seccomp-notify 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4348459a8a4722dfdc17dcf0acf21b0e7802f6b9b5fe80e1821d9cb1964d7802
-  data.tar.gz: 3d8776d6b56396439b30b17897eb862dde5fbe8c591ce3e58d62a1c928c90e72
+  metadata.gz: 1338763ff6ac458c1224576b7763524b57034de1b29423acc2dde48268012dd1
+  data.tar.gz: 03dc39b44de12c7bb1401edc303097eb02b389c511e040589c2293cb840d2c41
 SHA512:
-  metadata.gz: b3c6841b95077468dea06d50250d91f660386cf21e33240bcf270b07b7f7efabe6e890a0ee1e6ca22d6492d9cb6837b1cd25954c4eb93d195c77a4ce025221ac
-  data.tar.gz: 63d5fdf903dc3541c9ded5eb90deb66de7ea4171304b375f6228aae690462816cd5880eef05de9d27df95bb843fb84c573e89b6ffc718cee50c2e693827ff731
+  metadata.gz: 9c99782a7d1c9bf43d3069aa1f742f1c3f5e33b40a47014c6e5a3d4803062b8d8239e2df8a915583d056a4441ed438deebde1ad1cc8af9e1a1bdd8b5f95e333f
+  data.tar.gz: dd0f9b82f5749bdeb933e6e56c616619f150fadbb9742582f03ef32ff8d8401e7732dff4070b7a0860abcd6bb42ed537047cda119fa314891c99ab51af0bbd4e

data/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to seccomp-notify are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and versions follow [Semantic Versioning](https://semver.org/).
 
+## v0.3.0 - 2026-08-24
+
+- Kill the issuing thread group without treating a thread ID as a process ID.
+- Keep the listener transfer descriptor reserved so later `sendmsg` calls cannot bypass policy.
+- Reject x32 syscalls, conflicting policy actions, and invalid emulated return values.
+- Preserve the protocol-neutral type of decoded socket addresses.
+- Marshal ioctl and seccomp buffers through native memory for compacting-GC safety.
+- Reduce runtime feature detection from four isolated child probes to two and synchronize supervisor shutdown state.
+
+## v0.2.0 - 2026-08-22
+
+- Stop supervising a non-child target once it becomes a zombie.
+- Read target memory from the current address space after `exec` and normalize EOF failures.
+
 ## v0.1.0 - 2026-08-22
 
 - Initial release

data/README.md

@@ -1,82 +1,171 @@
-# seccomp-notify
-
-Pure Ruby plumbing for Linux [`SECCOMP_RET_USER_NOTIF`](https://www.kernel.org/doc/html/latest/userspace-api/seccomp_filter.html). It builds cBPF filters, transfers listener file descriptors, supervises notifications, reads target memory, and injects file descriptors without a native extension.
+<h1 align="center">seccomp-notify</h1>
+
+<p align="center">
+  <strong>Pure Ruby bindings for Linux seccomp user notifications</strong>
+</p>
+
+<p align="center">
+  <a href="https://rubygems.org/gems/seccomp-notify"><img src="https://img.shields.io/gem/v/seccomp-notify.svg?colorB=319e8c" alt="Gem Version"></a>
+  <a href="https://rubygems.org/gems/seccomp-notify"><img src="https://img.shields.io/gem/dt/seccomp-notify.svg" alt="Downloads"></a>
+  <img src="https://img.shields.io/badge/ruby-%3E%3D%203.1-ruby.svg" alt="Ruby Version">
+  <img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License">
+</p>
+
+<p align="center">
+  <a href="#features">Features</a> ·
+  <a href="#installation">Installation</a> ·
+  <a href="#quick-start">Quick Start</a> ·
+  <a href="https://ydah.github.io/seccomp-notify/">API Docs</a> ·
+  <a href="#responses">Responses</a> ·
+  <a href="#security">Security</a> ·
+  <a href="#development">Development</a>
+</p>
+
+---
+
+`seccomp-notify` provides the plumbing for Linux
+[`SECCOMP_RET_USER_NOTIF`](https://www.kernel.org/doc/html/latest/userspace-api/seccomp_filter.html).
+It builds cBPF filters, transfers listener file descriptors, supervises syscall notifications,
+reads target memory, and injects file descriptors without a native extension.
 
 > [!WARNING]
-> This gem is a mechanism, not a security policy or a complete sandbox. Never inspect a pointer argument and then use `continue!` as a security decision: another target thread can change that memory between inspection and syscall execution (TOCTOU). Reject the syscall or emulate it instead.
+> This gem is a mechanism, not a security policy or a complete sandbox. Never inspect a pointer
+> argument and then use `continue!` as a security decision: another target thread can change that
+> memory between inspection and syscall execution (TOCTOU). Reject or emulate the syscall instead.
+
+## Features
+
+- Pure Ruby cBPF filter generation and seccomp installation
+- Parent supervisor with a filtered child through `Seccomp::Notify.spawn`
+- Existing-process supervision through `Seccomp::Notify.supervise_self`
+- Syscall handlers with errno, emulation, continuation, and process termination responses
+- Target memory helpers for strings, bytes, and socket addresses
+- File descriptor injection with atomic and fallback ADDFD paths
+- Runtime detection for optional kernel features
+- Handler timeouts, concurrent workers, and supervisor health checks
+- Linux x86_64 and aarch64 support
 
