summaryrefslogtreecommitdiffstats
path: root/src/db.h
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/db.h217
1 files changed, 217 insertions, 0 deletions
diff --git a/src/db.h b/src/db.h
new file mode 100644
index 0000000..765c607
--- /dev/null
+++ b/src/db.h
@@ -0,0 +1,217 @@
+/**
+ * Enhanced Seccomp Filter DB
+ *
+ * Copyright (c) 2012,2016 Red Hat <pmoore@redhat.com>
+ * Author: Paul Moore <paul@paul-moore.com>
+ */
+
+/*
+ * This library is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; if not, see <http://www.gnu.org/licenses>.
+ */
+
+#ifndef _FILTER_DB_H
+#define _FILTER_DB_H
+
+#include <inttypes.h>
+#include <stdbool.h>
+
+#include <seccomp.h>
+
+#include "arch.h"
+
+/* XXX - need to provide doxygen comments for the types here */
+
+struct db_api_arg {
+ unsigned int arg;
+ enum scmp_compare op;
+ scmp_datum_t mask;
+ scmp_datum_t datum;
+
+ bool valid;
+};
+
+struct db_api_rule_list {
+ uint32_t action;
+ int syscall;
+ bool strict;
+ struct db_api_arg args[ARG_COUNT_MAX];
+
+ struct db_api_rule_list *prev, *next;
+};
+
+struct db_arg_chain_tree {
+ /* argument number (a0 = 0, a1 = 1, etc.) */
+ unsigned int arg;
+ /* true to indicate this is the high 32-bit word of a 64-bit value */
+ bool arg_h_flg;
+ /* argument bpf offset */
+ unsigned int arg_offset;
+
+ /* comparison operator */
+ enum scmp_compare op;
+ enum scmp_compare op_orig;
+ /* syscall argument value */
+ uint32_t mask;
+ uint32_t datum;
+ scmp_datum_t datum_full;
+
+ /* actions */
+ bool act_t_flg;
+ bool act_f_flg;
+ uint32_t act_t;
+ uint32_t act_f;
+
+ /* list of nodes on this level */
+ struct db_arg_chain_tree *lvl_prv, *lvl_nxt;
+
+ /* next node in the chain */
+ struct db_arg_chain_tree *nxt_t;
+ struct db_arg_chain_tree *nxt_f;
+
+ unsigned int refcnt;
+};
+#define ARG_MASK_MAX ((uint32_t)-1)
+
+struct db_sys_list {
+ /* native syscall number */
+ unsigned int num;
+
+ /* priority - higher is better */
+ unsigned int priority;
+
+ /* the argument chain heads */
+ struct db_arg_chain_tree *chains;
+ unsigned int node_cnt;
+
+ /* action in the case of no argument chains */
+ uint32_t action;
+
+ struct db_sys_list *next;
+ /* temporary use only by the BPF generator */
+ struct db_sys_list *pri_prv, *pri_nxt;
+
+ bool valid;
+};
+
+struct db_filter_attr {
+ /* action to take if we don't match an explicit allow/deny */
+ uint32_t act_default;
+ /* action to take if we don't match the architecture */
+ uint32_t act_badarch;
+ /* NO_NEW_PRIVS related attributes */
+ uint32_t nnp_enable;
+ /* SECCOMP_FILTER_FLAG_TSYNC related attributes */
+ uint32_t tsync_enable;
+ /* allow rules with a -1 syscall value */
+ uint32_t api_tskip;
+ /* SECCOMP_FILTER_FLAG_LOG related attributes */
+ uint32_t log_enable;
+ /* SPEC_ALLOW related attributes */
+ uint32_t spec_allow;
+ /* SCMP_FLTATR_CTL_OPTIMIZE related attributes */
+ uint32_t optimize;
+ /* return the raw system return codes */
+ uint32_t api_sysrawrc;
+};
+
+struct db_filter {
+ /* target architecture */
+ const struct arch_def *arch;
+
+ /* syscall filters, kept as a sorted single-linked list */
+ struct db_sys_list *syscalls;
+ unsigned int syscall_cnt;
+
+ /* list of rules used to build the filters, kept in order */
+ struct db_api_rule_list *rules;
+};
+
+struct db_filter_snap {
+ /* individual filters */
+ struct db_filter **filters;
+ unsigned int filter_cnt;
+ bool shadow;
+
+ struct db_filter_snap *next;
+};
+
+struct db_filter_col {
+ /* verification / state */
+ int state;
+
+ /* attributes */
+ struct db_filter_attr attr;
+
+ /* individual filters */
+ int endian;
+ struct db_filter **filters;
+ unsigned int filter_cnt;
+
+ /* transaction snapshots */
+ struct db_filter_snap *snapshots;
+
+ /* userspace notification */
+ bool notify_used;
+};
+
+/**
+ * Iterate over each item in the DB list
+ * @param iter the iterator
+ * @param list the list
+ *
+ * This macro acts as for()/while() conditional and iterates the following
+ * statement for each item in the given list.
+ *
+ */
+#define db_list_foreach(iter,list) \
+ for (iter = (list); iter != NULL; iter = iter->next)
+
+struct db_api_rule_list *db_rule_dup(const struct db_api_rule_list *src);
+
+struct db_filter_col *db_col_init(uint32_t def_action);
+int db_col_reset(struct db_filter_col *col, uint32_t def_action);
+void db_col_release(struct db_filter_col *col);
+
+int db_col_valid(struct db_filter_col *col);
+
+int db_col_action_valid(const struct db_filter_col *col, uint32_t action);
+
+int db_col_merge(struct db_filter_col *col_dst, struct db_filter_col *col_src);
+
+int db_col_arch_exist(struct db_filter_col *col, uint32_t arch_token);
+
+int db_col_attr_get(const struct db_filter_col *col,
+ enum scmp_filter_attr attr, uint32_t *value);
+uint32_t db_col_attr_read(const struct db_filter_col *col,
+ enum scmp_filter_attr attr);
+int db_col_attr_set(struct db_filter_col *col,
+ enum scmp_filter_attr attr, uint32_t value);
+
+int db_col_db_new(struct db_filter_col *col, const struct arch_def *arch);
+int db_col_db_add(struct db_filter_col *col, struct db_filter *db);
+int db_col_db_remove(struct db_filter_col *col, uint32_t arch_token);
+
+int db_col_rule_add(struct db_filter_col *col,
+ bool strict, uint32_t action, int syscall,
+ unsigned int arg_cnt, const struct scmp_arg_cmp *arg_array);
+
+int db_col_syscall_priority(struct db_filter_col *col,
+ int syscall, uint8_t priority);
+
+int db_col_transaction_start(struct db_filter_col *col);
+void db_col_transaction_abort(struct db_filter_col *col);
+void db_col_transaction_commit(struct db_filter_col *col);
+
+int db_rule_add(struct db_filter *db, const struct db_api_rule_list *rule);
+
+#endif