script_core 0.2.3 → 0.3.0

data/ext/enterprise_script_service/libseccomp/tests/util.c

@@ -200,14 +200,14 @@ int util_file_write(const char *path)
 
 	fd = open(path, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
 	if (fd < 0)
-		return errno;
+		return -errno;
 	if (write(fd, buf, buf_len) < buf_len) {
-		int rc = errno;
+		int rc = -errno;
 		close(fd);
 		return rc;
 	}
 	if (close(fd) < 0)
-		return errno;
+		return -errno;
 
 	return 0;
 }

data/ext/enterprise_script_service/libseccomp/tools/Makefile.am

@@ -35,10 +35,7 @@ scmp_bpf_sim_SOURCES = scmp_bpf_sim.c bpf.h util.h
 scmp_api_level_SOURCES = scmp_api_level.c
 
 scmp_sys_resolver_LDADD = ../src/libseccomp.la
-scmp_sys_resolver_LDFLAGS = -static
 scmp_arch_detect_LDADD = ../src/libseccomp.la
-scmp_arch_detect_LDFLAGS = -static
 scmp_bpf_disasm_LDADD = util.la
 scmp_bpf_sim_LDADD = util.la
 scmp_api_level_LDADD = ../src/libseccomp.la
-scmp_api_level_LDFLAGS = -static

data/ext/enterprise_script_service/libseccomp/tools/check-syntax

@@ -26,7 +26,7 @@ CHK_C_LIST="include/seccomp.h.in \
 	    src/*.c src/*.h \
 	    tests/*.c tests/*.h \
 	    tools/*.c tools/*.h"
-CHK_C_EXCLUDE=""
+CHK_C_EXCLUDE="src/syscalls.perf.c"
 
 ####
 # functions

data/ext/enterprise_script_service/libseccomp/tools/scmp_arch_detect.c

@@ -120,6 +120,9 @@ int main(int argc, char *argv[])
 		case SCMP_ARCH_S390X:
 			printf("s390x\n");
 			break;
+		case SCMP_ARCH_RISCV64:
+			printf("riscv64\n");
+			break;
 		default:
 			printf("unknown\n");
 		}

data/ext/enterprise_script_service/libseccomp/tools/scmp_bpf_disasm.c

@@ -288,7 +288,7 @@ static void bpf_decode_args(const bpf_instr_raw *bpf, unsigned int line)
  * @param file the BPF program
  *
  * Read the BPF program and display the instructions.  Returns zero on success,
- * negative values on failure.
+ * non-zero values on failure.
  *
  */
 static int bpf_decode(FILE *file)
@@ -424,7 +424,7 @@ static void bpf_dot_decode_args(const bpf_instr_raw *bpf, unsigned int line)
  * @param file the BPF program
  *
  * Read the BPF program and display the instructions.  Returns zero on success,
- * negative values on failure.
+ * non-zero values on failure.
  *
  */
 static int bpf_dot_decode(FILE *file)
@@ -508,6 +508,8 @@ int main(int argc, char *argv[])
 				arch = AUDIT_ARCH_S390;
 			else if (strcmp(optarg, "s390x") == 0)
 				arch = AUDIT_ARCH_S390X;
+			else if (strcmp(optarg, "riscv64") == 0)
+				arch = AUDIT_ARCH_RISCV64;
 			else
 				exit_usage(argv[0]);
 			break;

data/ext/enterprise_script_service/libseccomp/tools/scmp_bpf_sim.c

@@ -285,10 +285,14 @@ int main(int argc, char *argv[])
 				arch = AUDIT_ARCH_S390;
 			else if (strcmp(optarg, "s390x") == 0)
 				arch = AUDIT_ARCH_S390X;
+			else if (strcmp(optarg, "riscv64") == 0)
+				arch = AUDIT_ARCH_RISCV64;
 			else
 				exit_fault(EINVAL);
 			break;
 		case 'f':
+			if (opt_file)
+				exit_fault(EINVAL);
 			opt_file = strdup(optarg);
 			if (opt_file == NULL)
 				exit_fault(ENOMEM);

data/ext/enterprise_script_service/libseccomp/tools/util.c

@@ -78,6 +78,8 @@
 #define ARCH_NATIVE		AUDIT_ARCH_S390X
 #elif __s390__
 #define ARCH_NATIVE		AUDIT_ARCH_S390
+#elif __riscv && __riscv_xlen == 64
+#define ARCH_NATIVE		AUDIT_ARCH_RISCV64
 #else
 #error the simulator code needs to know about your machine type
 #endif
@@ -87,15 +89,15 @@ uint32_t arch = ARCH_NATIVE;
 
 /**
  * Convert a 16-bit target integer into the host's endianess
- * @param arch the architecture token
+ * @param arch_token the architecture token
  * @param val the 16-bit integer
  *
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint16_t ttoh16(uint32_t arch, uint16_t val)
+uint16_t ttoh16(uint32_t arch_token, uint16_t val)
 {
-	if (arch & __AUDIT_ARCH_LE)
+	if (arch_token & __AUDIT_ARCH_LE)
 		return le16toh(val);
 	else
 		return be16toh(val);
@@ -103,15 +105,15 @@ uint16_t ttoh16(uint32_t arch, uint16_t val)
 
