script_core 0.1.1 → 0.2.0

data/ext/enterprise_script_service/libseccomp/src/arch-x32-syscalls.c

@@ -26,7 +26,7 @@
 #include "arch.h"
 #include "arch-x32.h"
 
-/* NOTE: based on Linux 4.15-rc7 */
+/* NOTE: based on Linux v5.4-rc4 */
 const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "_llseek", __PNR__llseek },
 	{ "_newselect", __PNR__newselect },
@@ -58,11 +58,17 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "chown32", __PNR_chown32 },
 	{ "chroot", (X32_SYSCALL_BIT + 161) },
 	{ "clock_adjtime", (X32_SYSCALL_BIT + 305) },
+	{ "clock_adjtime64", __PNR_clock_adjtime64 },
 	{ "clock_getres", (X32_SYSCALL_BIT + 229) },
+	{ "clock_getres_time64", __PNR_clock_getres_time64 },
 	{ "clock_gettime", (X32_SYSCALL_BIT + 228) },
+	{ "clock_gettime64", __PNR_clock_gettime64 },
 	{ "clock_nanosleep", (X32_SYSCALL_BIT + 230) },
+	{ "clock_nanosleep_time64", __PNR_clock_nanosleep_time64 },
 	{ "clock_settime", (X32_SYSCALL_BIT + 227) },
+	{ "clock_settime64", __PNR_clock_settime64 },
 	{ "clone", (X32_SYSCALL_BIT + 56) },
+	{ "clone3", (X32_SYSCALL_BIT + 435) },
 	{ "close", (X32_SYSCALL_BIT + 3) },
 	{ "connect", (X32_SYSCALL_BIT + 42) },
 	{ "copy_file_range", (X32_SYSCALL_BIT + 326) },
@@ -106,7 +112,11 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "flock", (X32_SYSCALL_BIT + 73) },
 	{ "fork", (X32_SYSCALL_BIT + 57) },
 	{ "fremovexattr", (X32_SYSCALL_BIT + 199) },
+	{ "fsconfig", (X32_SYSCALL_BIT + 431) },
 	{ "fsetxattr", (X32_SYSCALL_BIT + 190) },
+	{ "fsmount", (X32_SYSCALL_BIT + 432) },
+	{ "fsopen", (X32_SYSCALL_BIT + 430) },
+	{ "fspick", (X32_SYSCALL_BIT + 433) },
 	{ "fstat", (X32_SYSCALL_BIT + 5) },
 	{ "fstat64", __PNR_fstat64 },
 	{ "fstatat64", __PNR_fstatat64 },
@@ -117,6 +127,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "ftruncate", (X32_SYSCALL_BIT + 77) },
 	{ "ftruncate64", __PNR_ftruncate64 },
 	{ "futex", (X32_SYSCALL_BIT + 202) },
+	{ "futex_time64", __PNR_futex_time64 },
 	{ "futimesat", (X32_SYSCALL_BIT + 261) },
 	{ "get_kernel_syms", __PNR_get_kernel_syms },
 	{ "get_mempolicy", (X32_SYSCALL_BIT + 239) },
@@ -169,8 +180,12 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "io_destroy", (X32_SYSCALL_BIT + 207) },
 	{ "io_getevents", (X32_SYSCALL_BIT + 208) },
 	{ "io_pgetevents", (X32_SYSCALL_BIT + 333) },
+	{ "io_pgetevents_time64", __PNR_io_pgetevents_time64 },
 	{ "io_setup", (X32_SYSCALL_BIT + 543) },
 	{ "io_submit", (X32_SYSCALL_BIT + 544) },
+	{ "io_uring_setup", (X32_SYSCALL_BIT + 425) },
+	{ "io_uring_enter", (X32_SYSCALL_BIT + 426) },
+	{ "io_uring_register", (X32_SYSCALL_BIT + 427) },
 	{ "ioctl", (X32_SYSCALL_BIT + 514) },
 	{ "ioperm", (X32_SYSCALL_BIT + 173) },
 	{ "iopl", (X32_SYSCALL_BIT + 172) },
@@ -214,6 +229,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "mmap2", __PNR_mmap2 },
 	{ "modify_ldt", (X32_SYSCALL_BIT + 154) },
 	{ "mount", (X32_SYSCALL_BIT + 165) },
+	{ "move_mount", (X32_SYSCALL_BIT + 429) },
 	{ "move_pages", (X32_SYSCALL_BIT + 533) },
 	{ "mprotect", (X32_SYSCALL_BIT + 10) },
 	{ "mpx", __PNR_mpx },
@@ -221,7 +237,9 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "mq_notify", (X32_SYSCALL_BIT + 527) },
 	{ "mq_open", (X32_SYSCALL_BIT + 240) },
 	{ "mq_timedreceive", (X32_SYSCALL_BIT + 243) },
+	{ "mq_timedreceive_time64", __PNR_mq_timedreceive_time64 },
 	{ "mq_timedsend", (X32_SYSCALL_BIT + 242) },
+	{ "mq_timedsend_time64", __PNR_mq_timedsend_time64 },
 	{ "mq_unlink", (X32_SYSCALL_BIT + 241) },
 	{ "mremap", (X32_SYSCALL_BIT + 25) },
 	{ "msgctl", (X32_SYSCALL_BIT + 71) },
@@ -246,6 +264,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "oldwait4", __PNR_oldwait4 },
 	{ "open", (X32_SYSCALL_BIT + 2) },
 	{ "open_by_handle_at", (X32_SYSCALL_BIT + 304) },
+	{ "open_tree", (X32_SYSCALL_BIT + 428) },
 	{ "openat", (X32_SYSCALL_BIT + 257) },
 	{ "pause", (X32_SYSCALL_BIT + 34) },
