script_core 0.2.1 → 0.2.6

data/ext/enterprise_script_service/libseccomp/CHANGELOG

@@ -2,6 +2,16 @@ libseccomp: Releases
 ===============================================================================
 https://github.com/seccomp/libseccomp
 
+* Version 2.4.3 - March 4, 2020
+- Add list of authorized release signatures to README.md
+- Fix multiplexing issue with s390/s390x shm* syscalls
+- Remove the static flag from libseccomp tools compilation
+- Add define for __SNR_ppoll
+- Update our Travis CI configuration to use Ubuntu 18.04
+- Disable live python tests in Travis CI
+- Use default python, rather than nightly python, in TravisCI
+- Fix potential memory leak identified by clang in the scmp_bpf_sim tool
+
 * Version 2.4.2 - November 7, 2019
 - Update the syscall table for Linux v5.4-rc4
 - Stop defining __NR_x values for syscalls that don't exist.  Libseccomp

data/ext/enterprise_script_service/libseccomp/CREDITS

@@ -7,11 +7,13 @@ Andy Lutomirski
 Ashley Lai <adlai@us.ibm.com>
 Bogdan Purcareata <bogdan.purcareata@freescale.com>
 Brian Cain <brian.cain@gmail.com>
+Chris Waldon <chris.waldon@ibm.com>
 Colin Walters <walters@verbum.org>
 Corey Bryant <coreyb@linux.vnet.ibm.com>
 David Drysdale <drysdale@google.com>
 Eduardo Otubo <otubo@linux.vnet.ibm.com>
 Eric Paris <eparis@redhat.com>
+Fabrice Fontaine <fontaine.fabrice@gmail.com>
 Felix Abecassis <fabecassis@nvidia.com>
 Felix Geyer <debfx@fobos.de>
 Heiko Carstens <heiko.carstens@de.ibm.com>
@@ -34,6 +36,7 @@ Mathias Krause
 Michael Forney <mforney@mforney.org>
 Mike Frysinger <vapier@gentoo.org>
 Mike Strosaker <strosake@linux.vnet.ibm.com>
+Miroslav Lichvar <mlichvar@redhat.com>
 Paul Moore <paul@paul-moore.com>
 Serge Hallyn <serge.hallyn@ubuntu.com>
 Stéphane Graber <stgraber@ubuntu.com>

data/ext/enterprise_script_service/libseccomp/README.md

@@ -63,6 +63,24 @@ CHANGELOG files.
 Those who are interested in contributing to the the project are encouraged to
 read the CONTRIBUTING in the top level directory.
 
+## Verifying Release Tarballs
+
+Before use you should verify the downloaded release tarballs and checksums
+using the detached signatures supplied as part of the release; the detached
+signature files are the "*.asc" files.  If you have GnuPG installed you can
+verify detached signatures using the following command:
+
+	# gpg --verify file.asc file
+
+At present, only the following keys are authorized to sign official libseccomp
+releases:
+
+	Paul Moore <paul@paul-moore.com>
+	7100 AADF AE6E 6E94 0D2E  0AD6 55E4 5A5A E8CA 7C8A
+
+	Tom Hromatka <tom.hromatka@oracle.com>
+	47A6 8FCE 37C7 D702 4FD6  5E11 356C E62C 2B52 4099
+
 ## Building and Installing the Library
 
 If you are building the libseccomp library from an official release tarball,

data/ext/enterprise_script_service/libseccomp/configure.ac

@@ -19,7 +19,7 @@ dnl #
 dnl ####
 dnl libseccomp defines
 dnl ####
-AC_INIT([libseccomp], [2.4.2])
+AC_INIT([libseccomp], [2.4.3])
 
 dnl ####
 dnl autoconf configuration

data/ext/enterprise_script_service/libseccomp/include/seccomp-syscalls.h

@@ -272,6 +272,7 @@
 #define __PNR_timerfd_gettime64			-10238
 #define __PNR_timerfd_settime64			-10239
 #define __PNR_utimensat_time64			-10240
+#define __PNR_ppoll				-10241
 
 /*
  * libseccomp syscall definitions
@@ -1359,6 +1360,12 @@
 #define __SNR_poll			__PNR_poll
 #endif
 