-Seccomp cannot intercept vDSO calls, I/O submitted through an existing `io_uring`, operations on already-open file descriptors, or indirect shared-memory effects. `io_uring_setup` is denied by default. If the supervisor dies, blocked notification syscalls return `ENOSYS`.
+## Installation
 
-`fcntl` and `sendmsg` must remain allowed because Ruby uses them to wrap and transfer the listener fd; policies that try to notify or deny them are rejected.
+Add the gem to your Gemfile:
 
-## Requirements
+```ruby
+gem "seccomp-notify"
+```
+
+Then install:
+
+```sh
+bundle install
+```
+
+### Requirements
 
 - Linux on x86_64 or aarch64
 - Ruby 3.1 or newer
-- Linux 5.0 or newer; ADDFD needs 5.9 or newer
+- Linux 5.0 or newer; ADDFD requires Linux 5.9 or newer
 - `CONFIG_SECCOMP_FILTER=y`
 
-Container runtimes may block `seccomp(2)` with their own profile. For Docker development, use an isolated test container with:
+Container runtimes may block `seccomp(2)` with their own profile. For Docker development, use an
+isolated test container with seccomp disabled:
 
 ```sh
 docker run --rm --security-opt seccomp=unconfined -v "$PWD:/app" -w /app ruby:3.4 bundle exec rake
 ```
 
-## Installation
-
-```ruby
-gem "seccomp-notify"
-```
-
-## Usage
+## Quick Start
 
-The recommended shape keeps the unfiltered supervisor in the parent and installs the filter in a child:
+Keep the unfiltered supervisor in the parent and install the filter in a child:
 
 ```ruby
 require "seccomp/notify"
 
-open_syscalls = RUBY_PLATFORM.include?("x86_64") ? %i[open openat] : %i[openat]
 policy = Seccomp::Notify::Policy.new do
-  notify(*open_syscalls, :connect)
+  notify :connect, :sendto
 end
 
 supervisor = Seccomp::Notify.spawn(policy) do
-  exec("bundle", "install")
+  exec("curl", "https://example.com")
 end
 
-open_handler = proc do |request|
-  path_argument = request.syscall == :open ? 0 : 1
-  path = request.read_string(request.args[path_argument])
-  if path == "/etc/shadow"
-    request.error!(Errno::EACCES)
-  else
-    request.continue!(unsafe: true)
-  end
-end
-open_syscalls.each { |syscall| supervisor.on(syscall, &open_handler) }
-
 supervisor.on(:connect) { |request| request.error!(Errno::ENETUNREACH) }
+supervisor.on(:sendto) { |request| request.error!(Errno::ENETUNREACH) }
+
 status = supervisor.run
 ```
 
-`request.pid` is an alias for `request.tid`: the kernel reports the thread ID that issued the syscall, not the process ID.
+`request.pid` is an alias for `request.tid`: the kernel reports the thread ID that issued the
+syscall, not the process ID.
+
+### Supervise the current process
+
+`supervise_self(policy, supervisor: :fork)` accepts a block that configures the child supervisor.
+The safer `:spawn` form starts a clean Ruby VM and supports the default pass-through handler only.
+Both forms detach the supervisor child, so broad `Process.wait` calls in the target can still
+observe related lifecycle effects. The default pass-through handler requires `continue!` and Linux
+5.5 or newer; handler-based supervision works on Linux 5.0 or newer.
+
+## Responses
+
+| Method | Behavior | Requirement |
+|--------|----------|-------------|
+| `allow!(value = 0)` | Emulate a successful return value without running the syscall | Linux 5.0+ |
+| `error!(Errno::EPERM)` | Return an errno | Linux 5.0+ |
+| `continue!` | Run the original syscall | Linux 5.5+ |
+| `add_fd!(io)` | Inject a file descriptor and return its number | Linux 5.9+ |
+| `kill!` | Terminate the issuing process | — |
+
+Use `Seccomp::Notify.features` to inspect runtime support. Set
+`SECCOMP_NOTIFY_DISABLE_FEATURES=addfd,continue` to force feature fallbacks in tests.
+
+Targets started by this gem can call `Seccomp::Notify.supervisor_alive?` to poll the health pipe.
+If the target calls `exec`, the pipe descriptor is inherited and published as
+`SECCOMP_NOTIFY_HEALTH_FD`.
 
-`supervise_self(policy, supervisor: :fork)` accepts a block that configures the child supervisor. The safer `:spawn` form starts a clean Ruby VM and therefore supports only the default pass-through handler. Both forms detach the supervisor child, so broad `Process.wait` calls in the target can still observe related lifecycle effects.
+## How It Works
 
-## Responses and features
+1. The parent creates a Unix socket pair and forks the target.
+2. The target installs a cBPF filter and sends its listener descriptor to the parent with
+   `SCM_RIGHTS`.
+3. The parent receives syscall notifications and dispatches them to registered handlers.
+4. Each handler returns an errno, emulated value, continuation, or injected descriptor.
 
