Class: SeccompTools::Explain

Inherits:
Object
  • Object
show all
Defined in:
lib/seccomp-tools/explain.rb,
lib/seccomp-tools/explain/qword.rb,
lib/seccomp-tools/explain/summary.rb,
lib/seccomp-tools/explain/verdict.rb,
lib/seccomp-tools/explain/analysis.rb,
lib/seccomp-tools/explain/renderer.rb,
lib/seccomp-tools/explain/path_facts.rb

Overview

Analyzes a whole seccomp filter across all execution paths and summarizes it as a per-action policy: which syscalls end in ALLOW, KILL, ERRNO(n), etc., and under what argument constraints.

It runs the generic Symbolic::Executor over the filter to collect every reachable return together with the path condition that leads to it, then hands those leaves to Summary, which interprets them with seccomp semantics (syscall numbers, architectures, actions, ...).

Examples:

insts = SeccompTools::Disasm.to_bpf(raw, :amd64).map(&:inst)
puts SeccompTools::Explain.new(insts, arch: :amd64).summarize

Defined Under Namespace

Modules: Verdict Classes: Analysis, PathFacts, Qword, QwordFusion, Renderer, Summary

Instance Method Summary collapse

Constructor Details

#initialize(instructions, arch:, source: nil) ⇒ Explain

Returns a new instance of Explain.

Parameters:

  • instructions (Array<Instruction::Base>) —

    The filter, as SeccompTools::Disasm.to_bpf(raw, arch).map(&:inst).

  • arch (Symbol) —

    The architecture the filter is written for, used for syscall/argument names.

  • source (String?) (defaults to: nil) —

    A label for the filter (e.g. a filename) shown in the summary header.



25
26
27
28
29
 
# File 'lib/seccomp-tools/explain.rb', line 25

def initialize(instructions, arch:, source: nil)
  @instructions = instructions
  @arch = arch
  @source = source
end

Instance Method Details

#summarize ⇒ Summary

Walks the filter and returns a printable Summary.

Returns:



33
34
35
36
 
# File 'lib/seccomp-tools/explain.rb', line 33

def summarize
  leaves, truncated = Symbolic::Executor.new(@instructions).run
  Summary.new(leaves, arch: @arch, source: @source, truncated:)
end