LOG: 0x7ffc0000,
  TRACE: 0x7ff00000,
  ALLOW: 0x7fff0000
}.freeze

MODE =

mode used in ld / ldx

{
  imm: 0x00,
  abs: 0x20,
  ind: 0x40,
  mem: 0x60,
  len: 0x80,
  msh: 0xa0
}.freeze

OP =

operation for alu

{
  add: 0x00,
  sub: 0x10,
  mul: 0x20,
  div: 0x30,
  or: 0x40,
  and: 0x50,
  lsh: 0x60,
  rsh: 0x70,
  neg: 0x80,
  # mod (0x90) is intentionally omitted: the kernel's seccomp_check_filter() allowlist rejects
  # BPF_MOD (EINVAL), so it can never appear in a loadable seccomp filter.
  xor: 0xa0
}.freeze

MISCOP =

operation for misc

{
  tax: 0x00,
  txa: 0x80
}.freeze

Class Method Summary

• .action_label(value) ⇒ String?

  The action a seccomp return value names, e.g.

Class Method Details

.action_label(value) ⇒ String?

The action a seccomp return value names, e.g. "ALLOW" or "ERRNO(5)", or nil when the action bits are not a value the kernel defines. The data part is shown for the actions that consume it: ERRNO always, and +TRACE+/+TRAP+ when non-zero (0 is their idle default). The result is both human-readable and re-assemblable.

Parameters:

• value (Integer)

Returns:

• (String?)

# File 'lib/seccomp-tools/const.rb', line 139

def self.action_label(value)
  action = ACTION.invert[value & SECCOMP_RET_ACTION_FULL]
  return if action.nil?

  data = value & SECCOMP_RET_DATA
  case action
  when :ERRNO then "ERRNO(#{data})"
  when :TRACE, :TRAP then data.zero? ? action.to_s : "#{action}(#{data})"
  else action.to_s
  end
end