1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
/* syscall_filter.h
* Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
* Use of this source code is governed by a BSD-style license that can be
* found in the LICENSE file.
*
* Syscall filter functions.
*/
#ifndef SYSCALL_FILTER_H
#define SYSCALL_FILTER_H
#include <stdbool.h>
#include "bpf.h"
#ifdef __cplusplus
extern "C" {
#endif
struct filter_block {
struct sock_filter *instrs;
size_t len;
struct filter_block *next;
struct filter_block *last;
size_t total_len;
};
struct parser_state {
const char *filename;
size_t line_number;
};
enum block_action {
ACTION_RET_KILL = 0,
ACTION_RET_TRAP,
ACTION_RET_LOG,
ACTION_RET_KILL_PROCESS,
};
struct filter_options {
enum block_action action;
int allow_logging;
int allow_syscalls_for_logging;
bool allow_duplicate_syscalls;
};
struct bpf_labels;
struct filter_block *compile_policy_line(struct parser_state *state, int nr,
const char *policy_line,
unsigned int label_id,
struct bpf_labels *labels,
enum block_action action);
int compile_file(const char *filename, FILE *policy_file,
struct filter_block *head, struct filter_block **arg_blocks,
struct bpf_labels *labels,
const struct filter_options *filteropts,
struct parser_state **previous_syscalls,
unsigned int include_level);
int compile_filter(const char *filename, FILE *policy_file,
struct sock_fprog *prog,
const struct filter_options *filteropts);
struct filter_block *new_filter_block(void);
int flatten_block_list(struct filter_block *head, struct sock_filter *filter,
size_t index, size_t cap);
void free_block_list(struct filter_block *head);
void free_previous_syscalls(struct parser_state **previous_syscalls);
int seccomp_can_softfail(void);
static inline bool allow_duplicate_syscalls(void)
{
#if defined(ALLOW_DUPLICATE_SYSCALLS)
return true;
#endif
return false;
}
#ifdef __cplusplus
}; /* extern "C" */
#endif
#endif /* SYSCALL_FILTER_H */
|
