all: add seccomp_precompute() functionality

This patch adds a seccomp_precompute() API to precompute the seccomp
filter prior to calling seccomp_load() or similar functions.  Not
only does this improve the performance of seccomp_load(), it ensures
that seccomp_load() is async-signal-safe if no additional changes
have been made since the filter was precomputed.

Python bindings, test, and manpage updates are included in this
patch.

One minor side effect of this change is that seccomp_export_bpf_mem()
now always return the length of the filter in the "len" function
parameter, even in cases where the passed buffer is too small.
Arguably seccomp_export_bpf_mem() should have always behaved this
way.

Signed-off-by: Paul Moore <paul@paul-moore.com>

4 files changed, 142 insertions, 3 deletions

diff --git a/tests/60-sim-precompute.c b/tests/60-sim-precompute.c
new file mode 100644
index 0000000..32601c8
--- /dev/null
+++ b/tests/60-sim-precompute.c
@@ -0,0 +1,68 @@
+/**
+ * Seccomp Library test program
+ *
+ * Copyright (c) 2022 Microsoft Corporation <paulmoore@microsoft.com>
+ * Author: Paul Moore <paul@paul-moore.com>
+ */
+
+/*
+ * This library is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; if not, see <http://www.gnu.org/licenses>.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+
+#include <seccomp.h>
+
+#include "util.h"
+
+int main(int argc, char *argv[])
+{
+	int rc;
+	struct util_options opts;
+	scmp_filter_ctx ctx = NULL;
+
+	rc = util_getopt(argc, argv, &opts);
+	if (rc < 0)
+		goto out;
+
+	ctx = seccomp_init(SCMP_ACT_ALLOW);
+	if (ctx == NULL)
+		return ENOMEM;
+
+	rc = seccomp_precompute(ctx);
+	if (rc != 0)
+		goto out;
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_KILL, 1000, 0);
+	if (rc != 0)
+		goto out;
+
+	rc = seccomp_precompute(ctx);
+	if (rc != 0)
+		goto out;
+	rc = seccomp_rule_add_exact(ctx, SCMP_ACT_KILL, 1001, 0);
+	if (rc != 0)
+		goto out;
+
+	rc = seccomp_precompute(ctx);
+	if (rc != 0)
+		goto out;
+
+	rc = util_filter_output(&opts, ctx);
+	if (rc)
+		goto out;
+
+out:
+	seccomp_release(ctx);
+	return (rc < 0 ? -rc : rc);
+}
diff --git a/tests/60-sim-precompute.py b/tests/60-sim-precompute.py
new file mode 100755
index 0000000..bb2f409
--- /dev/null
+++ b/tests/60-sim-precompute.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+
+#
+# Seccomp Library test program
+#
+# Copyright (c) 2012 Red Hat <pmoore@redhat.com>
+# Author: Paul Moore <paul@paul-moore.com>
+#
+
+#
+# This library is free software; you can redistribute it and/or modify it
+# under the terms of version 2.1 of the GNU Lesser General Public License as
+# published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+# for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library; if not, see <http://www.gnu.org/licenses>.
+#
+
+import argparse
+import sys
+
+import util
+
+from seccomp import *
+
+def test(args):
+    f = SyscallFilter(ALLOW)
+    f.precompute()
+    f.add_rule_exactly(KILL, 1000)
+    f.precompute()
+    f.add_rule_exactly(KILL, 1001)
+    f.precompute()
+    return f
+
+args = util.get_opt()
+ctx = test(args)
+util.filter_output(args, ctx)
+
+# kate: syntax python;
+# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;
diff --git a/tests/60-sim-precompute.tests b/tests/60-sim-precompute.tests
new file mode 100644
index 0000000..998122c
--- /dev/null
+++ b/tests/60-sim-precompute.tests
@@ -0,0 +1,23 @@
+#
+# libseccomp regression test automation data
+#
+# Copyright (c) 2022 Microsoft Corporation <paulmoore@microsoft.com>
+# Author: Paul Moore <paul@paul-moore.com>
+#
+
+test type: bpf-sim
+
+# Testname		Arch	Syscall	Arg0	Arg1	Arg2	Arg3	Arg4	Arg5	Result
+60-sim-precompute	all	0-10	N	N	N	N	N	N	ALLOW
+60-sim-precompute	all	1000	N	N	N	N	N	N	KILL
+60-sim-precompute	all	1001	N	N	N	N	N	N	KILL
+
+test type: bpf-sim-fuzz
+
+# Testname		StressCount
+60-sim-precompute	5
+
+test type: bpf-valgrind
+
+# Testname
+60-sim-precompute
diff --git a/tests/Makefile.am b/tests/Makefile.am
index f0a1f8e..07bea2e 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -94,7 +94,8 @@ check_PROGRAMS = \
 	56-basic-iterate_syscalls \
 	57-basic-rawsysrc \
 	58-live-tsync_notify \
-	59-basic-empty_binary_tree
+	59-basic-empty_binary_tree \
+	60-sim-precompute
 
 EXTRA_DIST_TESTPYTHON = \
 	util.py \
@@ -154,7 +155,8 @@ EXTRA_DIST_TESTPYTHON = \
 	56-basic-iterate_syscalls.py \
 	57-basic-rawsysrc.py \
 	58-live-tsync_notify.py \
-	59-basic-empty_binary_tree.py
+	59-basic-empty_binary_tree.py \
+	60-sim-precompute.py
 
 EXTRA_DIST_TESTCFGS = \
 	01-sim-allow.tests \
@@ -215,7 +217,8 @@ EXTRA_DIST_TESTCFGS = \
 	56-basic-iterate_syscalls.tests \
 	57-basic-rawsysrc.tests \
 	58-live-tsync_notify.tests \
-	59-basic-empty_binary_tree.tests
+	59-basic-empty_binary_tree.tests \
+	60-sim-precompute.tests
 
 EXTRA_DIST_TESTSCRIPTS = \
 	38-basic-pfc_coverage.sh 38-basic-pfc_coverage.pfc \