Class: SeccompTools::Explain::Summary

Inherits:
Object
  • Object
show all
Defined in:
lib/seccomp-tools/explain/summary.rb

Overview

Turns the raw Symbolic::Executor::Leafs collected by the walk into a human-readable policy, grouped by architecture and then by action (+ALLOW+, KILL, ERRNO(n), ...).

This class owns the presentation: sections, buckets and the default rule. It reads each leaf's path through PathFacts, decodes the returned action with Verdict, reassembles 64-bit word checks with QwordFusion, and stringifies conditions with Renderer.

Constant Summary collapse

SYS_NAME =

Display name of the syscall-number field, for the range subjects.

Const::BPF::SeccompData::NAMES.fetch(Const::BPF::SeccompData::SYS_NUMBER)
X32_SYSCALL_BIT =

The x32 ABI bit (+__X32_SYSCALL_BIT+); a lower-bound-only range at exactly this value is the conventional x32 guard, worth annotating.

0x40000000
WRAP_WIDTH =

Widest a wrapped bucket line may get, in columns.

72

Instance Method Summary collapse

Constructor Details

#initialize(leaves, arch:, source: nil, truncated: false) ⇒ Summary

Returns a new instance of Summary.

Parameters:

  • leaves (Array<Symbolic::Executor::Leaf>)
  • arch (Symbol) —

    The filter's declared architecture, used when the filter itself does not branch on arch.

  • source (String?) (defaults to: nil) —

    Label shown in the header.

  • truncated (Boolean) (defaults to: false) —

    Whether the walk hit Symbolic::Executor::STEP_CAP.



34
35
36
37
38
39
40
41
 
# File 'lib/seccomp-tools/explain/summary.rb', line 34

def initialize(leaves, arch:, source: nil, truncated: false)
  @arch = arch
  @source = source
  @truncated = truncated
  @fusion = QwordFusion.new(arch)
  @renderer = Renderer.new(@fusion)
  @analysis = Analysis.new(leaves)
end

Instance Method Details

#to_s ⇒ String

Renders the policy.

Returns:

  • (String) 


45
46
47
48
49
50
51
52
53
54
 
# File 'lib/seccomp-tools/explain/summary.rb', line 45

def to_s
  out = +''
  out << "Seccomp policy for #{@source}\n" if @source
  out << "WARNING: analysis truncated (filter too large); results may be incomplete.\n" if @truncated
  @analysis.sections(@arch).each do |_arch_val, arch_sym, title, leaves|
    out << "\n" << render_section(title, section_buckets(arch_sym, leaves))
  end
  out << render_other_arches
  out
end