 /**
  * Convert a 32-bit target integer into the host's endianess
- * @param arch the architecture token
+ * @param arch_token the architecture token
  * @param val the 32-bit integer
  *
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint32_t ttoh32(uint32_t arch, uint32_t val)
+uint32_t ttoh32(uint32_t arch_token, uint32_t val)
 {
-	if (arch & __AUDIT_ARCH_LE)
+	if (arch_token & __AUDIT_ARCH_LE)
 		return le32toh(val);
 	else
 		return be32toh(val);
@@ -119,15 +121,15 @@ uint32_t ttoh32(uint32_t arch, uint32_t val)
 
 /**
  * Convert a 32-bit host integer into the target's endianess
- * @param arch the architecture token
+ * @param arch_token the architecture token
  * @param val the 32-bit integer
  *
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint32_t htot32(uint32_t arch, uint32_t val)
+uint32_t htot32(uint32_t arch_token, uint32_t val)
 {
-	if (arch & __AUDIT_ARCH_LE)
+	if (arch_token & __AUDIT_ARCH_LE)
 		return htole32(val);
 	else
 		return htobe32(val);
@@ -135,15 +137,15 @@ uint32_t htot32(uint32_t arch, uint32_t val)
 
 /**
  * Convert a 64-bit host integer into the target's endianess
- * @param arch the architecture token
+ * @param arch_token the architecture token
  * @param val the 64-bit integer
  *
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint64_t htot64(uint32_t arch, uint64_t val)
+uint64_t htot64(uint32_t arch_token, uint64_t val)
 {
-	if (arch & __AUDIT_ARCH_LE)
+	if (arch_token & __AUDIT_ARCH_LE)
 		return htole64(val);
 	else
 		return htobe64(val);

data/ext/enterprise_script_service/libseccomp/tools/util.h

@@ -72,6 +72,13 @@
 #define AUDIT_ARCH_PPC64LE	(EM_PPC64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
 #endif
 
+#ifndef AUDIT_ARCH_RISCV64
+#ifndef EM_RISCV
+#define EM_RISCV		243
+#endif /* EM_RISCV */
+#define AUDIT_ARCH_RISCV64	(EM_RISCV|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
+#endif /* AUDIT_ARCH_RISCV64 */
+
 extern uint32_t arch;
 
 uint16_t ttoh16(uint32_t arch, uint16_t val);

