summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* doc: updates for the v2.0.0 releasev2.0.0release-2.0Paul Moore2013-01-281-3/+1
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* build: disable the python bindingsPaul Moore2013-01-251-4/+6
| | | | | | | | | This patch doesn't completely disable the python bindings, but it makes it much harder to enable them. I'm doing this because I'm not quite comfortable yet with shipping these without having at least one user to point to and say, "yes, these bindings are reasonable." Signed-off-by: Paul Moore <pmoore@redhat.com>
* build: set version for the 2.0.0 releasePaul Moore2013-01-251-1/+1
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: revert the change to the SCMP_SYS() macroPaul Moore2013-01-251-1/+1
| | | | | | | | It turns out that it is fairly common for people to use SCMP_SYS() as a constant/initializer so the change to have it point at a function breaks a few things. Signed-off-by: Paul Moore <pmoore@redhat.com>
* doc: escape some manpage dashes/minus-signsPaul Moore2013-01-245-13/+13
| | | | | Reported-by: Kees Cook <keescook@chromium.org> Signed-off-by: Paul Moore <pmoore@redhat.com>
* tools: remove the old syscall resolver scriptPaul Moore2013-01-241-70/+0
| | | | | | | | The new syscall resolver program which leverages the internal syscall tables is much better suited to our mult-arch capabilities so were just going to drop this script. Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: fix x86 tests to skip writeKees Cook2013-01-241-3/+3
| | | | | | | | | The 14-reset test on x86 wasn't correctly skipping the "write" sycall (number 4). This moves the ranges over by one to line up correctly. Without this, "regression -b 14-reset -s 007" would always fail. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Paul Moore <pmoore@redhat.com>
* doc: update the CHANGELOGPaul Moore2013-01-231-0/+12
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: test for missing syscalls on an architecturePaul Moore2013-01-225-1/+134
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: remove arch specific code from the tests when possiblePaul Moore2013-01-222-17/+20
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: ensure full syscall coverage across x86 and x86_64Paul Moore2013-01-2110-41/+529
| | | | | | This patch ensures that you can create non-native filters using syscalls not present in the native architecture. Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: enable multi-arch testing for some of the existing testsPaul Moore2013-01-212-18/+21
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: do some cleanup and assorted changes in the regression scriptPaul Moore2013-01-211-182/+141
| | | | | | | | | | | Random changes, including but not limited to: - Fix test numbering, again, as I screwed it up a bit last time - Use $(...) consistently for sub-shells - Comment tweaks - Added some verify_deps checks - Cleaned up some of the output formatting in the test functions Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: support running tests on all supported architecturesPaul Moore2013-01-181-136/+160
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tools: allow sys_resolver to translate syscallsPaul Moore2013-01-181-3/+14
| | | | | | | | | | | Normally sys_resolver does not translate syscalls which means that in some cases, e.g. socket() on x86, the returned syscall number could be a negative number (__PNR_socket). This patch adds a new option, '-t', which causes sys_resolver to attempt to do the translation and return the translated syscall number instead, e.g. socketcall() for socket() on x86. Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: allow the regression script to run multiple test modesPaul Moore2013-01-171-15/+20
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: reduce the number of fuzz testsPaul Moore2013-01-1715-16/+16
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: start the fuzz tests at zero like the other testsPaul Moore2013-01-171-15/+2
| | | | | | Also remove some dead code while we are in there making changes. Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: add a basic whitelist testPaul Moore2013-01-165-1/+148
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* build: quiet the build INFO messages during verbose buildsPaul Moore2013-01-163-13/+16
| | | | | | The ">> INFO: ..." messages aren't needed in verbose builds. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: use the syscall resolver API in the SCMP_SYS() macroPaul Moore2013-01-151-1/+1
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: add tests for the new syscall resolver APIsPaul Moore2013-01-152-2/+34
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* doc: add the manpages for the new syscall resolving APIsPaul Moore2013-01-154-8/+31
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add syscall resolution functions that take an architecture argumentPaul Moore2013-01-154-11/+92
| | | | | | | | Similar to the existing seccomp_syscall_resolve_name() function, but they work for arbitrary architectures (assuming libseccomp support of course) and not just the native architecture. Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: fix 16-arch-basic.pyPaul Moore2013-01-152-10/+11
| | | | | | | | | | | | | Fix the following problem: Traceback (most recent call last): File "./16-arch-basic.py", line 47, in <module> ctx = test(args) File "./16-arch-basic.py", line 33, in test if not Arch.system() == Arch.X86: TypeError: descriptor 'system' of 'seccomp.Arch' object needs an argument Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: update 05-long-jumps.py to match the C versionPaul Moore2013-01-151-2/+2
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* build: fix the makefile verbosityPaul Moore2013-01-141-0/+4
