Class: Seccomp::Notify::BPF::Builder

Inherits:
Object
  • Object
show all
Defined in:
lib/seccomp/notify/bpf/builder.rb

Constant Summary collapse

LINEAR_LIMIT = 
4
AUDIT_ARCHES = 
{x86_64: Constants::AUDIT_ARCH_X86_64, aarch64: Constants::AUDIT_ARCH_AARCH64}.freeze

Instance Method Summary collapse

Constructor Details

#initialize(policy, arch: Libc.architecture, transfer_fd: nil) ⇒ Builder

Returns a new instance of Builder.

Raises:



10
11
12
13
14
15
16
17
 
# File 'lib/seccomp/notify/bpf/builder.rb', line 10

def initialize(policy, arch: Libc.architecture, transfer_fd: nil)
  raise NotSupportedError, "unsupported architecture: #{arch}" unless AUDIT_ARCHES.key?(arch)
  raise ArgumentError, "transfer_fd must be a non-negative integer" if transfer_fd && (!transfer_fd.is_a?(Integer) || transfer_fd.negative?)

  @policy = policy
  @arch = arch
  @transfer_fd = transfer_fd
end

Instance Method Details

#build ⇒ Object 



19
20
21
22
23
24
25
26
27
28
29
30
 
# File 'lib/seccomp/notify/bpf/builder.rb', line 19

def build
  decisions = @policy.decisions(@arch)
  if @transfer_fd.nil? && @policy.default_action != Constants::SECCOMP_RET_ALLOW && !@policy.notified?(:sendmsg)
    decisions[Syscalls.number(:sendmsg, @arch)] = Constants::SECCOMP_RET_ALLOW
  end
  body = decisions.length <= LINEAR_LIMIT ? linear(decisions) : tree(decisions.sort)
  conditions = @policy.conditional_notifications(@arch)
  bootstrap_first = @transfer_fd && conditions.any? { |number, _argument, _mask| number == Syscalls.number(:sendmsg, @arch) }
  conditional = conditional_notifications(conditions, decisions)
  bootstrap = bootstrap_first ? transfer_allowance + conditional : conditional + transfer_allowance
  Program.new(prologue + bootstrap + body)
end