summaryrefslogtreecommitdiff
path: root/src/api.c
Commit message (Collapse)AuthorAgeFilesLines
* api: create an API level construct as part of the supported APIworking-api_levelPaul Moore2017-09-211-0/+55
| | | | | | | | | WORK IN PROGRESS, DO NOT SHIP XXX - manpage needed XXX - tests needed Signed-off-by: Paul Moore <paul@paul-moore.com>
* all: treat syscall -1 as a valid syscallPaul Moore2017-02-211-4/+7
| | | | | | | | | | | | | Process tracers use a -1 syscall value to indicate that a syscall should be skipped. This turns out to be quite an undertaking as we need to workaround __NR_SCMP_ERROR (which also has a value of -1). Pay special attention to the new attribute, SCMP_FLTATR_API_TSKIP, and the documentation additions. More information in the GitHub issue: * https://github.com/seccomp/libseccomp/issues/80 Signed-off-by: Paul Moore <paul@paul-moore.com>
* arch: removed unnecessary call in `seccomp_add_arch`.Jiannan Guo2017-02-021-4/+2
| | | | | | | | | Some logic in the implementation of `seccomp_add_arch` can never be reached and `arch_def_lookup` was called redundantly. Signed-off-by: Jiannan Guo <guojiannan1101@gmail.com> [PM: update subject line] Signed-off-by: Paul Moore <paul@paul-moore.com>
* api: add a seccomp_version() API callPaul Moore2016-02-181-0/+12
| | | | | | | | This will allow callers to dynamically query the libseccomp library to determine the version information. We do not currently plan on exposing this API via any of the supported language bindings. Signed-off-by: Paul Moore <paul@paul-moore.com>
* all: update my email addressPaul Moore2016-02-111-1/+1
| | | | | | | Employer agnostic emails make things a lot easier in the long run so make sure the paul-moore.com address is used whenever it makes sense. Signed-off-by: Paul Moore <paul@paul-moore.com>
* db: make the individual db filter ops privatePaul Moore2016-02-091-217/+34
| | | | | | | | | | We really should operate only on filter collections so move all the individual DB filter operations out of api.c and into db.c. There are likely other changes that can now be done to further clean the code, but I'll leave that as future work. Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: block negative syscall numbers from the filterPaul Moore2015-08-271-2/+7
| | | | | | | | | | | We use negative syscalls numbers to indicate syscalls that aren't supported by a certain arch/ABI and unfortunately there were cases where these bogus syscall values were finding their way into the filter. This patch corrects this and adds a new test to check for this in the future. Reported-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: fix a problem with the rule rewrites in _seccomp_rule_add()Paul Moore2015-08-271-1/+1
| | | | | | | A typo was causing the return value from arch_fitler_rewrite() to be ignored in cases where -EDOM was returned. Signed-off-by: Paul Moore <pmoore@redhat.com>
* docs: fix a number of problems in the function header commentsPaul Moore2015-05-091-1/+1
| | | | | Reported-by: Brian Cain <brian.cain@gmail.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: fix a number of small bugs found by CoverityPaul Moore2014-08-291-4/+8
| | | | | | | Also display the build revision to make things easier when submitting builds for scanning. Signed-off-by: Paul Moore <pmoore@redhat.com>
* system: add support for the thread sync functionalityPaul Moore2014-08-211-2/+3
| | | | | | | The thread sync functionality and the SECCOMP_FILTER_FLAG_TSYNC flag makes an appearance in Linux 3.17. Signed-off-by: Paul Moore <pmoore@redhat.com>
* system: add initial support for the new seccomp() syscallPaul Moore2014-08-211-19/+1
| | | | | | The new seccomp() syscall makes an appearance in Linux 3.17. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: rename seccomp_syscall_resolve_name_rewrite_arch()Paul Moore2014-05-091-2/+2
| | | | | | Change the API name to seccomp_syscall_resolve_name_rewrite(). Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add an API to do translated/rewriten syscall resolutionPaul Moore2014-05-081-0/+27
| | | | | | | This patch also converts the seccomp.resolve_syscall() method to use the new resolution API. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add the seccomp_arch_resolve_name() API callPaul Moore2014-05-071-0/+15
| | | | | | As requested by the systemd developers and used by our own tools. Signed-off-by: Paul Moore <pmoore@redhat.com>
* db: allow all architectures to be removed from a filterPaul Moore2014-04-151-4/+1
| | | | | | | | In order to add architectures with byte ordering that differs from the native architecture it is necessary to remove all architectures from a filter. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: ensure we return the proper error codes in the syscall resolver functionsPaul Moore2013-11-121-3/+3
| | | | | | | | At some point we may want to expand __NR_SCMP_ERROR out to different error codes, but for right now this seems okay. Reported-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: fix some vertical whitespace mistakesPaul Moore2013-10-221-3/+0
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* build: Hide non-public symbolsAndy Lutomirski2013-10-221-30/+38
| | | | | | | | | | Set -fvisibility=hidden and explicitly unhide public APIs. This overrides it with -fvisibility=default for Python because otherwise initseccomp gets hidden and the module won't load. Signed-off-by: Andy Lutomirski <luto@amacapital.net> (minor style fixes and macro renames) Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: wrong variable name was failing seccomp_syscall_priorityEduardo Otubo2013-05-081-1/+1