-- `allow!(value = 0)` emulates a successful return value without executing the syscall.
-- `error!(Errno::EPERM)` returns an errno.
-- `continue!` executes the original syscall when supported.
-- `add_fd!(io)` injects a file descriptor when supported.
-- `kill!` terminates the issuing task.
+## Security
 
-Use `Seccomp::Notify.features` to inspect runtime support. Set `SECCOMP_NOTIFY_DISABLE_FEATURES=addfd,continue` to force feature fallbacks in tests.
+- Pointer data may change after inspection. Never use it to justify `continue!`.
+- vDSO calls, existing file descriptors, and indirect shared-memory effects are outside seccomp's
+  control.
+- I/O submitted through an existing `io_uring` does not pass through the filter;
+  `io_uring_setup` is denied by default.
+- If the supervisor dies, blocked notification syscalls return `ENOSYS`.
+- `fcntl` must remain allowed while Ruby wraps the listener descriptor, so policies that notify or
+  deny it are rejected. `sendmsg` may be filtered; only listener transfer on its reserved descriptor
+  is allowed, and that descriptor remains open across `exec` to prevent fd-number reuse.
 
-Targets started by this gem can call `Seccomp::Notify.supervisor_alive?` to poll the health pipe. If the target `exec`s, the pipe fd is inherited and published as `SECCOMP_NOTIFY_HEALTH_FD`.
+## Examples
+
+- [`examples/deny_network.rb`](examples/deny_network.rb) rejects outbound network syscalls.
+- [`examples/emulate_open.rb`](examples/emulate_open.rb) replaces `/dev/urandom` with an injected
+  file descriptor.
+- [`examples/strace_lite.rb`](examples/strace_lite.rb) logs selected syscall notifications.
 
 ## Development
 
-Run `bundle exec rake`. Linux runs include real seccomp integration tests; other systems run only portable filter and layout tests. `spike/notify_min.c` is the reference C round trip, and `tools/gen_syscall_table.rb` regenerates architecture tables from Linux kernel headers.
+```sh
+bundle install
+bundle exec rake
+```
+
+Linux runs include real seccomp integration tests; other systems run portable filter and layout
+tests only. `spike/notify_min.c` is the reference C round trip, and
+`tools/gen_syscall_table.rb` regenerates architecture tables from Linux kernel syscall tables.
+
+## Contributing
+
+Bug reports and pull requests are welcome at https://github.com/ydah/seccomp-notify.
+
+Releases before 1.0 may change the API.
+
+## License
 
-Releases before 1.0 may change the API. The project is available under the MIT License.
+Released under the [MIT License](LICENSE.txt).

data/lib/seccomp/notify/bpf/builder.rb

@@ -4,31 +4,45 @@ module Seccomp
   module Notify
     module BPF
       class Builder
-        LINEAR_LIMIT = 64
+        LINEAR_LIMIT = 4
         AUDIT_ARCHES = {x86_64: Constants::AUDIT_ARCH_X86_64, aarch64: Constants::AUDIT_ARCH_AARCH64}.freeze
 
-        def initialize(policy, arch: Libc.architecture)
+        def initialize(policy, arch: Libc.architecture, transfer_fd: nil)
           raise NotSupportedError, "unsupported architecture: #{arch}" unless AUDIT_ARCHES.key?(arch)
+          raise ArgumentError, "transfer_fd must be a non-negative integer" if transfer_fd && (!transfer_fd.is_a?(Integer) || transfer_fd.negative?)
 
           @policy = policy
           @arch = arch
+          @transfer_fd = transfer_fd
         end
 
         def build
           decisions = @policy.decisions(@arch)
+          if @transfer_fd.nil? && @policy.default_action != Constants::SECCOMP_RET_ALLOW && !@policy.notified?(:sendmsg)
+            decisions[Syscalls.number(:sendmsg, @arch)] = Constants::SECCOMP_RET_ALLOW
+          end
           body = decisions.length <= LINEAR_LIMIT ? linear(decisions) : tree(decisions.sort)
-          Program.new(prologue + body)
+          conditions = @policy.conditional_notifications(@arch)
+          bootstrap_first = @transfer_fd && conditions.any? { |number, _argument, _mask| number == Syscalls.number(:sendmsg, @arch) }
+          conditional = conditional_notifications(conditions, decisions)
+          bootstrap = bootstrap_first ? transfer_allowance + conditional : conditional + transfer_allowance
+          Program.new(prologue + bootstrap + body)
         end
 
         private
 
         def prologue
-          [
+          instructions = [
             ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_ARCH),
             ins(Constants::BPF_JMP_JEQ_K, 1, 0, AUDIT_ARCHES.fetch(@arch)),
             ins(Constants::BPF_RET_K, 0, 0, Constants::SECCOMP_RET_KILL_PROCESS),
             ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_NR)
           ]
+          if @arch == :x86_64
+            instructions << ins(Constants::BPF_JMP_JGE_K, 0, 1, Constants::X32_SYSCALL_BIT)
+            instructions << ins(Constants::BPF_RET_K, 0, 0, Constants::SECCOMP_RET_KILL_PROCESS)
+          end
+          instructions
         end
 
         def linear(decisions)
@@ -37,6 +51,42 @@ module Seccomp
           end << ins(Constants::BPF_RET_K, 0, 0, @policy.default_action)
         end
 
