all: add seccomp_precompute() functionality

This patch adds a seccomp_precompute() API to precompute the seccomp
filter prior to calling seccomp_load() or similar functions.  Not
only does this improve the performance of seccomp_load(), it ensures
that seccomp_load() is async-signal-safe if no additional changes
have been made since the filter was precomputed.

Python bindings, test, and manpage updates are included in this
patch.

One minor side effect of this change is that seccomp_export_bpf_mem()
now always return the length of the filter in the "len" function
parameter, even in cases where the passed buffer is too small.
Arguably seccomp_export_bpf_mem() should have always behaved this
way.

Signed-off-by: Paul Moore <paul@paul-moore.com>

14 files changed, 366 insertions, 19 deletions

diff --git a/doc/Makefile.am b/doc/Makefile.am
index a21d4c8..2eff0ad 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -33,6 +33,7 @@ dist_man3_MANS = \
 	man/man3/seccomp_init.3 \
 	man/man3/seccomp_load.3 \
 	man/man3/seccomp_merge.3 \
+	man/man3/seccomp_precompute.3 \
 	man/man3/seccomp_release.3 \
 	man/man3/seccomp_reset.3 \
 	man/man3/seccomp_rule_add.3 \
diff --git a/doc/man/man3/seccomp_load.3 b/doc/man/man3/seccomp_load.3
index 729f73e..d0d43eb 100644
--- a/doc/man/man3/seccomp_load.3
+++ b/doc/man/man3/seccomp_load.3
@@ -22,7 +22,12 @@ Link with \fI\-lseccomp\fP.
 Loads the seccomp filter provided by
 .I ctx
 into the kernel; if the function
-succeeds the new seccomp filter will be active when the function returns.
+succeeds the new seccomp filter will be active when the function returns.  If
+.BR seccomp_precompute (3)
+was called prior to attempting to load the seccomp filter, and no changes have
+been made to the filter,
+.BR seccomp_load ()
+can be considered to be async-signal-safe.
 .P
 As it is possible to have multiple stacked seccomp filters for a given task
 (defined as either a process or a thread), it is important to remember that
@@ -108,5 +113,5 @@ Paul Moore <paul@paul-moore.com>
 .BR seccomp_release (3),
 .BR seccomp_rule_add (3),
 .BR seccomp_rule_add_exact (3)
-
-
+.BR seccomp_precompute (3)
+.BR signal-safety (7)
diff --git a/doc/man/man3/seccomp_precompute.3 b/doc/man/man3/seccomp_precompute.3
new file mode 100644
index 0000000..b82bd0a
--- /dev/null
+++ b/doc/man/man3/seccomp_precompute.3
@@ -0,0 +1,103 @@
+.TH "seccomp_precompute" 3 "19 September 2022" "paul@paul-moore.com" "libseccomp Documentation"
+.\" //////////////////////////////////////////////////////////////////////////
+.SH NAME
+.\" //////////////////////////////////////////////////////////////////////////
+seccomp_precompute \- Precompute the current seccomp filter
+.\" //////////////////////////////////////////////////////////////////////////
+.SH SYNOPSIS
+.\" //////////////////////////////////////////////////////////////////////////
+.nf
+.B #include <seccomp.h>
+.sp
+.B typedef void * scmp_filter_ctx;
+.sp
+.BI "int seccomp_precompute(scmp_filter_ctx " ctx ");"
+.sp
+Link with \fI\-lseccomp\fP.
+.fi
+.\" //////////////////////////////////////////////////////////////////////////
+.SH DESCRIPTION