+#ifdef __NR_ppoll
+#define __SNR_ppoll			__NR_ppoll
+#else
+#define __SNR_ppoll			__PNR_ppoll
+#endif
+
 #ifdef __NR_ppoll_time64
 #define __SNR_ppoll_time64		__NR_ppoll_time64
 #else

data/ext/enterprise_script_service/libseccomp/src/arch-s390-syscalls.c

@@ -531,6 +531,14 @@ int s390_syscall_resolve_name(const char *name)
 		return __PNR_sendto;
 	else if (strcmp(name, "setsockopt") == 0)
 		return __PNR_setsockopt;
+	else if (strcmp(name, "shmat") == 0)
+		return __PNR_shmat;
+	else if (strcmp(name, "shmdt") == 0)
+		return __PNR_shmdt;
+	else if (strcmp(name, "shmget") == 0)
+		return __PNR_shmget;
+	else if (strcmp(name, "shmctl") == 0)
+		return __PNR_shmctl;
 	else if (strcmp(name, "shutdown") == 0)
 		return __PNR_shutdown;
 	else if (strcmp(name, "socket") == 0)
@@ -596,6 +604,14 @@ const char *s390_syscall_resolve_num(int num)
 		return "sendto";
 	else if (num == __PNR_setsockopt)
 		return "setsockopt";
+	else if (num == __PNR_shmat)
+		return "shmat";
+	else if (num == __PNR_shmdt)
+		return "shmdt";
+	else if (num == __PNR_shmget)
+		return "shmget";
+	else if (num == __PNR_shmctl)
+		return "shmctl";
 	else if (num == __PNR_shutdown)
 		return "shutdown";
 	else if (num == __PNR_socket)

data/ext/enterprise_script_service/libseccomp/src/arch-s390x-syscalls.c

@@ -531,6 +531,14 @@ int s390x_syscall_resolve_name(const char *name)
 		return __PNR_sendto;
 	else if (strcmp(name, "setsockopt") == 0)
 		return __PNR_setsockopt;
+	else if (strcmp(name, "shmat") == 0)
+		return __PNR_shmat;
+	else if (strcmp(name, "shmdt") == 0)
+		return __PNR_shmdt;
+	else if (strcmp(name, "shmget") == 0)
+		return __PNR_shmget;
+	else if (strcmp(name, "shmctl") == 0)
+		return __PNR_shmctl;
 	else if (strcmp(name, "shutdown") == 0)
 		return __PNR_shutdown;
 	else if (strcmp(name, "socket") == 0)
@@ -596,6 +604,14 @@ const char *s390x_syscall_resolve_num(int num)
 		return "sendto";
 	else if (num == __PNR_setsockopt)
 		return "setsockopt";
+	else if (num == __PNR_shmat)
+		return "shmat";
+	else if (num == __PNR_shmdt)
+		return "shmdt";
+	else if (num == __PNR_shmget)
+		return "shmget";
+	else if (num == __PNR_shmctl)
+		return "shmctl";
 	else if (num == __PNR_shutdown)
 		return "shutdown";
 	else if (num == __PNR_socket)

data/ext/enterprise_script_service/libseccomp/tests/.gitignore

@@ -56,3 +56,4 @@ util.pyc
 48-sim-32b_args
 49-sim-64b_comparisons
 50-sim-hash_collision
+52-basic-load

data/ext/enterprise_script_service/libseccomp/tests/15-basic-resolver.c

@@ -55,15 +55,15 @@ int main(int argc, char *argv[])
 	unsigned int arch;
 	char *name = NULL;
 
-	if (seccomp_syscall_resolve_name("open") != __NR_open)
+	if (seccomp_syscall_resolve_name("open") != __SNR_open)
 		goto fail;
-	if (seccomp_syscall_resolve_name("read") != __NR_read)
+	if (seccomp_syscall_resolve_name("read") != __SNR_read)
 		goto fail;
 	if (seccomp_syscall_resolve_name("INVALID") != __NR_SCMP_ERROR)
 		goto fail;
 
 	rc = seccomp_syscall_resolve_name_rewrite(SCMP_ARCH_NATIVE, "openat");
-	if (rc != __NR_openat)
+	if (rc != __SNR_openat)
 		goto fail;
 