+        def transfer_allowance
+          return [] unless @transfer_fd
+
+          conditional(Syscalls.number(:sendmsg, @arch), 0, @transfer_fd, Constants::BPF_JMP_JEQ_K)
+        end
+
+        def conditional_notifications(conditions, decisions)
+          last_condition = {}
+          conditions.each_with_index { |(number, _argument, _mask), index| last_condition[number] = index }
+          conditions.each_with_index.flat_map do |(number, argument, mask), index|
+            fallback = decisions.fetch(number, @policy.default_action) if last_condition.fetch(number) == index
+            conditional(number, argument, mask, Constants::BPF_JMP_JSET_K, fallback:)
+          end
+        end
+
+        def conditional(number, argument, value, comparison, fallback: nil)
+          if fallback
+            return [
+              ins(Constants::BPF_JMP_JEQ_K, 0, 4, number),
+              ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_ARGS + argument * 8),
+              ins(comparison, 0, 1, value),
+              ins(Constants::BPF_RET_K, 0, 0, Constants::SECCOMP_RET_USER_NOTIF),
+              ins(Constants::BPF_RET_K, 0, 0, fallback),
+              ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_NR)
+            ]
+          end
+
+          [
+            ins(Constants::BPF_JMP_JEQ_K, 0, 3, number),
+            ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_ARGS + argument * 8),
+            ins(comparison, 0, 1, value),
+            ins(Constants::BPF_RET_K, 0, 0, comparison == Constants::BPF_JMP_JEQ_K ? Constants::SECCOMP_RET_ALLOW : Constants::SECCOMP_RET_USER_NOTIF),
+            ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_NR)
+          ]
+        end
+
         def tree(decisions)
           return [ins(Constants::BPF_RET_K, 0, 0, @policy.default_action)] if decisions.empty?
           return linear(decisions) if decisions.length <= 4

data/lib/seccomp/notify/constants.rb

@@ -32,13 +32,17 @@ module Seccomp
       AUDIT_ARCH_X86_64 = 0xc000_003e
       AUDIT_ARCH_AARCH64 = 0xc000_00b7
       AUDIT_ARCH_I386 = 0x4000_0003
+      X32_SYSCALL_BIT = 0x4000_0000
       SYS_SECCOMP = {x86_64: 317, aarch64: 277}.freeze
+      SYS_TGKILL = {x86_64: 234, aarch64: 131}.freeze
 
       PR_SET_NO_NEW_PRIVS = 38
+      PR_SET_PTRACER = 0x5961_6d61
       BPF_LD_W_ABS = 0x20
       BPF_JMP_JA = 0x05
       BPF_JMP_JEQ_K = 0x15
       BPF_JMP_JGE_K = 0x35
+      BPF_JMP_JSET_K = 0x45
       BPF_RET_K = 0x06
       BPF_MAXINSNS = 4096
       MAX_ERRNO = 4095

data/lib/seccomp/notify/fd_passing.rb

@@ -9,7 +9,7 @@ module Seccomp
       module_function
 
       def send_fd(socket, io)
-        socket.sendmsg("\0", 0, nil, Socket::AncillaryData.unix_rights(io))
+        socket.send_io(io)
       end
 
       def recv_fd(socket, timeout: 10)

data/lib/seccomp/notify/features.rb

@@ -12,9 +12,7 @@ module Seccomp
         result = {user_notif: supported?, continue: false, addfd: false, addfd_send: false, wait_killable_recv: false}
         return result.freeze unless result[:user_notif]
 
-        result[:continue] = probe_response(Constants::SECCOMP_USER_NOTIF_FLAG_CONTINUE)
-        result[:addfd] = probe_addfd(0)
-        result[:addfd_send] = probe_addfd(Constants::SECCOMP_ADDFD_FLAG_SEND)
+        result.update(probe_responses)
         result[:wait_killable_recv] = probe_install(Constants::SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
         disabled.each { |name| result[name.to_sym] = false if result.key?(name.to_sym) }
         result[:addfd_send] = false unless result[:addfd]
@@ -28,21 +26,36 @@ module Seccomp
         false
       end
 
-      def probe_response(flags)
-        probe do |listener, request|
-          response = [request.unpack1("Q<"), 0, 0, flags].pack(Structs::RESPONSE_FORMAT)
-          Ioctl.call(listener, Ioctl::NOTIF_SEND, response)
-        end
-      end
-
-      def probe_addfd(flags)
+      def probe_responses
+        parent, child = UNIXSocket.pair
+        listener = nil
+        pid = nil
         File.open("/dev/null") do |source|
-          probe do |listener, request|
-            id = request.unpack1("Q<")
-            injected = Ioctl.call(listener, Ioctl::NOTIF_ADDFD, [id, flags, source.fileno, 0, 0].pack(Structs::ADDFD_FORMAT))
-            Ioctl.call(listener, Ioctl::NOTIF_SEND, [id, injected, 0, 0].pack(Structs::RESPONSE_FORMAT)) if flags.zero?
+          pid = fork do
+            parent.close
+            listener = Filter.install!(BPF::Builder.new(Policy.new { notify :getpid }).build)
+            FdPassing.send_fd(child, listener)
+            3.times { Libc::SYSCALL.call(Syscalls.number(:getpid), 0, 0, 0) }
+            exit! 0
+          rescue StandardError
+            exit! 1
           end
+          child.close
+          listener = FdPassing.recv_fd(parent, timeout: 2)
+          result = {
+            continue: probe_response(listener, Constants::SECCOMP_USER_NOTIF_FLAG_CONTINUE),
+            addfd: probe_addfd(listener, source, 0),
+            addfd_send: probe_addfd(listener, source, Constants::SECCOMP_ADDFD_FLAG_SEND)
+          }
+          return result if wait_for_probe(pid).success?
         end
+        {continue: false, addfd: false, addfd_send: false}
+      rescue SystemCallError, EOFError, Timeout::Error
+        terminate_probe(pid)
+        {continue: false, addfd: false, addfd_send: false}
+      ensure
+        listener&.close unless listener&.closed?
+        parent&.close unless parent&.closed?
       end
 
       def probe_install(flags)
@@ -67,30 +80,31 @@ module Seccomp
         parent&.close unless parent&.closed?
       end
 