+.\" //////////////////////////////////////////////////////////////////////////
+.P
+Precomputes the seccomp filter for later use by
+.BR seccomp_load ()
+and similar functions.  Not only does this improve performance of
+.BR seccomp_load ()
+it also ensures that the seccomp filter can be loaded in an async-signal-safe
+manner if no changes have been made to the filter since it was precomputed.
+.\" //////////////////////////////////////////////////////////////////////////
+.SH RETURN VALUE
+.\" //////////////////////////////////////////////////////////////////////////
+Returns zero on success or one of the following error codes on failure:
+.TP
+.B -ECANCELED
+There was a system failure beyond the control of the library.
+.TP
+.B -EFAULT
+Internal libseccomp failure.
+.TP
+.B -EINVAL
+Invalid input, either the context or architecture token is invalid.
+.TP
+.B -ENOMEM
+The library was unable to allocate enough memory.
+.P
+If the \fISCMP_FLTATR_API_SYSRAWRC\fP filter attribute is non-zero then
+additional error codes may be returned to the caller; these additional error
+codes are the negative \fIerrno\fP values returned by the system.  Unfortunately
+libseccomp can make no guarantees about these return values.
+.\" //////////////////////////////////////////////////////////////////////////
+.SH EXAMPLES
+.\" //////////////////////////////////////////////////////////////////////////
+.nf
+#include <seccomp.h>
+
+int main(int argc, char *argv[])
+{
+	int rc = \-1;
+	scmp_filter_ctx ctx;
+
+	ctx = seccomp_init(SCMP_ACT_KILL);
+	if (ctx == NULL)
+		goto out;
+
+	/* ... */
+
+	rc = seccomp_precompute(ctx);
+	if (rc < 0)
+		goto out;
+
+	/* ... */
+
+	rc = seccomp_load(ctx);
+	if (rc < 0)
+		goto out;
+
+	/* ... */
+
+out:
+	seccomp_release(ctx);
+	return \-rc;
+}
+.fi
+.\" //////////////////////////////////////////////////////////////////////////
+.SH NOTES
+.\" //////////////////////////////////////////////////////////////////////////
+.P
+While the seccomp filter can be generated independent of the kernel, kernel
+support is required to load and enforce the seccomp filter generated by
+libseccomp.
+.P
+The libseccomp project site, with more information and the source code
+repository, can be found at https://github.com/seccomp/libseccomp.  This tool,
+as well as the libseccomp library, is currently under development, please
+report any bugs at the project site or directly to the author.
+.\" //////////////////////////////////////////////////////////////////////////
+.SH AUTHOR
+.\" //////////////////////////////////////////////////////////////////////////
+Paul Moore <paul@paul-moore.com>
+.\" //////////////////////////////////////////////////////////////////////////
+.SH SEE ALSO
+.\" //////////////////////////////////////////////////////////////////////////
+.BR seccomp_load (3)
+.BR signal-safety (7)
diff --git a/include/seccomp.h.in b/include/seccomp.h.in
index 983fb77..6f4929b 100644
--- a/include/seccomp.h.in
+++ b/include/seccomp.h.in
@@ -830,6 +830,17 @@ int seccomp_export_bpf(const scmp_filter_ctx ctx, int fd);
  */
 int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf, size_t *len);
 