 	{ "pciconfig_iobase", __PNR_pciconfig_iobase },
@@ -253,6 +272,8 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "pciconfig_write", __PNR_pciconfig_write },
 	{ "perf_event_open", (X32_SYSCALL_BIT + 298) },
 	{ "personality", (X32_SYSCALL_BIT + 135) },
+	{ "pidfd_open", (X32_SYSCALL_BIT + 434) },
+	{ "pidfd_send_signal", (X32_SYSCALL_BIT + 424) },
 	{ "pipe", (X32_SYSCALL_BIT + 22) },
 	{ "pipe2", (X32_SYSCALL_BIT + 293) },
 	{ "pivot_root", (X32_SYSCALL_BIT + 155) },
@@ -261,6 +282,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "pkey_mprotect", (X32_SYSCALL_BIT + 329) },
 	{ "poll", (X32_SYSCALL_BIT + 7) },
 	{ "ppoll", (X32_SYSCALL_BIT + 271) },
+	{ "ppoll_time64", __PNR_ppoll_time64 },
 	{ "prctl", (X32_SYSCALL_BIT + 157) },
 	{ "pread64", (X32_SYSCALL_BIT + 17) },
 	{ "preadv", (X32_SYSCALL_BIT + 534) },
@@ -271,6 +293,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "prof", __PNR_prof },
 	{ "profil", __PNR_profil },
 	{ "pselect6", (X32_SYSCALL_BIT + 270) },
+	{ "pselect6_time64", __PNR_pselect6_time64 },
 	{ "ptrace", (X32_SYSCALL_BIT + 521) },
 	{ "putpmsg", (X32_SYSCALL_BIT + 182) },
 	{ "pwrite64", (X32_SYSCALL_BIT + 18) },
@@ -288,6 +311,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "recv", __PNR_recv },
 	{ "recvfrom", (X32_SYSCALL_BIT + 517) },
 	{ "recvmmsg", (X32_SYSCALL_BIT + 537) },
+	{ "recvmmsg_time64", __PNR_recvmmsg_time64 },
 	{ "recvmsg", (X32_SYSCALL_BIT + 519) },
 	{ "remap_file_pages", (X32_SYSCALL_BIT + 216) },
 	{ "removexattr", (X32_SYSCALL_BIT + 197) },
@@ -305,6 +329,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "rt_sigreturn", (X32_SYSCALL_BIT + 513) },
 	{ "rt_sigsuspend", (X32_SYSCALL_BIT + 130) },
 	{ "rt_sigtimedwait", (X32_SYSCALL_BIT + 523) },
+	{ "rt_sigtimedwait_time64", __PNR_rt_sigtimedwait_time64 },
 	{ "rt_tgsigqueueinfo", (X32_SYSCALL_BIT + 536) },
 	{ "rtas", __PNR_rtas },
 	{ "s390_guarded_storage", __PNR_s390_guarded_storage },
@@ -319,6 +344,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "sched_getparam", (X32_SYSCALL_BIT + 143) },
 	{ "sched_getscheduler", (X32_SYSCALL_BIT + 145) },
 	{ "sched_rr_get_interval", (X32_SYSCALL_BIT + 148) },
+	{ "sched_rr_get_interval_time64", __PNR_sched_rr_get_interval_time64 },
 	{ "sched_setaffinity", (X32_SYSCALL_BIT + 203) },
 	{ "sched_setattr", (X32_SYSCALL_BIT + 314) },
 	{ "sched_setparam", (X32_SYSCALL_BIT + 142) },
@@ -331,6 +357,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "semget", (X32_SYSCALL_BIT + 64) },
 	{ "semop", (X32_SYSCALL_BIT + 65) },
 	{ "semtimedop", (X32_SYSCALL_BIT + 220) },
+	{ "semtimedop_time64", __PNR_semtimedop_time64 },
 	{ "send", __PNR_send },
 	{ "sendfile", (X32_SYSCALL_BIT + 40) },
 	{ "sendfile64", __PNR_sendfile64 },
@@ -424,11 +451,15 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "timer_delete", (X32_SYSCALL_BIT + 226) },
 	{ "timer_getoverrun", (X32_SYSCALL_BIT + 225) },
 	{ "timer_gettime", (X32_SYSCALL_BIT + 224) },
+	{ "timer_gettime64", __PNR_timer_gettime64 },
 	{ "timer_settime", (X32_SYSCALL_BIT + 223) },
+	{ "timer_settime64", __PNR_timer_settime64 },
 	{ "timerfd", __PNR_timerfd },
 	{ "timerfd_create", (X32_SYSCALL_BIT + 283) },
 	{ "timerfd_gettime", (X32_SYSCALL_BIT + 287) },
+	{ "timerfd_gettime64", __PNR_timerfd_gettime64 },
 	{ "timerfd_settime", (X32_SYSCALL_BIT + 286) },
+	{ "timerfd_settime64", __PNR_timerfd_settime64 },
 	{ "times", (X32_SYSCALL_BIT + 100) },
 	{ "tkill", (X32_SYSCALL_BIT + 200) },
 	{ "truncate", (X32_SYSCALL_BIT + 76) },
@@ -450,6 +481,7 @@ const struct arch_syscall_def x32_syscall_table[] = { \
 	{ "ustat", (X32_SYSCALL_BIT + 136) },
 	{ "utime", (X32_SYSCALL_BIT + 132) },
 	{ "utimensat", (X32_SYSCALL_BIT + 280) },
+	{ "utimensat_time64", __PNR_utimensat_time64 },
 	{ "utimes", (X32_SYSCALL_BIT + 235) },
 	{ "vfork", (X32_SYSCALL_BIT + 58) },
 	{ "vhangup", (X32_SYSCALL_BIT + 153) },

