Module: SeccompTools::Explain::Verdict

Defined in:
lib/seccomp-tools/explain/verdict.rb

Overview

Decodes the value a filter path returns into the action it stands for: the label a policy shows (+ALLOW+, ERRNO(5), ...) and where that action sorts among the buckets.

Constant Summary collapse

ORDER =

Buckets are printed in this order; unlisted actions sort last.

%i[ALLOW USER_NOTIF LOG TRACE TRAP ERRNO KILL KILL_PROCESS UNKNOWN].freeze

Class Method Summary collapse

Class Method Details

.action_of(label) ⇒ Symbol

The bare action symbol of a label, recovered by stripping any (data) / + (annotation)+ suffix label appended. Safe because no action name itself contains " (".

Parameters:

  • label (String)

Returns:

  • (Symbol) 


39
40
41
 
# File 'lib/seccomp-tools/explain/verdict.rb', line 39

def action_of(label)
  label.sub(/\s*\(.*/, '').to_sym
end

.label(ret) ⇒ String

The label for the value ret a leaf returns, including the SECCOMP_RET_DATA part when it is meaningful for the action.

Parameters:

Returns:

  • (String) 


19
20
21
22
23
24
25
 
# File 'lib/seccomp-tools/explain/verdict.rb', line 19

def label(ret)
  return 'UNKNOWN' unless ret.imm?

  # An unrecognized action value loads fine; the kernel treats it as KILL_PROCESS
  # (KILL_THREAD before Linux 4.14). See seccomp(2).
  Const::BPF.action_label(ret.val) || format('KILL_PROCESS (unknown action 0x%x)', ret.val)
end

.rank(label) ⇒ Array(Integer, String)

Where the bucket labeled label sorts: by its action's position in ORDER, then alphabetically. Works on any label label produces, data and annotations included.

Parameters:

  • label (String)

Returns:

  • (Array(Integer, String)) 


31
32
33
 
# File 'lib/seccomp-tools/explain/verdict.rb', line 31

def rank(label)
  [ORDER.index(action_of(label)) || ORDER.size, label]
end