+/**
+ * Precompute the seccomp filter for future use
+ * @param ctx the filter context
+ *
+ * This function precomputes the seccomp filter and stores it internally for
+ * future use, speeding up seccomp_load() and other functions which require
+ * the generated filter.
+ *
+ */
+int seccomp_precompute(const scmp_filter_ctx ctx);
+
 /*
  * pseudo syscall definitions
  */
diff --git a/src/api.c b/src/api.c
index 423a1c5..9c2f64a 100644
--- a/src/api.c
+++ b/src/api.c
@@ -2,6 +2,7 @@
  * Seccomp Library API
  *
  * Copyright (c) 2012,2013 Red Hat <pmoore@redhat.com>
+ * Copyright (c) 2022 Microsoft Corporation <paulmoore@microsoft.com>
  * Author: Paul Moore <paul@paul-moore.com>
  */
 
@@ -723,11 +724,11 @@ API int seccomp_export_bpf(const scmp_filter_ctx ctx, int fd)
 		return _rc_filter(-EINVAL);
 	col = (struct db_filter_col *)ctx;
 
-	rc = gen_bpf_generate(col, &program);
+	rc = db_col_precompute(col);
 	if (rc < 0)
 		return _rc_filter(rc);
+	program = col->prgm_bpf;
 	rc = write(fd, program->blks, BPF_PGM_SIZE(program));
-	gen_bpf_release(program);
 	if (rc < 0)
 		return _rc_filter_sys(col, -errno);
 
@@ -739,7 +740,6 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
 			       size_t *len)
 {
 	int rc;
-	size_t buf_len;
 	struct db_filter_col *col;
 	struct bpf_program *program;
 
@@ -747,21 +747,31 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
 		return _rc_filter(-EINVAL);
 	col = (struct db_filter_col *)ctx;
 
-	rc = gen_bpf_generate(col, &program);
+	rc = db_col_precompute(col);
 	if (rc < 0)
 		return _rc_filter(rc);
-	buf_len = *len;
-	*len = BPF_PGM_SIZE(program);
+	program = col->prgm_bpf;
 
-	rc = 0;
 	if (buf) {
 		/* If we have a big enough buffer, write the program. */
-		if (*len > buf_len)
+		if (BPF_PGM_SIZE(program) > *len)
 			rc = _rc_filter(-ERANGE);
 		else
 			memcpy(buf, program->blks, *len);
 	}
-	gen_bpf_release(program);
+	*len = BPF_PGM_SIZE(program);
 
 	return rc;
 }
+
+/* NOTE - function header comment in include/seccomp.h */
+API int seccomp_precompute(const scmp_filter_ctx ctx)
+{
+	struct db_filter_col *col;
+
+	if (_ctx_valid(ctx))
+		return _rc_filter(-EINVAL);
+	col = (struct db_filter_col *)ctx;
+
+	return _rc_filter(db_col_precompute(col));
+}
diff --git a/src/db.c b/src/db.c
index 3d9585a..6d81874 100644
--- a/src/db.c
+++ b/src/db.c
@@ -3,6 +3,7 @@
  *
  * Copyright (c) 2012,2016,2018 Red Hat <pmoore@redhat.com>
  * Copyright (c) 2019 Cisco Systems, Inc. <pmoore2@cisco.com>
+ * Copyright (c) 2022 Microsoft Corporation <paulmoore@microsoft.com>
  * Author: Paul Moore <paul@paul-moore.com>
  */
 
@@ -1098,6 +1099,9 @@ int db_col_reset(struct db_filter_col *col, uint32_t def_action)
 		free(snap);
 	}
 
+	/* reset the precomputed programs */
+	db_col_precompute_reset(col);
+
 	return 0;
 }
 
@@ -1162,6 +1166,9 @@ void db_col_release(struct db_filter_col *col)
 		free(col->filters);
 	col->filters = NULL;
 
+	/* free any precompute */
+	db_col_precompute_reset(col);
+
 	/* free the collection */
 	free(col);
 }
@@ -1250,6 +1257,9 @@ int db_col_merge(struct db_filter_col *col_dst, struct db_filter_col *col_src)
 		col_dst->filter_cnt++;
 	}
 
+	/* reset the precompute */
+	db_col_precompute_reset(col_dst);
+
 	/* free the source */
 	col_src->filter_cnt = 0;
 	db_col_release(col_src);
@@ -1373,6 +1383,7 @@ int db_col_attr_set(struct db_filter_col *col,
 			col->attr.act_badarch = value;
 		else
 			return -EINVAL;
+		db_col_precompute_reset(col);
 		break;
 	case SCMP_FLTATR_CTL_NNP:
 		col->attr.nnp_enable = (value ? 1 : 0);
@@ -1394,6 +1405,7 @@ int db_col_attr_set(struct db_filter_col *col,
 		break;
 	case SCMP_FLTATR_API_TSKIP:
 		col->attr.api_tskip = (value ? 1 : 0);
+		db_col_precompute_reset(col);
 		break;
 	case SCMP_FLTATR_CTL_LOG:
 		rc = sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_LOG);
@@ -1427,6 +1439,7 @@ int db_col_attr_set(struct db_filter_col *col,
 			rc = -EOPNOTSUPP;
 			break;
 		}
+		db_col_precompute_reset(col);
 		break;
 	case SCMP_FLTATR_API_SYSRAWRC:
 		col->attr.api_sysrawrc = (value ? 1 : 0);
@@ -1460,6 +1473,8 @@ int db_col_db_new(struct db_filter_col *col, const struct arch_def *arch)
 	rc = db_col_db_add(col, db);
 	if (rc < 0)
 		_db_release(db);
+	else
+		db_col_precompute_reset(col);
 
