1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
//初始化seccomp filter state
scmp_filter_ctx seccomp_init(uint32_t def_action);
int seccomp_reset(scmp_filter_ctx ctx, unit32_t def_action);
def_action：
SCMP_ACT_KILL , SCMP_ACT_TRAP , ACMP_ACT_ERRNO , SCMP_ACT_TRACE , SCMP_ACT_ALLOW
//释放seccomp filter state ,已经loaded into kernel不受影响
void seccomp_release(scmp_filter_ctx ctx);
//合并两个seccomp filter,src会被释放，不需要在调用 seccomp_release
//filter值需要一致，架构需要重叠
int seccomp_merge(scmp_filter_ctx dst, scmp_filter_ctx src);
//架构管理
uint32_t seccomp_arch_resolve_name(const char *arch_name);
uint32_t seccomp_arch_native();
int seccomp_arch_exist(const scmp_filter_ctx ctx, uint32_t arch_token);
int seccomp_arch_add(scmp_filter_ctx ctx, uint32_t arch_token);
int seccomp_arch_remove(scmp_filter_ctx ctx, uint32_t arch_token);
uint32_t arch_token 由 SCMP_ARCH_* 定义的常量
SCMP_ARCH_NATIVE 常量总是指向本地编译的架构当一个新的架构加进来的时候，老的filter和它没关系，但是后面新增的filter都跟他相关。
//属性管理
int seccomp_attr_set(scmp_filter_ctx ctx, enum scmp_filter_attr attr, uint32_t value)
int seccomp_attr_get(scmp_filter_ctx ctx,enum scmp_filter_attr attr, uint32_t *value)
可选的scmp_filter_attr为
SCMP_FLTATR_ACT_DEFAULT
只读属性
SCMP_FLTATR_ACT_BADARCH //def_action
如果架构不匹配，那么默认 SCMP_ACT_KILL
SCMP_FLTATR_CTL_NNP //boolean
定义NO_NEW_PRIVS在filter加载到内核之前就应该被启动。如果这个为0，那么会去检查 CAP_SYS_ADMIN，不然失败。默认1。
SCMP_FLTATR_CTL_TSYNC //boolean
设置表示seccomp_load调用的时候需要全部同步filter
SCMP_FLTATR_ATL_TSKIP //boolean
设置表示可以创建 -1的syscall
//导出seccomp filter
int seccomp_export_bpf(const scmp_filter_ctx, int fd);
//bpf --> Berkley Packet Filter
int seccomp_export_pfc(const scmp_filter_ctx, int fd);
//pfc --> Pseudo Filter Code
//装载filter到kernel中
int seccomp_load(scmp_filter_ctx ctx); //成功的加载
//增加 seccomp filter rule
int SCMP_SYS(syscall_name);
struct scmp_arg_cmp SCMP_CMP(unsigned int arg, enum scmp_compare op, ...);
struct scmp_arg_cmp SCMP_A0(enum scmp_compare op, ...);
...
struct scmp_arg_cmp SCMP_A5(enum scmp_compare op, ...);
int seccomp_rule_add(scmp_filter_ctx ctx, uint32_t action , int syscall, unsigned int arg_cnt, ...);
int seccomp_rule_add_exact(scmp_filter_ctx ctx, uint32_t action, int syscall, unsigned int arg_cnt, ...);
int seccomp_rule_add_array(scmp_filter_ctx ctx, uint32_t action, int syscall, unsigned int arg_cnt, const struct scmp_arg_cmp *arg_array);
int seccomp_rule_add_exact_array(scmp_filter_ctx ctx, uint32_t action, int syscal, unsigned int arg_cnt, const struct scmp_arg_cmp *arg_array);
新加入的filter rule需要load进 kernel才会生效
SCMP_CMP（） 和 SCMP_A{0-5}()宏 生成一个 scmp_arg_cmp结构用到上面的函数中。
//区分 seccomp filter 中的 syscall
int seccomp_syscall_priority(scmp_filter_ctx ctx, int syscall, uint8_t priority);
//解析syscall名称
int seccomp_syscall_resolve_name(const char *name);
int seccomp_syscall_resolve_name_arch(uint32_t arch_token, const char *name);
int seccomp_syscall_resolve_name_rewrite(uint32_t arch_token, const char *name);
char *seccomp_syscall_resolve_num_arch(uint32_t arch_torken, int num);
|