data/ext/enterprise_script_service/libseccomp/src/arch-x86-syscalls.c

@@ -26,7 +26,7 @@
 #include "arch.h"
 #include "arch-x86.h"
 
-/* NOTE: based on Linux 4.15-rc7 */
+/* NOTE: based on Linux v5.4-rc4 */
 const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "_llseek", 140 },
 	{ "_newselect", 142 },
@@ -58,11 +58,17 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "chown32", 212 },
 	{ "chroot", 61 },
 	{ "clock_adjtime", 343 },
+	{ "clock_adjtime64", 405 },
 	{ "clock_getres", 266 },
+	{ "clock_getres_time64", 406 },
 	{ "clock_gettime", 265 },
+	{ "clock_gettime64", 403 },
 	{ "clock_nanosleep", 267 },
+	{ "clock_nanosleep_time64", 407 },
 	{ "clock_settime", 264 },
+	{ "clock_settime64", 404 },
 	{ "clone", 120 },
+	{ "clone3", 435 },
 	{ "close", 6 },
 	{ "connect", 362 },
 	{ "copy_file_range", 377 },
@@ -106,7 +112,11 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "flock", 143 },
 	{ "fork", 2 },
 	{ "fremovexattr", 237 },
+	{ "fsconfig", 431 },
 	{ "fsetxattr", 228 },
+	{ "fsmount", 432 },
+	{ "fsopen", 430 },
+	{ "fspick", 433 },
 	{ "fstat", 108 },
 	{ "fstat64", 197 },
 	{ "fstatat64", 300 },
@@ -117,6 +127,7 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "ftruncate", 93 },
 	{ "ftruncate64", 194 },
 	{ "futex", 240 },
+	{ "futex_time64", 422 },
 	{ "futimesat", 299 },
 	{ "get_kernel_syms", 130 },
 	{ "get_mempolicy", 275 },
@@ -169,8 +180,12 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "io_destroy", 246 },
 	{ "io_getevents", 247 },
 	{ "io_pgetevents", 385 },
+	{ "io_pgetevents_time64", 416 },
 	{ "io_setup", 245 },
 	{ "io_submit", 248 },
+	{ "io_uring_setup", 425 },
+	{ "io_uring_enter", 426 },
+	{ "io_uring_register", 427 },
 	{ "ioctl", 54 },
 	{ "ioperm", 101 },
 	{ "iopl", 110 },
@@ -214,6 +229,7 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "mmap2", 192 },
 	{ "modify_ldt", 123 },
 	{ "mount", 21 },
+	{ "move_mount", 429 },
 	{ "move_pages", 317 },
 	{ "mprotect", 125 },
 	{ "mpx", 56 },
@@ -221,13 +237,15 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "mq_notify", 281 },
 	{ "mq_open", 277 },
 	{ "mq_timedreceive", 280 },
+	{ "mq_timedreceive_time64", 419 },
 	{ "mq_timedsend", 279 },
+	{ "mq_timedsend_time64", 418 },
 	{ "mq_unlink", 278 },
 	{ "mremap", 163 },
-	{ "msgctl", __PNR_msgctl },
-	{ "msgget", __PNR_msgget },
-	{ "msgrcv", __PNR_msgrcv },
-	{ "msgsnd", __PNR_msgsnd },
+	{ "msgctl", 402 },
+	{ "msgget", 399 },
+	{ "msgrcv", 401 },
+	{ "msgsnd", 400 },
 	{ "msync", 144 },
 	{ "multiplexer", __PNR_multiplexer },
 	{ "munlock", 151 },
@@ -246,6 +264,7 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "oldwait4", __PNR_oldwait4 },
 	{ "open", 5 },
 	{ "open_by_handle_at", 342 },
+	{ "open_tree", 428 },
 	{ "openat", 295 },
 	{ "pause", 29 },
 	{ "pciconfig_iobase", __PNR_pciconfig_iobase },
@@ -253,6 +272,8 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "pciconfig_write", __PNR_pciconfig_write },
 	{ "perf_event_open", 336 },
 	{ "personality", 136 },
+	{ "pidfd_open", 434 },