 	while ((arch = arch_list[iter++]) != -1) {

data/ext/enterprise_script_service/libseccomp/tests/52-basic-load.c

@@ -0,0 +1,48 @@
+/**
+ * Seccomp Library test program
+ *
+ * Copyright (c) 2019 Cisco Systems, Inc. <pmoore2@cisco.com>
+ * Author: Paul Moore <paul@paul-moore.com>
+ */
+
+/*
+ * This library is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; if not, see <http://www.gnu.org/licenses>.
+ */
+
+#include <errno.h>
+#include <unistd.h>
+
+#include <seccomp.h>
+
+#include "util.h"
+
+int main(int argc, char *argv[])
+{
+	int rc;
+	struct util_options opts;
+	scmp_filter_ctx ctx = NULL;
+
+	rc = util_getopt(argc, argv, &opts);
+	if (rc < 0)
+		goto out;
+
+	ctx = seccomp_init(SCMP_ACT_ALLOW);
+	if (ctx == NULL)
+		return ENOMEM;
+
+	rc = seccomp_load(ctx);
+
+out:
+	seccomp_release(ctx);
+	return (rc < 0 ? -rc : rc);
+}

data/ext/enterprise_script_service/libseccomp/tests/52-basic-load.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python
+
+#
+# Seccomp Library test program
+#
+# Copyright (c) 2019 Cisco Systems, Inc. <pmoore2@cisco.com>
+# Author: Paul Moore <paul@paul-moore.com>
+#
+
+#
+# This library is free software; you can redistribute it and/or modify it
+# under the terms of version 2.1 of the GNU Lesser General Public License as
+# published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+# for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library; if not, see <http://www.gnu.org/licenses>.
+#
+
+import argparse
+import sys
+
+import util
+
+from seccomp import *
+
+def test():
+    f = SyscallFilter(ALLOW)
+    f.load()
+
+test()
+
+# kate: syntax python;
+# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;

data/ext/enterprise_script_service/libseccomp/tests/52-basic-load.tests

@@ -0,0 +1,11 @@
+#
+# libseccomp regression test automation data
+#
+# Copyright (c) 2013 Red Hat <pmoore@redhat.com>
+# Author: Paul Moore <paul@paul-moore.com>
+#
+
+test type: basic
+
+# Test command
+52-basic-load

data/ext/enterprise_script_service/libseccomp/tests/Makefile.am

@@ -89,7 +89,8 @@ check_PROGRAMS = \
 	47-live-kill_process \
 	48-sim-32b_args \
 	49-sim-64b_comparisons \
-	50-sim-hash_collision
+	50-sim-hash_collision \
+	52-basic-load
 
 EXTRA_DIST_TESTPYTHON = \
 	util.py \
@@ -141,7 +142,8 @@ EXTRA_DIST_TESTPYTHON = \
 	47-live-kill_process.py \
 	48-sim-32b_args.py \
 	49-sim-64b_comparisons.py \
-	50-sim-hash_collision.py
+	50-sim-hash_collision.py \
+	52-basic-load.py
 
 EXTRA_DIST_TESTCFGS = \
 	01-sim-allow.tests \
@@ -193,7 +195,8 @@ EXTRA_DIST_TESTCFGS = \
 	47-live-kill_process.tests \
 	48-sim-32b_args.tests \
 	49-sim-64b_comparisons.tests \
-	50-sim-hash_collision.tests
+	50-sim-hash_collision.tests \
+	52-basic-load.tests
 
 EXTRA_DIST_TESTSCRIPTS = \
 	38-basic-pfc_coverage.sh 38-basic-pfc_coverage.pfc

data/ext/enterprise_script_service/libseccomp/tests/regression

@@ -94,6 +94,7 @@ libseccomp regression test automation script
 optional arguments:
   -h             show this help message and exit
   -m MODE        specified the test mode [c (default), python]
+                  can also be set via LIBSECCOMP_TSTCFG_MODE_LIST env variable
   -a             specifies all tests are to be run
   -b BATCH_NAME  specifies batch of tests to be run
   -l [LOG]       specifies log file to write test results to
@@ -1025,6 +1026,9 @@ while getopts "ab:gl:m:s:t:T:vh" opt; do
 	esac
 done
 
+# use mode list from environment if provided
+[[ -z $mode_list && -n $LIBSECCOMP_TSTCFG_MODE_LIST ]] && mode_list=$LIBSECCOMP_TSTCFG_MODE_LIST
+
 # determine the mode test automatically
 if [[ -z $mode_list ]]; then
 	# always perform the native c tests

data/ext/enterprise_script_service/libseccomp/tools/Makefile.am

@@ -35,10 +35,7 @@ scmp_bpf_sim_SOURCES = scmp_bpf_sim.c bpf.h util.h
 scmp_api_level_SOURCES = scmp_api_level.c
 