 	return rc;
 }
@@ -1540,6 +1555,8 @@ int db_col_db_remove(struct db_filter_col *col, uint32_t arch_token)
 		col->endian = 0;
 	}
 
+	db_col_precompute_reset(col);
+
 	return 0;
 }
 
@@ -2233,6 +2250,9 @@ priority_failure:
 			rc = rc_tmp;
 	}
 
+	if (rc == 0)
+		db_col_precompute_reset(col);
+
 	return rc;
 }
 
@@ -2377,8 +2397,11 @@ add_arch_fail:
 
 add_return:
 	/* update the misc state */
-	if (rc == 0 && action == SCMP_ACT_NOTIFY)
-		col->notify_used = true;
+	if (rc == 0) {
+		if (action == SCMP_ACT_NOTIFY)
+			col->notify_used = true;
+		db_col_precompute_reset(col);
+	}
 	if (chain != NULL)
 		free(chain);
 	return rc;
@@ -2501,6 +2524,9 @@ void db_col_transaction_abort(struct db_filter_col *col)
 	for (iter = 0; iter < filter_cnt; iter++)
 		_db_release(filters[iter]);
 	free(filters);
+
+	/* free any precompute */
+	db_col_precompute_reset(col);
 }
 
 /**
@@ -2618,3 +2644,33 @@ shadow_err:
 	_db_snap_release(snap);
 	return;
 }
+
+/**
+ * Precompute the seccomp filters
+ * @param col the filter collection
+ *
+ * This function precomputes the seccomp filters before they are needed,
+ * returns zero on success, negative values on error.
+ *
+ */
+int db_col_precompute(struct db_filter_col *col)
+{
+	if (!col->prgm_bpf)
+		return gen_bpf_generate(col, &col->prgm_bpf);
+	return 0;
+}
+
+/**
+ * Free any precomputed filter programs
+ * @param col the filter collection
+ *
+ * This function releases any precomputed filter programs.
+ */
+void db_col_precompute_reset(struct db_filter_col *col)
+{
+	if (!col->prgm_bpf)
+		return;
+
+	gen_bpf_release(col->prgm_bpf);
+	col->prgm_bpf = NULL;
+}
diff --git a/src/db.h b/src/db.h
index 765c607..9a41427 100644
--- a/src/db.h
+++ b/src/db.h
@@ -2,6 +2,7 @@
  * Enhanced Seccomp Filter DB
  *
  * Copyright (c) 2012,2016 Red Hat <pmoore@redhat.com>
+ * Copyright (c) 2022 Microsoft Corporation <paulmoore@microsoft.com>
  * Author: Paul Moore <paul@paul-moore.com>
  */
 
@@ -28,6 +29,7 @@
 #include <seccomp.h>
 
 #include "arch.h"
+#include "gen_bpf.h"
 
 /* XXX - need to provide doxygen comments for the types here */
 
@@ -162,6 +164,9 @@ struct db_filter_col {
 
 	/* userspace notification */
 	bool notify_used;
+
+	/* precomputed programs */
+	struct bpf_program *prgm_bpf;
 };
 