+	{ "pidfd_send_signal", 424 },
 	{ "pipe", 42 },
 	{ "pipe2", 331 },
 	{ "pivot_root", 217 },
@@ -261,6 +282,7 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "pkey_mprotect", 380 },
 	{ "poll", 168 },
 	{ "ppoll", 309 },
+	{ "ppoll_time64", 414 },
 	{ "prctl", 172 },
 	{ "pread64", 180 },
 	{ "preadv", 333 },
@@ -271,6 +293,7 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "prof", 44 },
 	{ "profil", 98 },
 	{ "pselect6", 308 },
+	{ "pselect6_time64", 413 },
 	{ "ptrace", 26 },
 	{ "putpmsg", 189 },
 	{ "pwrite64", 181 },
@@ -288,6 +311,7 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "recv", __PNR_recv },
 	{ "recvfrom", 371 },
 	{ "recvmmsg", 337 },
+	{ "recvmmsg_time64", 417 },
 	{ "recvmsg", 372 },
 	{ "remap_file_pages", 257 },
 	{ "removexattr", 235 },
@@ -305,6 +329,7 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "rt_sigreturn", 173 },
 	{ "rt_sigsuspend", 179 },
 	{ "rt_sigtimedwait", 177 },
+	{ "rt_sigtimedwait_time64", 421 },
 	{ "rt_tgsigqueueinfo", 335 },
 	{ "rtas", __PNR_rtas },
 	{ "s390_guarded_storage", __PNR_s390_guarded_storage },
@@ -319,6 +344,7 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "sched_getparam", 155 },
 	{ "sched_getscheduler", 157 },
 	{ "sched_rr_get_interval", 161 },
+	{ "sched_rr_get_interval_time64", 423 },
 	{ "sched_setaffinity", 241 },
 	{ "sched_setattr", 351 },
 	{ "sched_setparam", 154 },
@@ -327,10 +353,11 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "seccomp", 354 },
 	{ "security", __PNR_security },
 	{ "select", 82 },
-	{ "semctl", __PNR_semctl },
-	{ "semget", __PNR_semget },
+	{ "semctl", 394 },
+	{ "semget", 393 },
 	{ "semop", __PNR_semop },
 	{ "semtimedop", __PNR_semtimedop },
+	{ "semtimedop_time64", 420 },
 	{ "send", __PNR_send },
 	{ "sendfile", 187 },
 	{ "sendfile64", 239 },
@@ -372,10 +399,10 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "setuid32", 213 },
 	{ "setxattr", 226 },
 	{ "sgetmask", 68 },
-	{ "shmat", __PNR_shmat },
-	{ "shmctl", __PNR_shmctl },
-	{ "shmdt", __PNR_shmdt },
-	{ "shmget", __PNR_shmget },
+	{ "shmat", 397 },
+	{ "shmctl", 396 },
+	{ "shmdt", 398 },
+	{ "shmget", 395 },
 	{ "shutdown", 373 },
 	{ "sigaction", 67 },
 	{ "sigaltstack", 186 },
@@ -424,11 +451,15 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "timer_delete", 263 },
 	{ "timer_getoverrun", 262 },
 	{ "timer_gettime", 261 },
+	{ "timer_gettime64", 408 },
 	{ "timer_settime", 260 },
+	{ "timer_settime64", 409 },
 	{ "timerfd", __PNR_timerfd },
 	{ "timerfd_create", 322 },
 	{ "timerfd_gettime", 326 },
+	{ "timerfd_gettime64", 410 },
 	{ "timerfd_settime", 325 },
+	{ "timerfd_settime64", 411 },
 	{ "times", 43 },
 	{ "tkill", 238 },
 	{ "truncate", 92 },
@@ -450,6 +481,7 @@ const struct arch_syscall_def x86_syscall_table[] = { \
 	{ "ustat", 62 },
 	{ "utime", 30 },
 	{ "utimensat", 320 },
+	{ "utimensat_time64", 412 },
 	{ "utimes", 271 },
 	{ "vfork", 190 },
 	{ "vhangup", 111 },
@@ -483,7 +515,7 @@ int x86_syscall_resolve_name(const char *name)
 