| | | | | | | | | The wrong variable name was erroneous failing the function seccomp_syscall_priority() when trying to set a priority on a negative (pseudo-syscall) is added. Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: convert some booleans from ints to boolsPaul Moore2013-04-191-1/+2
| | | | | | Make it more obvious that these variables are booleans. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: disconnect the BPF arch token from the libseccomp tokenPaul Moore2013-03-261-8/+8
| | | | | | | | | Unfortunately, the x32 ABI shares the same architecture token with x86_64 in the kernel so we need to separate the arch token we use in the BPF filter with the arch token we use for idenitfying the arch/ABI to libseccomp callers. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: Add array versions of seccomp_rule_add functionsVitaly Vi Shukela2013-03-261-6/+51
| | | | | Signed-off-by: Vitaly Vi Shukela <vi0oss@gmail.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: ensure filter chains are preserved with multiple architecturesPaul Moore2013-02-141-23/+40
| | | | | | | | | | We currently have a bug where an architecture that mangles the filter chain could affect the filter chain of other architectures. This patch corrects this problem by ensuring that each architecture that mangles the filter chain does so only with a private copy of the filter chain. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: ensure full syscall coverage across x86 and x86_64Paul Moore2013-01-211-1/+9
| | | | | | This patch ensures that you can create non-native filters using syscalls not present in the native architecture. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add syscall resolution functions that take an architecture argumentPaul Moore2013-01-151-3/+40
| | | | | | | | Similar to the existing seccomp_syscall_resolve_name() function, but they work for arbitrary architectures (assuming libseccomp support of course) and not just the native architecture. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add an API to query the system's architecturePaul Moore2012-11-261-0/+6
| | | | | | | In C we add seccomp_arch_native(void), in Python we add Arch.system(). Both functions return an architecture token value. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add support for multiple architecturesPaul Moore2012-09-271-0/+76
| | | | | | | | | Add the seccomp_arch_add() and seccomp_arch_remove() functions to add and remove architectures from the filter. This patch also adds the seccomp_merge() function which merges two filter contexts together assuming there is no architecture conflicts. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: disable certain operations with multiple architecturesPaul Moore2012-09-271-0/+3
| | | | | | | | Certain operations don't make sense with multiple architectures so we disable them only when more than one architecture has been added to the given filter. Signed-off-by: Paul Moore <pmoore@redhat.com>
* db: enable basic filter collection supportPaul Moore2012-09-271-48/+106
| | | | | | | | | | | In order to support systems that can run applications from multiple architectures we need to be able to support multiple filter DBs; were calling this "filter collections". This patch adds the basic collection support such that it passes all of the existing tests; further work may be necessary once we start using the multiple filter capabilities. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: provide the basic infrastructure for non-native architecture supportPaul Moore2012-09-271-0/+8
| | | | | | | Add the arch_syscall_translate() function which converts the syscall table from the native architecture to the desired architecture. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: add support for syscall name resolutionPaul Moore2012-09-271-2/+26
| | | | | | Provide syscall name to syscall number resolution. Signed-off-by: Paul Moore <pmoore@redhat.com>
* db: add a filter initialization checkPaul Moore2012-07-251-9/+22
| | | | | | | | Now that we are allowing users to specify a filter DB via the public API we should so some simple checking to ensure the passed DB is valid. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: remove the internal state and make the API context-awarePaul Moore2012-07-251-51/+51
| | | | | | | | | | | | | | | IMPORTANT: WILL CAUSE BREAKAGE WITH v0.1.x API The current API relies on the library storing internal state about the filter context. While this is okay in several cases, it may cause problems in others, e.g. threaded applications. Since the bulk of the library already operates on a filter context, known as "struct db_filter", this patch simply adds an additional parameter to the public API, exporting this context as an opaque context/handle. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: rename the seccomp_gen_*() functions to seccomp_export_*()Paul Moore2012-04-261-2/+2
| | | | | | | | | | | | These functions were originally intended as a debugging tool for developers (both application and libseccomp), but recent discussions have led me to believe that at some point in the future libseccomp will likely support the import/export of seccomp policy. While I hate changing the API, we haven't released libseccomp yet so we are still free to make what changes we need and I think this rename puts us in a better position for the future. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: add a new attribute for the bad architecture actionPaul Moore2012-04-161-25/+2