-      def probe
-        parent, child = UNIXSocket.pair
-        pid = fork do
-          parent.close
-          listener = Filter.install!(BPF::Builder.new(Policy.new { notify :getpid }).build)
-          FdPassing.send_fd(child, listener)
-          Libc::SYSCALL.call(Syscalls.number(:getpid), 0, 0, 0)
-          exit! 0
-        rescue StandardError
-          exit! 1
-        end
-        child.close
-        listener = FdPassing.recv_fd(parent, timeout: 2)
+      def probe_response(listener, flags)
         request = "\0" * Structs::NOTIF_SIZE
         Ioctl.call(listener, Ioctl::NOTIF_RECV, request)
-        yield listener, request
-        status = wait_for_probe(pid)
-        status.success?
-      rescue SystemCallError, EOFError, Timeout::Error
-        terminate_probe(pid)
+        id = request.unpack1("Q<")
+        Ioctl.call(listener, Ioctl::NOTIF_SEND, [id, 0, 0, flags].pack(Structs::RESPONSE_FORMAT))
+        true
+      rescue SystemCallError
+        respond_to_probe(listener, id)
         false
-      ensure
-        listener&.close unless listener&.closed?
-        parent&.close unless parent&.closed?
+      end
+
+      def probe_addfd(listener, source, flags)
+        request = "\0" * Structs::NOTIF_SIZE
+        Ioctl.call(listener, Ioctl::NOTIF_RECV, request)
+        id = request.unpack1("Q<")
+        injected = Ioctl.call(listener, Ioctl::NOTIF_ADDFD, [id, flags, source.fileno, 0, 0].pack(Structs::ADDFD_FORMAT))
+        respond_to_probe(listener, id, injected) if flags.zero?
+        true
+      rescue SystemCallError
+        respond_to_probe(listener, id)
+        false
+      end
+
+      def respond_to_probe(listener, id, value = 0)
+        Ioctl.call(listener, Ioctl::NOTIF_SEND, [id, value, 0, 0].pack(Structs::RESPONSE_FORMAT)) if id
       end
 
       def wait_for_probe(pid)

data/lib/seccomp/notify/filter.rb

@@ -5,7 +5,7 @@ module Seccomp
     module Filter
       module_function
 
-      def install!(program, flags: 0)
+      def install!(program, flags: 0, raw: false)
         unless Libc.prctl(Constants::PR_SET_NO_NEW_PRIVS, 1).zero?
           raise SystemCallError.new("prctl(PR_SET_NO_NEW_PRIVS)", Fiddle.last_error)
         end
@@ -14,7 +14,7 @@ module Seccomp
         fd = Libc.seccomp(Constants::SECCOMP_SET_MODE_FILTER, filter_flags, program.to_sock_fprog)
         raise SystemCallError.new("seccomp(SET_MODE_FILTER)", Fiddle.last_error) if fd.negative?
 
-        IO.for_fd(fd, "r")
+        raw ? fd : IO.for_fd(fd, "r")
       end
     end
   end

data/lib/seccomp/notify/libc.rb

@@ -20,8 +20,7 @@ module Seccomp
       IOCTL = Fiddle::Function.new(
         HANDLE["ioctl"],
         [Fiddle::TYPE_INT, Fiddle::TYPE_LONG, Fiddle::TYPE_VOIDP],
-        Fiddle::TYPE_INT,
-        need_gvl: true
+        Fiddle::TYPE_INT
       )
       POLL = Fiddle::Function.new(
         HANDLE["poll"],
@@ -47,20 +46,29 @@ module Seccomp
       end
 
       def seccomp(operation, flags, buffer = 0)
-        pointer = buffer.is_a?(String) ? Fiddle::Pointer[buffer] : buffer
-        SYSCALL.call(Constants::SYS_SECCOMP.fetch(architecture), operation, flags, pointer.to_i)
+        with_pointer(buffer) do |pointer|
+          SYSCALL.call(Constants::SYS_SECCOMP.fetch(architecture), operation, flags, pointer.to_i)
+        end
+      end
+
+      def tgkill(tgid, tid, signal)
+        result = SYSCALL.call(Constants::SYS_TGKILL.fetch(architecture), tgid, tid, signal)
+        raise SystemCallError.new("tgkill", Fiddle.last_error) if result.negative?
+
+        result
       end
 
       def ioctl(fd, request, buffer)
-        IOCTL.call(fd, request, Fiddle::Pointer[buffer])
+        with_pointer(buffer) { |pointer| IOCTL.call(fd, request, pointer) }
       end
 
       def poll_hup?(fd)
         buffer = [fd, 1, 0].pack("l<s<s<")
-        result = POLL.call(Fiddle::Pointer[buffer], 1, 0)
+        result = with_pointer(buffer) { |pointer| POLL.call(pointer, 1, 0) }
         raise SystemCallError.new("poll", Fiddle.last_error) if result.negative?
 