 	if (strcmp(name, "accept") == 0)
 		return __PNR_accept;
-	if (strcmp(name, "accept4") == 0)
+	else if (strcmp(name, "accept4") == 0)
 		return __PNR_accept4;
 	else if (strcmp(name, "bind") == 0)
 		return __PNR_bind;
@@ -522,6 +554,31 @@ int x86_syscall_resolve_name(const char *name)
 	else if (strcmp(name, "socketpair") == 0)
 		return __PNR_socketpair;
 
+	if (strcmp(name, "semop") == 0)
+		return __PNR_semop;
+	else if (strcmp(name, "semget") == 0)
+		return __PNR_semget;
+	else if (strcmp(name, "semctl") == 0)
+		return __PNR_semctl;
+	else if (strcmp(name, "semtimedop") == 0)
+		return __PNR_semtimedop;
+	else if (strcmp(name, "msgsnd") == 0)
+		return __PNR_msgsnd;
+	else if (strcmp(name, "msgrcv") == 0)
+		return __PNR_msgrcv;
+	else if (strcmp(name, "msgget") == 0)
+		return __PNR_msgget;
+	else if (strcmp(name, "msgctl") == 0)
+		return __PNR_msgctl;
+	else if (strcmp(name, "shmat") == 0)
+		return __PNR_shmat;
+	else if (strcmp(name, "shmdt") == 0)
+		return __PNR_shmdt;
+	else if (strcmp(name, "shmget") == 0)
+		return __PNR_shmget;
+	else if (strcmp(name, "shmctl") == 0)
+		return __PNR_shmctl;
+
 	for (iter = 0; table[iter].name != NULL; iter++) {
 		if (strcmp(name, table[iter].name) == 0)
 			return table[iter].num;
@@ -587,6 +644,31 @@ const char *x86_syscall_resolve_num(int num)
 	else if (num == __PNR_socketpair)
 		return "socketpair";
 