| | | | | | Also shorten SCMP_FLTATR_CTL_NNP_ON to just SCMP_FLTATR_CTL_NNP. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: always pass along errors from failed attempts to set NO_NEW_PRIVSPaul Moore2012-04-161-1/+1
| | | | | | | | It turns out the kernel required either CAP_SYS_ADMIN or NO_NEW_PRIVS, so not signaling an error on prctl(NO_NEW_PRIVS) isn't all that useful. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: enable toggling NO_NEW_PRIVS behavior via filter attributesPaul Moore2012-04-131-1/+5
| | | | | | | | Allow developers to disable setting NO_NEW_PRIVS on filter load and have seccomp_load() fail if setting NO_NEW_PRIVS fails. The default is to set NO_NEW_PRIVS but do not fail on error. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: enable NO_NEW_PRIVS when loading the seccomp filterPaul Moore2012-04-131-0/+3
| | | | | | | Attempt to enable NO_NEW_PRIVS before loading the seccomp filter but don't consider it an error condition if it doesn't work. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: enable basic filter attribute supportPaul Moore2012-04-131-1/+19
| | | | | | Move the default action into the filter attribute mechanism. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: error conditions are indicated by negative return valuesPaul Moore2012-04-131-2/+2
| | | | | | Fix some problems where we return "errno" instead of "-errno". Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: relicense the library from GPLv2 to LGPLv2.1Paul Moore2012-04-091-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the libseccomp-discuss mailing list: On Monday, April 09, 2012 06:06:51 PM Paul Moore wrote: > Hello, > > It was suggested on the libseccomp announcement thread that we > relicense the library from GPLv2 to LGPLv2.1. In my opinion this > makes sense and I recommend we relicense the library, can I have > your permission to relicense your contributions? > > * LGPLv2.1 > -> http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html On Tuesday, April 10, 2012 10:07:37 AM Eric Paris wrote: > You have my permission to relicense to LGPL. On Tuesday, April 10, 2012 10:27:39 AM Ashley Lai wrote: > Yes, you have my permission to relicense to LGPL. On Tuesday, April 10, 2012 11:48:14 AM Corey Bryant wrote: > We (IBM) have OSSC approval now. You have my approval to > relicense my contributions to LGPLv2.1. On Tuesday, April 10, 2012 12:57:25 PM Eduardo Otubo wrote: > On Tue, Apr 10, 2012 at 11:48:14AM -0400, Corey Bryant wrote: > > We (IBM) have OSSC approval now. You have my approval to > > relicense my contributions to LGPLv2.1. > > Exactly, not a problem for me. Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: support masked comparisonsPaul Moore2012-04-041-5/+17
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: make the va_args more reliablePaul Moore2012-04-041-6/+8
| | | | | | | | | | | | While va_args are nice, testing has proven them to be unreliable with respect to datum types and this is causing some real problems on 64 bit architectures. This patch resolves this by moving the individual argument, op, and datum values into a structure that can be created by the SCMP_CMP() and SCMP_A{0-6}() macros. Signed-off-by: Paul Moore <pmoore@redhat.com>
* all: use the system header files when possiblePaul Moore2012-04-021-6/+2
| | | | Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: tweak the rule_add API furtherPaul Moore2012-03-291-6/+47
| | | | | | | | | | | | | | This patch makes seccomp_rule_add() operate slightly differently which should make it more useful form an arch independence point of view; if a filter rule needs to be rewritten for a particular arch and the full rule can not be preserved, the function no longer fails. While this may be less secure in the stricktest sense, it should make the library much more usable. Also, the seccomp_rule_add_exact() function was added with the older behavior. Signed-off-by: Paul Moore <pmoore@redhat.com>
* arch: enable less strict filter rewritesPaul Moore2012-03-291-1/+1
| | | | | | | | | | | | At present we fail if we can't completely preserve the caller's filter, while admirable, this does require some knowledge of the architecture to ensure you're adding a "correct" rule. In keeping with our goal of architecture independence, we want to add the ability to do "best effort" rewrites that preserve as much of the original filter rule as possible. Signed-off-by: Paul Moore <pmoore@redhat.com>
* db: enable user input for syscall prioritiesPaul Moore2012-03-271-2/+14
| | | | | | | Support user specified syscall priority hinting and add two tests for syscall priorities. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: stub out syscall priority hinting in the APIPaul Moore2012-03-231-0/+7
| | | | | | | | | | | | | | | This doesn't actually connect the API call with the underlying bits in the filter DB code, that will come in a later patch. This patch is here to establish the API only. CHANGELOG -v2 * Change priority value to uint8_t from uint16_t to allow for potential rule priorities at some point in the future. -v1 * Initial version. Signed-off-by: Paul Moore <pmoore@redhat.com>
* api: move the API comments into include/seccomp.hPaul Moore2012-03-231-67/+7
| | | | | | | | | This will make the API function comments visible to developers when libseccomp is installed on their system. This patch also adds some doxygen style comments to a few things that were not commented in seccomp.h. Signed-off-by: Paul Moore <pmoore@redhat.com>
View Lorry Controller Status