-        (buffer.unpack1("@6S<") & 0x10).positive?
+        revents = buffer.unpack1("@6S<")
+        (revents & 0x10).positive? && (revents & 0x01).zero?
       end
 
       def notif_sizes
@@ -71,6 +79,15 @@ module Seccomp
         notif, resp, data = buffer.unpack("S<S<S<")
         {notif: notif, resp: resp, data: data}.freeze
       end
+
+      def with_pointer(buffer)
+        return yield buffer unless buffer.is_a?(String)
+
+        pointer = Fiddle::Pointer.malloc(buffer.bytesize)
+        pointer[0, buffer.bytesize] = buffer
+        yield(pointer).tap { buffer.replace(pointer[0, buffer.bytesize]) }
+      end
+      private_class_method :with_pointer
     end
   end
 end

data/lib/seccomp/notify/policy.rb

@@ -3,7 +3,7 @@
 module Seccomp
   module Notify
     class Policy
-      BOOTSTRAP_SYSCALLS = %i[fcntl sendmsg].freeze
+      BOOTSTRAP_SYSCALLS = %i[fcntl].freeze
       ALLOWED_FLAGS = Constants::SECCOMP_FILTER_FLAG_LOG |
         Constants::SECCOMP_FILTER_FLAG_SPEC_ALLOW |
         Constants::SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
@@ -21,6 +21,7 @@ module Seccomp
 
         @flags = flags
         @notifications = []
+        @conditional_notifications = []
         @denials = {}
         deny_io_uring! if deny_io_uring
         instance_eval(&block) if block
@@ -34,6 +35,14 @@ module Seccomp
         @notifications.concat(names.map(&:to_sym))
       end
 
+      # Notifies only when one of the low 32 bits in a syscall argument is set.
+      def notify_if(name, argument:, mask:)
+        raise ArgumentError, "argument must be between 0 and 5" unless (0..5).cover?(argument)
+        raise ArgumentError, "mask must be between 1 and 0xffffffff" unless mask.is_a?(Integer) && (1..0xffff_ffff).cover?(mask)
+
+        @conditional_notifications << [name.to_sym, argument, mask]
+      end
+
       # Rejects syscalls in the kernel without notifying the supervisor.
       # @param names [Array<Symbol>]
       # @param errno [Class, Integer] an Errno class or numeric errno
@@ -69,9 +78,18 @@ module Seccomp
         @notifications.include?(name.to_sym)
       end
 
+      def conditional_notifications(arch)
+        @conditional_notifications.filter_map do |name, argument, mask|
+          [Syscalls.number(name, arch), argument, mask] unless notified?(name) || @denials.key?(name)
+        end
+      end
+
       private
 
       def validate!
+        conflict = (@notifications + @conditional_notifications.map(&:first)).find { |name| @denials.key?(name) }
+        raise InvalidPolicyError, "#{conflict} cannot be both notified and denied" if conflict
+
         invalid_bootstrap = BOOTSTRAP_SYSCALLS.find { |name| notified?(name) || @denials.key?(name) }
         if invalid_bootstrap
           raise InvalidPolicyError, "#{invalid_bootstrap} must be allowed while transferring the listener fd"

data/lib/seccomp/notify/request.rb

@@ -79,6 +79,10 @@ module Seccomp
       # Emulates a successful syscall return.
       # @return [void]
       def allow!(value = 0)
+        unless value.is_a?(Integer) && (-(1 << 63)...(1 << 63)).cover?(value) && !(-Constants::MAX_ERRNO..-1).cover?(value)
+          raise ArgumentError, "value must be a signed 64-bit integer outside the errno range"
+        end
+
         respond!(value:, error: 0, flags: 0)
       end
 
@@ -130,14 +134,20 @@ module Seccomp
 
       def kill!(signal = "KILL")
         ensure_unresponded!
-        Process.kill(signal, @tid)
-        @responded = true
+        signal = Signal.list.fetch(signal.to_s.delete_prefix("SIG")) { raise ArgumentError, "unknown signal: #{signal.inspect}" } unless signal.is_a?(Integer)
+        tgid = Integer(File.read("/proc/#{@tid}/status")[/^Tgid:\s+(\d+)/, 1])
+        Libc.tgkill(tgid, @tid, signal)
+        error!
       end
 
       def mark_pointer_read!
         @pointer_read = true
       end
 
+      def close
+        @memory.close
+      end
+
       private
 
       def validate_id(request, buffer)

data/lib/seccomp/notify/supervisor.rb

@@ -53,9 +53,8 @@ module Seccomp
         @handlers = {}
         @unknown_handler = ->(request) { request.error!(@default_errno) }
         @error_handler = ->(error, _request) { warn("seccomp-notify supervisor: #{error.full_message(highlight: false, order: :top)}") }
-        @memory_cache = {}
-        @memory_cache_mutex = Mutex.new
         @receive_mutex = Mutex.new
+        @state_mutex = Mutex.new
         @stop = false
         @listener_closed = false
       end
@@ -97,19 +96,18 @@ module Seccomp
       def run
         workers = Array.new(@concurrency) { Thread.new { event_loop } }
         status = wait_for_target
-        wait_until_listener_closes if @target_pid && !@stop
-        @stop = true
+        wait_until_listener_closes if @target_pid && !stopped?
+        stop
         workers.each(&:join)
         status
       ensure
-        @stop = true
-        @memory_cache.each_value { |io| io.close unless io.closed? }
+        stop
         @listener.close unless @listener.closed?
         @health_writer&.close unless @health_writer&.closed?
       end
 
       def stop
-        @stop = true
+        @state_mutex.synchronize { @stop = true }
       end
 
       private
@@ -118,7 +116,7 @@ module Seccomp
         return wait_until_listener_closes unless @target_pid
 
         loop do
-          return if @stop
+          return if stopped?
 
           waited = Process.waitpid2(@target_pid, Process::WNOHANG)
           return waited.last if waited
@@ -132,7 +130,8 @@ module Seccomp
 
       def wait_for_non_child
         loop do
-          return if @stop
+          return if stopped?
+          return if target_zombie?
 