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* doc: fix up unescaped minus signs in man-pagesKees Cook2012-12-106-13/+13
| | | | | Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Paul Moore <pmoore@redhat.com>
* doc: fix seccomp_syscall_resolve_name manpageThiago Marcos P. Santos2012-12-051-3/+1
| | | | | Signed-off-by: Thiago Marcos P. Santos <thiago.santos@intel.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add an API to query the system's architecturePaul Moore2012-11-269-8/+38
| | | | | | | In C we add seccomp_arch_native(void), in Python we add Arch.system(). Both functions return an architecture token value. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: fix the i386 ipc syscallsPaul Moore2012-11-201-12/+12
| | | | | | | Correct all of the i386 ipc syscalls using glibc sources as a reference. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: fix the i386 socket syscallsPaul Moore2012-11-202-18/+30
| | | | | | | Correct all of the i386 socket syscalls via the socketcall() syscall using the glibc and kernel sources as a reference. Signed-off-by: Paul Moore <pmoore@redhat.com>
* doc: update the CHANGELOG for the 1.0.1 releasePaul Moore2012-11-121-0/+7
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* Merge ssh+git://git.code.sf.net/p/libseccomp/libseccompPaul Moore2012-11-120-0/+0
|\ | | | | | | | | Conflicts: src/gen_bpf.c
| * bpf: fix a problem when creating filters that include syscall argumentsPaul Moore2012-11-122-124/+158
| | | | | | | | | | | | | | | | | | | | In some cases when generating BPF filters, if a particular argument chain did not match, the filter would fall through to the default action for the architecture instead of checking on other argument chains for the same syscall. This patch corrects this problem by ensuring that all argument chains are evaluated. Signed-off-by: Paul Moore <pmoore@redhat.com>
* | bpf: fix a problem when creating filters that include syscall argumentsPaul Moore2012-11-122-124/+158
|/ | | | | | | | | | In some cases when generating BPF filters, if a particular argument chain did not match, the filter would fall through to the default action for the architecture instead of checking on other argument chains for the same syscall. This patch corrects this problem by ensuring that all argument chains are evaluated. Signed-off-by: Paul Moore <pmoore@redhat.com>
* bpf: fix a problem with small filtersPaul Moore2012-11-121-5/+4
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: fix a problem with the correct results for 08-subtree-checksPaul Moore2012-11-121-3/+3
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: shrink the 05-long-jumps testsPaul Moore2012-11-122-8/+8
| | | | | | | | The existing test is too large to fit within the standard Linux Kernel BPF size limit if generated correctly so shrink it so we don't run into size problems. Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: enable running non-native architecture testsPaul Moore2012-11-071-5/+11
| | | | | | | | | | | Support running non-native architecture tests buy prefixing the architecture with a "+" in the test file. Example: test type: bpf-sim 00-test +x86 read N N N N N N 00-test +x86_64 read N N N N N N Signed-off-by: Paul Moore <pmoore@redhat.com>
* tools: make the sys_resolver tool work for non-native architecturesPaul Moore2012-11-064-1/+83
| | | | | | | | | | | | In order to test non-native architectures using our existing regression test infrastructure and BPF simulator we need to be able to resolve syscall names on arbitrary architectures. This patch moves aside the existing bash script and replaces it with a small C progream which uses some internal libseccomp routines to resolve the syscall. Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: add python versions of the existing testsPaul Moore2012-11-0518-0/+940
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: add basic support for python testsPaul Moore2012-10-314-14/+93
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add Python bindings via CythonPaul Moore2012-10-018-7/+816
| | | | | | | | This patch adds Python bindings using Cython, see http://www.cython.org for more information. There are also some minor tweaks to the build macros while we are mucking around in macros.mk; nothing major. Signed-off-by: Paul Moore <pmoore@redhat.com>
* docs: add manpages for the seccomp_arch_{exist,add,remove}() and ↵Paul Moore2012-10-015-1/+248
| | | | | | seccomp_merge() API Signed-off-by: Paul Moore <pmoore@redhat.com>
* tests: add tests for the new multi-arch/filter supportPaul Moore2012-09-286-1/+255
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add support for multiple architecturesPaul Moore2012-09-276-7/+306
| | | | | | | | | Add the seccomp_arch_add() and seccomp_arch_remove() functions to add and remove architectures from the filter. This patch also adds the seccomp_merge() function which merges two filter contexts together assuming there is no architecture conflicts. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: disable certain operations with multiple architecturesPaul Moore2012-09-271-0/+3
| | | | | | | | Certain operations don't make sense with multiple architectures so we disable them only when more than one architecture has been added to the given filter. Signed-off-by: Paul Moore <pmoore@redhat.com>
* pfc: provide basic multiple arch/filter supportPaul Moore2012-09-271-53/+97
| | | | | | | | Add support for multiple architectures/filters to the PFC filter generation code. This patch also cleans up the PFC output a bit in hopes of making it more readable and consistent. Signed-off-by: Paul Moore <pmoore@redhat.com>
* bpf: remove _gen_bpf_chain_lvl()Paul Moore2012-09-271-94/+69
| | | | | | | Since only _gen_bpf_chain() called _gen_bpf_chain_lvl() move the function inside _gen_bpf_chain(). Signed-off-by: Paul Moore <pmoore@redhat.com>
View Lorry Controller Status