2 * Enhanced Seccomp Filter DB
4 * Copyright (c) 2012,2016 Red Hat <pmoore@redhat.com>
5 * Author: Paul Moore <paul@paul-moore.com>
9 * This library is free software; you can redistribute it and/or modify it
10 * under the terms of version 2.1 of the GNU Lesser General Public License as
11 * published by the Free Software Foundation.
13 * This library is distributed in the hope that it will be useful, but WITHOUT
14 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
15 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
18 * You should have received a copy of the GNU Lesser General Public License
19 * along with this library; if not, see <http://www.gnu.org/licenses>.
32 /* XXX - need to provide doxygen comments for the types here */
43 struct db_api_rule_list
{
46 struct db_api_arg
*args
;
47 unsigned int args_cnt
;
49 struct db_api_rule_list
*prev
, *next
;
52 struct db_arg_chain_tree
{
53 /* argument number (a0 = 0, a1 = 1, etc.) */
55 /* argument bpf offset */
56 unsigned int arg_offset
;
58 /* comparison operator */
60 /* syscall argument value */
70 /* list of nodes on this level */
71 struct db_arg_chain_tree
*lvl_prv
, *lvl_nxt
;
73 /* next node in the chain */
74 struct db_arg_chain_tree
*nxt_t
;
75 struct db_arg_chain_tree
*nxt_f
;
79 #define ARG_MASK_MAX ((uint32_t)-1)
80 #define db_chain_lt(x,y) \
81 (((x)->arg < (y)->arg) || \
82 (((x)->arg == (y)->arg) && \
83 (((x)->op < (y)->op) || (((x)->mask & (y)->mask) == (y)->mask))))
84 #define db_chain_eq(x,y) \
85 (((x)->arg == (y)->arg) && \
86 ((x)->op == (y)->op) && ((x)->datum == (y)->datum) && \
87 ((x)->mask == (y)->mask))
88 #define db_chain_gt(x,y) \
89 (((x)->arg > (y)->arg) || \
90 (((x)->arg == (y)->arg) && \
91 (((x)->op > (y)->op) || (((x)->mask & (y)->mask) != (y)->mask))))
92 #define db_chain_action(x) \
93 (((x)->act_t_flg) || ((x)->act_f_flg))
94 #define db_chain_zombie(x) \
95 ((x)->nxt_t == NULL && !((x)->act_t_flg) && \
96 (x)->nxt_f == NULL && !((x)->act_f_flg))
97 #define db_chain_leaf(x) \
98 ((x)->nxt_t == NULL && (x)->nxt_f == NULL)
99 #define db_chain_eq_result(x,y) \
100 ((((x)->nxt_t != NULL && (y)->nxt_t != NULL) || \
101 ((x)->nxt_t == NULL && (y)->nxt_t == NULL)) && \
102 (((x)->nxt_f != NULL && (y)->nxt_f != NULL) || \
103 ((x)->nxt_f == NULL && (y)->nxt_f == NULL)) && \
104 ((x)->act_t_flg == (y)->act_t_flg) && \
105 ((x)->act_f_flg == (y)->act_f_flg) && \
106 (((x)->act_t_flg && (x)->act_t == (y)->act_t) || \
107 (!((x)->act_t_flg))) && \
108 (((x)->act_f_flg && (x)->act_f == (y)->act_f) || \
109 (!((x)->act_f_flg))))
112 /* native syscall number */
115 /* priority - higher is better */
116 unsigned int priority
;
118 /* the argument chain heads */
119 struct db_arg_chain_tree
*chains
;
120 unsigned int node_cnt
;
122 /* action in the case of no argument chains */
125 struct db_sys_list
*next
;
126 /* temporary use only by the BPF generator */
127 struct db_sys_list
*pri_prv
, *pri_nxt
;
132 struct db_filter_attr
{
133 /* action to take if we don't match an explicit allow/deny */
134 uint32_t act_default
;
135 /* action to take if we don't match the architecture */
136 uint32_t act_badarch
;
137 /* NO_NEW_PRIVS related attributes */
139 /* SECCOMP_FILTER_FLAG_TSYNC related attributes */
140 uint32_t tsync_enable
;
144 /* target architecture */
145 const struct arch_def
*arch
;
147 /* syscall filters, kept as a sorted single-linked list */
148 struct db_sys_list
*syscalls
;
150 /* list of rules used to build the filters, kept in order */
151 struct db_api_rule_list
*rules
;
154 struct db_filter_snap
{
155 /* individual filters */
156 struct db_filter
**filters
;
157 unsigned int filter_cnt
;
159 struct db_filter_snap
*next
;
162 struct db_filter_col
{
163 /* verification / state */
167 struct db_filter_attr attr
;
169 /* individual filters */
171 struct db_filter
**filters
;
172 unsigned int filter_cnt
;
174 /* transaction snapshots */
175 struct db_filter_snap
*snapshots
;
179 * Iterate over each item in the DB list
180 * @param iter the iterator
181 * @param list the list
183 * This macro acts as for()/while() conditional and iterates the following
184 * statement for each item in the given list.
187 #define db_list_foreach(iter,list) \
188 for (iter = (list); iter != NULL; iter = iter->next)
190 int db_action_valid(uint32_t action
);
192 struct db_filter_col
*db_col_init(uint32_t def_action
);
193 int db_col_reset(struct db_filter_col
*col
, uint32_t def_action
);
194 void db_col_release(struct db_filter_col
*col
);
196 int db_col_valid(struct db_filter_col
*col
);
198 int db_col_merge(struct db_filter_col
*col_dst
, struct db_filter_col
*col_src
);
200 int db_col_arch_exist(struct db_filter_col
*col
, uint32_t arch_token
);
202 int db_col_attr_get(const struct db_filter_col
*col
,
203 enum scmp_filter_attr attr
, uint32_t *value
);
204 int db_col_attr_set(struct db_filter_col
*col
,
205 enum scmp_filter_attr attr
, uint32_t value
);
207 int db_col_db_new(struct db_filter_col
*col
, const struct arch_def
*arch
);
208 int db_col_db_add(struct db_filter_col
*col
, struct db_filter
*db
);
209 int db_col_db_remove(struct db_filter_col
*col
, uint32_t arch_token
);
211 int db_col_rule_add(struct db_filter_col
*col
,
212 bool strict
, uint32_t action
, int syscall
,
213 unsigned int arg_cnt
, const struct scmp_arg_cmp
*arg_array
);
215 int db_col_syscall_priority(struct db_filter_col
*col
,
216 int syscall
, uint8_t priority
);
218 int db_col_transaction_start(struct db_filter_col
*col
);
219 void db_col_transaction_abort(struct db_filter_col
*col
);
220 void db_col_transaction_commit(struct db_filter_col
*col
);
222 int db_rule_add(struct db_filter
*db
, const struct db_api_rule_list
*rule
);
This page took 0.026564 seconds and 4 git commands to generate.