 scmp_sys_resolver_LDADD = ../src/libseccomp.la
-scmp_sys_resolver_LDFLAGS = -static
 scmp_arch_detect_LDADD = ../src/libseccomp.la
-scmp_arch_detect_LDFLAGS = -static
 scmp_bpf_disasm_LDADD = util.la
 scmp_bpf_sim_LDADD = util.la
 scmp_api_level_LDADD = ../src/libseccomp.la
-scmp_api_level_LDFLAGS = -static

data/ext/enterprise_script_service/libseccomp/tools/scmp_bpf_sim.c

@@ -289,6 +289,8 @@ int main(int argc, char *argv[])
 				exit_fault(EINVAL);
 			break;
 		case 'f':
+			if (opt_file)
+				exit_fault(EINVAL);
 			opt_file = strdup(optarg);
 			if (opt_file == NULL)
 				exit_fault(ENOMEM);

data/ext/enterprise_script_service/mruby/.github/workflows/build.yml

@@ -0,0 +1,106 @@
+name: Build & Test
+
+on: [push, pull_request]
+
+jobs:
+  Ubuntu-1604:
+    runs-on: ubuntu-16.04
+    steps:
+    - uses: actions/checkout@v1
+    - name: apt
+      run: sudo apt install ruby gperf
+    - name: build and test
+      run: rake -m -j4 all test
+      env:
+        MRUBY_CONFIG: travis_config.rb
+
+  Ubuntu-1804-gcc:
+    runs-on: ubuntu-18.04
+    steps:
+    - uses: actions/checkout@v1
+    - name: apt
+      run: sudo apt install ruby gperf gcc g++
+    - name: build and test
+      run: rake -m -j4 all test
+      env:
+        MRUBY_CONFIG: travis_config.rb
+        CC: gcc
+        CXX: g++
+
+  Ubuntu-1804-clang:
+    runs-on: ubuntu-18.04
+    steps:
+    - uses: actions/checkout@v1
+    - name: apt
+      run: sudo apt install ruby gperf
+    - name: build and test
+      run: rake -m -j4 all test
+      env:
+        MRUBY_CONFIG: travis_config.rb
+        CC: clang
+        CXX: clang++
+
+  macOS:
+    runs-on: macos-latest
+    steps:
+    - uses: actions/checkout@v1
+    - name: brew
+      run: brew install ruby gperf
+    - name: build and test
+      run: rake -m -j4 all test
+      env:
+        MRUBY_CONFIG: travis_config.rb
+
+  Windows-MinGW:
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v1
+    - name: chocolatey
+      run: choco install -y ruby gperf
+    - name: build and test
+      run: rake -E '$stdout.sync=true' -j4 test
+      env:
+        MRUBY_CONFIG: travis_config.rb
+        CFLAGS: -g -O1 -Wall -Wundef
+
+  Windows-Cygwin:
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v1
+    - uses: actions/cache@v1
+      with:
+        path: C:\Users\runneradmin\AppData\Local\Temp\chocolatey
+        key: ${{ runner.os }}-cygwin-chocolatey-${{ matrix.os }}-${{ github.sha }}
+        restore-keys: |
+          ${{ runner.os }}-cygwin-chocolatey-${{ matrix.os }}-
+          ${{ runner.os }}-cygwin-chocolatey-
+    - name: chocolatey
+      run: choco install -y cygwin
+    - name: Install cygwin packages
+      shell: cmd
+      run: C:\tools\cygwin\cygwinsetup.exe -qgnNdO -R C:/tools/cygwin -l C:/tools/cygwin/package -s http://mirrors.kernel.org/sourceware/cygwin/ -P gcc-core,gcc-g++,make,gperf,ruby
+    - name: Set ENV
+      run: |
+        echo '::set-env name=PATH::C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin'
+    - name: build and test
+      shell: cmd
+      run: C:\tools\cygwin\bin\ruby.exe /usr/bin/rake -m -j4 -E 'STDOUT.sync=true' test
+      env:
+        MRUBY_CONFIG: travis_config.rb
+
+  Windows-VC:
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v1
+    - name: chocolatey
+      run: choco install -y ruby gperf
+    - name: build and test
+      shell: cmd
+      run: |
+        call "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+        rake -E "STDOUT.sync=true" -m -j4 test
+      env:
+        MRUBY_CONFIG: appveyor_config.rb
+        # TODO(take-cheeze): Re-enable /O2
+        CFLAGS: "/c /nologo /W3 /we4013 /Zi /MD /D_CRT_SECURE_NO_WARNINGS"
+        CXXFLAGS: "/c /nologo /W3 /Zi /MD /EHs /D_CRT_SECURE_NO_WARNINGS"