+	if (num == __PNR_semop)
+		return "semop";
+	else if (num == __PNR_semget)
+		return "semget";
+	else if (num == __PNR_semctl)
+		return "semctl";
+	else if (num == __PNR_semtimedop)
+		return "semtimedop";
+	else if (num == __PNR_msgsnd)
+		return "msgsnd";
+	else if (num == __PNR_msgrcv)
+		return "msgrcv";
+	else if (num == __PNR_msgget)
+		return "msgget";
+	else if (num == __PNR_msgctl)
+		return "msgctl";
+	else if (num == __PNR_shmat)
+		return "shmat";
+	else if (num == __PNR_shmdt)
+		return "shmdt";
+	else if (num == __PNR_shmget)
+		return "shmget";
+	else if (num == __PNR_shmctl)
+		return "shmctl";
+
 	for (iter = 0; table[iter].num != __NR_SCMP_ERROR; iter++) {
 		if (num == table[iter].num)
 			return table[iter].name;

data/ext/enterprise_script_service/libseccomp/src/arch-x86.c

@@ -43,16 +43,16 @@ const struct arch_def arch_def_x86 = {
 };
 
 /**
- * Convert a multiplexed pseudo socket syscall into a direct syscall
- * @param socketcall the multiplexed pseudo syscall number
+ * Convert a multiplexed pseudo syscall into a direct syscall
+ * @param syscall the multiplexed pseudo syscall number
  *
  * Return the related direct syscall number, __NR_SCMP_UNDEF is there is
  * no related syscall, or __NR_SCMP_ERROR otherwise.
  *
  */
-static int _x86_sock_demux(int socketcall)
+static int _x86_syscall_demux(int syscall)
 {
-	switch (socketcall) {
+	switch (syscall) {
 	case -101:
 		/* socket */
 		return 359;
@@ -113,20 +113,56 @@ static int _x86_sock_demux(int socketcall)
 	case -120:
 		/* sendmmsg */
 		return 345;
+	case -201:
+		/* semop - not defined */
+		return __NR_SCMP_UNDEF;
+	case -202:
+		/* semget */
+		return 393;
+	case -203:
+		/* semctl */
+		return 394;
+	case -204:
+		/* semtimedop - not defined */
+		return __NR_SCMP_UNDEF;
+	case -211:
+		/* msgsnd */
+		return 400;
+	case -212:
+		/* msgrcv */
+		return 401;
+	case -213:
+		/* msgget */
+		return 399;
+	case -214:
+		/* msgctl */
+		return 402;
+	case -221:
+		/* shmat */
+		return 397;
+	case -222:
+		/* shmdt */
+		return 398;
+	case -223:
+		/* shmget */
+		return 395;
+	case -224:
+		/* shmctl */
+		return 396;
 	}
 
 	return __NR_SCMP_ERROR;
 }
 
 /**
- * Convert a direct socket syscall into multiplexed pseudo socket syscall
+ * Convert a direct syscall into multiplexed pseudo socket syscall
  * @param syscall the direct syscall
  *
  * Return the related multiplexed pseduo syscall number, __NR_SCMP_UNDEF is
  * there is no related pseudo syscall, or __NR_SCMP_ERROR otherwise.
  *
  */
-static int _x86_sock_mux(int syscall)
+static int _x86_syscall_mux(int syscall)
 {
 	switch (syscall) {
 	case 337:
@@ -180,6 +216,36 @@ static int _x86_sock_mux(int syscall)
 	case 373:
 		/* shutdown */
 		return -113;
+	case 393:
+		/* semget */
+		return -202;
+	case 394:
+		/* semctl */
+		return -203;
+	case 400:
+		/* msgsnd */
+		return -211;
+	case 401:
+		/* msgrcv */
+		return -212;
+	case 399:
+		/* msgget */
+		return -213;
+	case 402:
+		/* msgctl */
+		return -214;
+	case 397:
+		/* shmat */
+		return -221;
+	case 398:
+		/* shmdt */
+		return -222;
+	case 395:
+		/* shmget */
+		return -223;
+	case 396:
+		/* shmctl */
+		return -224;
 	}
 
 	return __NR_SCMP_ERROR;
@@ -244,7 +310,7 @@ int x86_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
 