data/ext/enterprise_script_service/mruby/.github/workflows/build.yml

@@ -0,0 +1,149 @@
+name: Build & Test
+
+on: [push, pull_request]
+
+jobs:
+  Check-Skip:
+    if: |
+      !contains(github.event.head_commit.message, '[ci skip]') &&
+      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip gha]')
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo not skip
+
+  Ubuntu-1604:
+    needs: Check-Skip
+    runs-on: ubuntu-16.04
+    env:
+      MRUBY_CONFIG: ci/gcc-clang
+      CC: gcc
+    steps:
+      - uses: actions/checkout@v2
+      - name: Ruby version
+        run: ruby -v
+      - name: Compiler version
+        run: ${{ env.CC }} --version
+      - name: Build and test
+        run: rake -m test:build && rake test:run
+
+  Ubuntu-1804-gcc:
+    needs: Check-Skip
+    runs-on: ubuntu-18.04
+    env:
+      MRUBY_CONFIG: ci/gcc-clang
+      CC: gcc
+    steps:
+      - uses: actions/checkout@v2
+      - name: Ruby version
+        run: ruby -v
+      - name: Compiler version
+        run: ${{ env.CC }} --version
+      - name: Build and test
+        run: rake -m test:build && rake test:run
+
+  Ubuntu-1804-clang:
+    needs: Check-Skip
+    runs-on: ubuntu-18.04
+    env:
+      MRUBY_CONFIG: ci/gcc-clang
+      CC: clang
+    steps:
+      - uses: actions/checkout@v2
+      - name: Ruby version
+        run: ruby -v
+      - name: Compiler version
+        run: ${{ env.CC }} --version
+      - name: Build and test
+        run: rake -m test:build && rake test:run
+
+  macOS:
+    needs: Check-Skip
+    runs-on: macos-latest
+    env:
+      MRUBY_CONFIG: ci/gcc-clang
+      CC: clang
+    steps:
+      - uses: actions/checkout@v2
+      - name: Ruby version
+        run: ruby -v
+      - name: Compiler version
+        run: ${{ env.CC }} --version
+      - name: Build and test
+        run: rake -m test:build && rake test:run
+
+  Windows-MinGW:
+    needs: Check-Skip
+    runs-on: windows-latest
+    env:
+      MRUBY_CONFIG: ci/gcc-clang
+      CC: gcc
+    steps:
+      - uses: actions/checkout@v2
+      - name: Ruby version
+        run: ruby -v
+      - name: Compiler version
+        run: ${{ env.CC }} --version
+      - name: Build and test
+        run: rake -m test:build && rake test:run
+
+  Windows-Cygwin:
+    needs: Check-Skip
+    runs-on: windows-latest
+    env:
+      ACTIONS_ALLOW_UNSECURE_COMMANDS: true
+      MRUBY_CONFIG: ci/gcc-clang
+      CC: gcc
+      installer-path: '%TMP%\cygwin-setup.exe'
+      cygwin-root: C:\cygwin
+      package-dir: C:\cygwin-package
+      cache-version: v1
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/cache@v2
+        with:
+          path: ${{ env.package-dir }}
+          key: ${{ runner.os }}-cygwin-${{ env.cache-version }}
+      - name: Download Cygwin installer
+        shell: cmd
+        run: >
+          bitsadmin /transfer download /priority foreground
+          https://cygwin.com/setup-x86_64.exe ${{ env.installer-path }}
+      - name: Install Cygwin
+        shell: cmd
+        run: >
+          ${{ env.installer-path }}
+          --quiet-mode --no-shortcuts --no-startmenu --no-desktop --no-admin
+          --only-site --site http://mirrors.kernel.org/sourceware/cygwin/
+          --root ${{ env.cygwin-root }}
+          --local-package-dir ${{ env.package-dir }}
+          --packages gcc-core,gcc-g++,ruby
+      - name: Set PATH for Cygwin
+        run: |
+          echo '::set-env name=PATH::${{ env.cygwin-root }}\bin;${{ env.cygwin-root }}\usr\bin'
+      - name: Ruby version
+        shell: cmd
+        run: ruby -v
+      - name: Compiler version
+        run: ${{ env.CC }} --version
+      - name: Build and test
+        shell: cmd
+        run: ruby /usr/bin/rake -m test:build && ruby /usr/bin/rake test:run
+      - name: Set PATH for cache archiving (tar)
+        # set Windows path so that Cygwin tar is not used for cache archiving
+        run: echo '::set-env name=PATH::C:\windows\System32'
+
+  Windows-VC:
+    needs: Check-Skip
+    runs-on: windows-latest
+    env:
+      MRUBY_CONFIG: ci/msvc
+    steps:
+      - uses: actions/checkout@v2
+      - name: Ruby version
+        run: ruby -v
+      - name: Build and test
+        shell: cmd
+        run: |
+          call "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+          rake -m test:build && rake test:run

data/ext/enterprise_script_service/mruby/.github/workflows/codeql-analysis.yml

@@ -0,0 +1,55 @@
+name: "Code scanning - action"
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '0 19 * * 4'
+
+jobs:
+  CodeQL-Build:
+    if: |
+      !contains(github.event.head_commit.message, '[ci skip]') &&
+      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip gha]')
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          # We must fetch at least the immediate parents so that if this is
+          # a pull request then we can checkout the head.
+          fetch-depth: 2
+
+      # If this run was triggered by a pull request event, then checkout
+      # the head of the pull request instead of the merge commit.
+      - run: git checkout HEAD^2
+        if: ${{ github.event_name == 'pull_request' }}
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        # Override language selection by uncommenting this and choosing your languages
+        # with:
+        #   languages: go, javascript, csharp, python, cpp, java
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v1
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+
+      # - run: |
+      #    make bootstrap
+      #    make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1

data/ext/enterprise_script_service/mruby/.github/workflows/lint.yml

@@ -0,0 +1,23 @@
+name: ❄️ Lint
+
+on: [pull_request]
+
+jobs:
+  yamllint:
+    name: 🍶 YAML
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: 🧹 YAML Lint
+        uses: ibiqlik/action-yamllint@v3
+  markdownlint:
+    name: 🍸 Markdown
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: 🚀 Use Node.js
+        uses: actions/setup-node@v2.1.4
+        with:
+          node-version: '12.x'
+      - run: npm install -g markdownlint-cli@0.25.0
+      - run: markdownlint '**/*.md'

data/ext/enterprise_script_service/mruby/.github/workflows/oss-fuzz.yml

@@ -0,0 +1,27 @@
+name: CIFuzz
+on: [pull_request]
+jobs:
+  Fuzzing:
+    if: |
+      !contains(github.event.head_commit.message, '[ci skip]') &&
+      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip gha]')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build Fuzzers
+        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+        with:
+          oss-fuzz-project-name: 'mruby'
+          dry-run: false
+      - name: Run Fuzzers
+        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+        with:
+          oss-fuzz-project-name: 'mruby'
+          fuzz-seconds: 600
+          dry-run: false
+      - name: Upload Crash
+        uses: actions/upload-artifact@v1
+        if: failure()
+        with:
+          name: artifacts
+          path: ./out/artifacts