 /**
@@ -212,6 +217,9 @@ int db_col_transaction_start(struct db_filter_col *col);
 void db_col_transaction_abort(struct db_filter_col *col);
 void db_col_transaction_commit(struct db_filter_col *col);
 
+int db_col_precompute(struct db_filter_col *col);
+void db_col_precompute_reset(struct db_filter_col *col);
+
 int db_rule_add(struct db_filter *db, const struct db_api_rule_list *rule);
 
 #endif
diff --git a/src/python/libseccomp.pxd b/src/python/libseccomp.pxd
index 6175c8a..9589cfe 100644
--- a/src/python/libseccomp.pxd
+++ b/src/python/libseccomp.pxd
@@ -170,5 +170,7 @@ cdef extern from "seccomp.h":
     int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
                                size_t *len)
 
+    int seccomp_precompute(const scmp_filter_ctx ctx)
+
 # kate: syntax python;
 # kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;
diff --git a/src/python/seccomp.pyx b/src/python/seccomp.pyx
index 3551aac..1f58517 100644
--- a/src/python/seccomp.pyx
+++ b/src/python/seccomp.pyx
@@ -1069,5 +1069,17 @@ cdef class SyscallFilter:
             raise RuntimeError(str.format("Library error (errno = {0})", rc))
         return program
 
+    def precompute(self):
+        """ Precompute the seccomp filter.
+
+        Description:
+        Precompute the seccomp filter and store it internally for future use,
+        speeding up filter loads and other functions which require the
+        generated filter.
+        """
+        rc = libseccomp.seccomp_precompute(self._ctx)
+        if rc != 0:
+            raise RuntimeError(str.format("Library error (errno = {0})", rc))
+
 # kate: syntax python;
 # kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;
diff --git a/src/system.c b/src/system.c
index ae445bf..94e0405 100644
--- a/src/system.c
+++ b/src/system.c
@@ -360,9 +360,10 @@ int sys_filter_load(struct db_filter_col *col, bool rawrc)
 	bool listener_req;
 	struct bpf_program *prgm = NULL;
 
-	rc = gen_bpf_generate(col, &prgm);
+	rc = db_col_precompute(col);
 	if (rc < 0)
 		return rc;
+	prgm = col->prgm_bpf;
 
 	/* attempt to set NO_NEW_PRIVS */
 	if (col->attr.nnp_enable) {
@@ -417,7 +418,6 @@ int sys_filter_load(struct db_filter_col *col, bool rawrc)
 