           Process.kill(0, @target_pid)
           sleep(@poll_interval)
@@ -141,17 +140,23 @@ module Seccomp
         nil
       end
 
+      def target_zombie?
+        File.read("/proc/#{@target_pid}/stat").match?(/\A\d+ \(.*\) [ZX] /)
+      rescue Errno::ENOENT
+        true
+      end
+
       def wait_until_listener_closes
-        sleep(@poll_interval) until @stop || @listener_closed
+        sleep(@poll_interval) until stopped? || listener_closed?
       end
 
       def event_loop
-        process_one until @stop || @listener_closed
+        process_one until stopped? || listener_closed?
       rescue IOError, Errno::EBADF, Errno::ENOTCONN
-        @stop = true
+        stop
       rescue StandardError => error
         warn("seccomp-notify worker failed: #{error.message}")
-        @stop = true
+        stop
       end
 
       def process_one
@@ -161,13 +166,20 @@ module Seccomp
         dispatch(request)
       rescue Errno::EINTR
         retry
+      rescue Errno::EAGAIN
+        mark_listener_closed if Libc.poll_hup?(@listener.fileno)
+        nil
       rescue Errno::ENOENT
-        @listener_closed = true if Libc.poll_hup?(@listener.fileno)
+        mark_listener_closed if Libc.poll_hup?(@listener.fileno)
         nil
       end
 
       def receive_request
         return unless IO.select([@listener], nil, nil, @poll_interval)
+        if Libc.poll_hup?(@listener.fileno)
+          mark_listener_closed
+          return
+        end
 
         buffer = "\0" * @sizes[:notif]
         Ioctl.call(@listener, Ioctl::NOTIF_RECV, buffer)
@@ -175,8 +187,8 @@ module Seccomp
           buffer,
           listener: @listener,
           sizes: @sizes,
-          memory_cache: @memory_cache,
-          memory_cache_mutex: @memory_cache_mutex,
+          memory_cache: nil,
+          memory_cache_mutex: nil,
           features: @features
         )
       end
@@ -191,7 +203,23 @@ module Seccomp
           warn("seccomp-notify error callback failed: #{callback_error.message}")
         end
       ensure
-        request&.error!(@default_errno) unless request&.responded?
+        begin
+          request&.error!(@default_errno) unless request&.responded?
+        ensure
+          request&.close
+        end
+      end
+
+      def stopped?
+        @state_mutex.synchronize { @stop }
+      end
+
+      def listener_closed?
+        @state_mutex.synchronize { @listener_closed }
+      end
+
+      def mark_listener_closed
+        @state_mutex.synchronize { @listener_closed = true }
       end
     end
   end

data/lib/seccomp/notify/target_memory.rb

@@ -1,18 +1,22 @@
 # frozen_string_literal: true
 
-require "ipaddr"
 require "socket"
+require "ipaddr"
 
 module Seccomp
   module Notify
     class TargetMemory
       PAGE_SIZE = 4096
+      SOCKADDR_STORAGE_SIZE = 128
 
-      def initialize(listener, request, cache, cache_mutex = Mutex.new)
+      def initialize(listener, request, _cache = nil, _cache_mutex = nil)
         @listener = listener
         @request = request
-        @cache = cache
-        @cache_mutex = cache_mutex
+        @memory = nil
+      end
+
+      def close
+        @memory&.close unless @memory&.closed?
       end
 
       def read(address, length)
@@ -24,7 +28,7 @@ module Seccomp
 
         @request.mark_pointer_read!
         data
-      rescue Errno::EIO, Errno::EFAULT, Errno::ENOENT, Errno::EACCES => error
+      rescue EOFError, Errno::EIO, Errno::EFAULT, Errno::ENOENT, Errno::EACCES => error
         raise MemoryReadError, error.message
       end
 
@@ -45,18 +49,22 @@ module Seccomp
 
       def read_sockaddr(address, length)
         raise MemoryReadError, "sockaddr is shorter than sa_family" if length < 2
+        raise MemoryReadError, "sockaddr is longer than sockaddr_storage" if length > SOCKADDR_STORAGE_SIZE
 
         bytes = read(address, length)
         case bytes.unpack1("S<")
         when Socket::AF_INET
           raise MemoryReadError, "short AF_INET sockaddr" if length < 16
-          Addrinfo.tcp(IPAddr.ntop(bytes.byteslice(4, 4)), bytes.byteslice(2, 2).unpack1("n"))
+          port = bytes.unpack1("@2n")
+          host = IPAddr.ntop(bytes.byteslice(4, 4))
+          Addrinfo.new(Socket.sockaddr_in(port, host), Socket::AF_INET, 0, 0)
         when Socket::AF_INET6
           raise MemoryReadError, "short AF_INET6 sockaddr" if length < 28
-          address = IPAddr.ntop(bytes.byteslice(8, 16))
-          scope = bytes.byteslice(24, 4).unpack1("L<")
-          address = "#{address}%#{scope}" unless scope.zero?
-          Addrinfo.tcp(address, bytes.byteslice(2, 2).unpack1("n"))
+          port = bytes.unpack1("@2n")
+          host = IPAddr.ntop(bytes.byteslice(8, 16))
+          scope = bytes.unpack1("@24L<")
+          host = "#{host}%#{scope}" unless scope.zero?
+          Addrinfo.new(Socket.sockaddr_in(port, host), Socket::AF_INET6, 0, 0)
         when Socket::AF_UNIX
           raw_path = bytes.byteslice(2..).to_s
           path = raw_path.start_with?("\0") ? raw_path : raw_path.split("\0", 2).first
@@ -69,9 +77,7 @@ module Seccomp
       private
 
