Module: SeccompTools::Const::BPF::SeccompData

Defined in:

lib/seccomp-tools/const.rb

Overview

Byte offsets of the fields of the filter's input buffer:

struct seccomp_data {
int nr;                     // SYS_NUMBER
__u32 arch;                 // ARCH
__u64 instruction_pointer;  // INSTRUCTION_POINTER
__u64 args[6];              // ARGS
};

The 64-bit fields are each two 32-bit words a filter loads separately (see QWORD_BASES).

Constant Summary

SYS_NUMBER =

Byte offset of the syscall number.

0

ARCH =

Byte offset of the architecture.

4

INSTRUCTION_POINTER =

Byte offset of the instruction pointer.

8

ARGS =

Byte offset of the first 64-bit argument.

16

SIZE =

Total size in bytes; the len load returns this.

64

QWORD_BASES =

Byte offsets of the 64-bit fields (+instruction_pointer+ and the six arguments), each a pair of 32-bit words.

[INSTRUCTION_POINTER, *(ARGS...SIZE).step(8)].freeze

NAMES =

Display names of the fixed (non-argument) fields, keyed by byte offset. For the 64-bit instruction_pointer this is the field's base name; a high-word load appends >> 32.

{ SYS_NUMBER => 'sys_number', ARCH => 'arch', INSTRUCTION_POINTER => 'instruction_pointer' }.freeze