 filter_load_out:
 	/* cleanup and return */
-	gen_bpf_release(prgm);
 	if (rc == -ESRCH)
 		return -ESRCH;
 	if (rc < 0)
diff --git a/tests/60-sim-precompute.c b/tests/60-sim-precompute.c
new file mode 100644
index 0000000..32601c8
--- /dev/null
+++ b/tests/60-sim-precompute.c
@@ -0,0 +1,68 @@
+/**
+ * Seccomp Library test program
+ *
+ * Copyright (c) 2022 Microsoft Corporation <paulmoore@microsoft.com>
+ * Author: Paul Moore <paul@paul-moore.com>
+ */
+
+/*
+ * This library is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; if not, see <http://www.gnu.org/licenses>.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+
+#include <seccomp.h>
+
+#include "util.h"
+
+int main(int argc, char *argv[])
+{
+	int rc;
+	struct util_options opts;
+	scmp_filter_ctx ctx = NULL;
+
+	rc = util_getopt(argc, argv, &opts);
+	if (rc < 0)
+		goto out;
+
+	ctx = seccomp_init(SCMP_ACT_ALLOW);
+	if (ctx == NULL)
+		return ENOMEM;
+
+	rc = seccomp_precompute(ctx);
+	if (rc != 0)
+		goto out;
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_KILL, 1000, 0);
+	if (rc != 0)
+		goto out;
+
+	rc = seccomp_precompute(ctx);
+	if (rc != 0)
+		goto out;
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_KILL, 1001, 0);
+	if (rc != 0)
+		goto out;
+
+	rc = seccomp_precompute(ctx);
+	if (rc != 0)
+		goto out;
+
+	rc = util_filter_output(&opts, ctx);
+	if (rc)
+		goto out;
+
+out:
+	seccomp_release(ctx);
+	return (rc < 0 ? -rc : rc);
+}
diff --git a/tests/60-sim-precompute.py b/tests/60-sim-precompute.py
new file mode 100755
index 0000000..bb2f409
--- /dev/null
+++ b/tests/60-sim-precompute.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+
+#
+# Seccomp Library test program
+#
+# Copyright (c) 2012 Red Hat <pmoore@redhat.com>
+# Author: Paul Moore <paul@paul-moore.com>
+#
+
+#
+# This library is free software; you can redistribute it and/or modify it
+# under the terms of version 2.1 of the GNU Lesser General Public License as
+# published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+# for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library; if not, see <http://www.gnu.org/licenses>.
+#
+
+import argparse
+import sys
+
+import util
+
+from seccomp import *
+
+def test(args):
+    f = SyscallFilter(ALLOW)
+    f.precompute()
+    f.add_rule_exactly(KILL, 1000)
+    f.precompute()
+    f.add_rule_exactly(KILL, 1001)
+    f.precompute()
+    return f
+
+args = util.get_opt()
+ctx = test(args)
+util.filter_output(args, ctx)
+
+# kate: syntax python;
+# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;
diff --git a/tests/60-sim-precompute.tests b/tests/60-sim-precompute.tests
new file mode 100644
index 0000000..998122c
--- /dev/null
+++ b/tests/60-sim-precompute.tests
@@ -0,0 +1,23 @@
+#
+# libseccomp regression test automation data
+#
+# Copyright (c) 2022 Microsoft Corporation <paulmoore@microsoft.com>
+# Author: Paul Moore <paul@paul-moore.com>
+#
+
+test type: bpf-sim
+
+# Testname		Arch	Syscall	Arg0	Arg1	Arg2	Arg3	Arg4	Arg5	Result
+60-sim-precompute	all	0-10	N	N	N	N	N	N	ALLOW
+60-sim-precompute	all	1000	N	N	N	N	N	N	KILL
+60-sim-precompute	all	1001	N	N	N	N	N	N	KILL
+
+test type: bpf-sim-fuzz
+
+# Testname		StressCount
+60-sim-precompute	5
+
+test type: bpf-valgrind
+
+# Testname
+60-sim-precompute
diff --git a/tests/Makefile.am b/tests/Makefile.am
index f0a1f8e..07bea2e 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -94,7 +94,8 @@ check_PROGRAMS = \
 	56-basic-iterate_syscalls \
 	57-basic-rawsysrc \
 	58-live-tsync_notify \
-	59-basic-empty_binary_tree
+	59-basic-empty_binary_tree \
+	60-sim-precompute
 
 EXTRA_DIST_TESTPYTHON = \
 	util.py \
@@ -154,7 +155,8 @@ EXTRA_DIST_TESTPYTHON = \
 	56-basic-iterate_syscalls.py \
 	57-basic-rawsysrc.py \
 	58-live-tsync_notify.py \
-	59-basic-empty_binary_tree.py
+	59-basic-empty_binary_tree.py \
+	60-sim-precompute.py
 
 EXTRA_DIST_TESTCFGS = \
 	01-sim-allow.tests \
@@ -215,7 +217,8 @@ EXTRA_DIST_TESTCFGS = \
 	56-basic-iterate_syscalls.tests \
 	57-basic-rawsysrc.tests \
 	58-live-tsync_notify.tests \
-	59-basic-empty_binary_tree.tests
+	59-basic-empty_binary_tree.tests \
+	60-sim-precompute.tests
 
 EXTRA_DIST_TESTSCRIPTS = \
 	38-basic-pfc_coverage.sh 38-basic-pfc_coverage.pfc \