       def memory
-        @cache[@request.tid] || @cache_mutex.synchronize do
-          @cache[@request.tid] ||= File.open("/proc/#{@request.tid}/mem", File::RDONLY)
-        end
+        @memory ||= File.open("/proc/#{@request.tid}/mem", File::RDONLY)
       end
     end
   end

data/lib/seccomp/notify/version.rb

@@ -2,6 +2,6 @@
 
 module Seccomp
   module Notify
-    VERSION = "0.1.0"
+    VERSION = "0.3.0"
   end
 end

data/lib/seccomp/notify.rb

@@ -62,16 +62,17 @@ module Seccomp
           raise ArgumentError, "recv_timeout must be positive"
         end
 
-        program, install_flags = prepare_supervision(policy, supervisor_options)
         parent_socket, child_socket = UNIXSocket.pair
+        program, install_flags = prepare_supervision(policy, supervisor_options, transfer_fd: child_socket.fileno)
         health_reader, health_writer = IO.pipe
         pid = fork do
           parent_socket.close
           health_writer.close
           keep_health_reader(health_reader)
-          listener = Filter.install!(program, flags: install_flags)
-          FdPassing.send_fd(child_socket, listener)
-          child_socket.close
+          listener_fd = Filter.install!(program, flags: install_flags, raw: true)
+          FdPassing.send_fd(child_socket, listener_fd)
+          keep_transfer_socket(child_socket)
+          listener = IO.for_fd(listener_fd, "r")
           listener.close
           target.call
           exit! 0
@@ -102,11 +103,11 @@ module Seccomp
         raise ArgumentError, "supervisor must be :spawn or :fork" unless %i[spawn fork].include?(supervisor)
         raise ArgumentError, "supervisor: :spawn does not support Ruby handler blocks" if supervisor == :spawn && configure
 
-        program, install_flags = prepare_supervision(policy, options)
         selected_features = options.fetch(:features, features)
         raise NotSupportedError, "supervise_self requires CONTINUE when no handler block is given" if !configure && !selected_features[:continue]
 
         parent_socket, supervisor_socket = UNIXSocket.pair
+        program, install_flags = prepare_supervision(policy, options, transfer_fd: parent_socket.fileno)
         health_reader, health_writer = IO.pipe
         target_pid = Process.pid
         supervisor_pid = case supervisor
@@ -119,10 +120,11 @@ module Seccomp
         supervisor_socket.close
         health_writer.close
         keep_health_reader(health_reader)
-        listener = Filter.install!(program, flags: install_flags)
-        FdPassing.send_fd(parent_socket, listener)
+        listener_fd = Filter.install!(program, flags: install_flags, raw: true)
+        FdPassing.send_fd(parent_socket, listener_fd)
+        keep_transfer_socket(parent_socket)
+        listener = IO.for_fd(listener_fd, "r")
         listener.close
-        parent_socket.close
         Process.detach(supervisor_pid)
         supervisor_pid
       rescue StandardError
@@ -175,14 +177,14 @@ module Seccomp
         )
       end
 
-      def prepare_supervision(policy, options)
+      def prepare_supervision(policy, options, transfer_fd: nil)
         Supervisor.validate_options!(options)
         sizes = notif_sizes
         raise NotSupportedError, "unsupported kernel notification sizes: #{sizes.inspect}" unless sizes == Supervisor::EXPECTED_SIZES
 
         selected_features = options.fetch(:features, features)
         optional_flags = selected_features[:wait_killable_recv] ? Constants::SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV : 0
-        [BPF::Builder.new(policy).build, policy.flags | optional_flags]
+        [BPF::Builder.new(policy, transfer_fd:).build, policy.flags | optional_flags]
       end
 
       def keep_health_reader(reader)
@@ -191,6 +193,11 @@ module Seccomp
         @supervisor_health_reader = reader
       end
 
+      def keep_transfer_socket(socket)
+        socket.close_on_exec = false
+        @listener_transfer_socket = socket
+      end
+
       def supervisor_health_reader
         return @supervisor_health_reader if defined?(@supervisor_health_reader)
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: seccomp-notify
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Yudai Takada
@@ -60,12 +60,12 @@ files:
 - lib/seccomp/notify/version.rb
 - spike/notify_min.c
 - tools/gen_syscall_table.rb
-homepage: https://rubygems.org/gems/seccomp-notify
+homepage: https://ydah.github.io/seccomp-notify/
 licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-  homepage_uri: https://rubygems.org/gems/seccomp-notify
+  homepage_uri: https://ydah.github.io/seccomp-notify/
 rdoc_options: []
 require_paths:
 - lib
@@ -80,7 +80,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.19
 specification_version: 4
 summary: Pure Ruby bindings for Linux seccomp user notifications
 test_files: []