 		/* determine both the muxed and direct syscall numbers */
 		if (sys > 0) {
-			sys_a = _x86_sock_mux(sys);
+			sys_a = _x86_syscall_mux(sys);
 			if (sys_a == __NR_SCMP_ERROR) {
 				rc = __NR_SCMP_ERROR;
 				goto add_return;
@@ -252,7 +318,7 @@ int x86_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
 			sys_b = sys;
 		} else {
 			sys_a = sys;
-			sys_b = _x86_sock_demux(sys);
+			sys_b = _x86_syscall_demux(sys);
 			if (sys_b == __NR_SCMP_ERROR) {
 				rc = __NR_SCMP_ERROR;
 				goto add_return;
@@ -305,24 +371,81 @@ int x86_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
 			if (rc < 0)
 				goto add_return;
 		}
-	} else if (sys <= -200 && sys >= -224) {
-		/* multiplexed ipc syscalls */
+	} else if ((sys <= -200 && sys >= -224) || (sys >= 393 && sys <= 402)) {
+		/* (-200 to -224) : multiplexed ipc syscalls
+		   (393 to 402) : direct ipc syscalls */
+
+		/* strict check for the multiplexed socket syscalls */
 		for (iter = 0; iter < ARG_COUNT_MAX; iter++) {
 			if ((rule->args[iter].valid != 0) && (rule->strict)) {
 				rc = -EINVAL;
 				goto add_return;
 			}
 		}
-		rule->args[0].arg = 0;
-		rule->args[0].op = SCMP_CMP_EQ;
-		rule->args[0].mask = DATUM_MAX;
-		rule->args[0].datum = abs(sys) % 200;
-		rule->args[0].valid = 1;
-		rule->syscall = __x86_NR_ipc;
 
-		rc = db_rule_add(db, rule);
-		if (rc < 0)
-			goto add_return;
+		/* determine both the muxed and direct syscall numbers */
+		if (sys > 0) {
+			sys_a = _x86_syscall_mux(sys);
+			if (sys_a == __NR_SCMP_ERROR) {
+				rc = __NR_SCMP_ERROR;
+				goto add_return;
+			}
+			sys_b = sys;
+		} else {
+			sys_a = sys;
+			sys_b = _x86_syscall_demux(sys);
+			if (sys_b == __NR_SCMP_ERROR) {
+				rc = __NR_SCMP_ERROR;
+				goto add_return;
+			}
+		}
+
+		/* use rule_a for the multiplexed syscall and use rule_b for
+		 * the direct wired syscall */
+
+		if (sys_a == __NR_SCMP_UNDEF) {
+			rule_a = NULL;
+			rule_b = rule;
+		} else if (sys_b == __NR_SCMP_UNDEF) {
+			rule_a = rule;
+			rule_b = NULL;
+		} else {
+			/* need two rules, dup the first and link together */
+			rule_a = rule;
+			rule_dup = db_rule_dup(rule_a);
+			rule_b = rule_dup;
+			if (rule_b == NULL)
+				goto add_return;
+			rule_b->prev = rule_a;
+			rule_b->next = NULL;
+			rule_a->next = rule_b;
+		}
+
+		/* multiplexed socket syscalls */
+		if (rule_a != NULL) {
+			rule_a->syscall = __x86_NR_ipc;
+			rule_a->args[0].arg = 0;
+			rule_a->args[0].op = SCMP_CMP_EQ;
+			rule_a->args[0].mask = DATUM_MAX;
+			rule_a->args[0].datum = (-sys_a) % 200;
+			rule_a->args[0].valid = 1;
+		}
+
+		/* direct wired socket syscalls */
+		if (rule_b != NULL)
+			rule_b->syscall = sys_b;
+
+		/* we should be protected by a transaction checkpoint */
+		if (rule_a != NULL) {
+			rc = db_rule_add(db, rule_a);
+			if (rc < 0)
+				goto add_return;
+		}
+		if (rule_b != NULL) {
+			rc = db_rule_add(db, rule_b);
+			if (rc < 0)
+				goto add_return;
+		}
 	} else if (sys >= 0) {
 		/* normal syscall processing */
 		rc = db_rule_add(db, rule);