seccomp-notify 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ace169c2d9c0677fc63afda27695ec1afcf8dbfa2ee0b7e935690ee1b48c9c13
-  data.tar.gz: 159c4ea512b51d37cef181ba13cfc95b176b7ad5044ab1131cdc626ac281f419
+  metadata.gz: 1338763ff6ac458c1224576b7763524b57034de1b29423acc2dde48268012dd1
+  data.tar.gz: 03dc39b44de12c7bb1401edc303097eb02b389c511e040589c2293cb840d2c41
 SHA512:
-  metadata.gz: 6875777a81e6507e7ea582ecfe3078b193c9dda9a896e424112e1976c3ee6bd9e943f41294bed8dd49e50cb2a8aa91f9560c3093ad49700402b154c4c1af627b
-  data.tar.gz: 0cb483dd0df1793bf30df385c73bd14daf2c30ed81dabcbe714e8ecdbc56c84308386b9c277145c206bc2543465370ec080b11e8ebefdc39d048aab8c56e4133
+  metadata.gz: 9c99782a7d1c9bf43d3069aa1f742f1c3f5e33b40a47014c6e5a3d4803062b8d8239e2df8a915583d056a4441ed438deebde1ad1cc8af9e1a1bdd8b5f95e333f
+  data.tar.gz: dd0f9b82f5749bdeb933e6e56c616619f150fadbb9742582f03ef32ff8d8401e7732dff4070b7a0860abcd6bb42ed537047cda119fa314891c99ab51af0bbd4e

data/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to seccomp-notify are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and versions follow [Semantic Versioning](https://semver.org/).
 
+## v0.3.0 - 2026-08-24
+
+- Kill the issuing thread group without treating a thread ID as a process ID.
+- Keep the listener transfer descriptor reserved so later `sendmsg` calls cannot bypass policy.
+- Reject x32 syscalls, conflicting policy actions, and invalid emulated return values.
+- Preserve the protocol-neutral type of decoded socket addresses.
+- Marshal ioctl and seccomp buffers through native memory for compacting-GC safety.
+- Reduce runtime feature detection from four isolated child probes to two and synchronize supervisor shutdown state.
+
 ## v0.2.0 - 2026-08-22
 
 - Stop supervising a non-child target once it becomes a zombie.

data/README.md

@@ -102,7 +102,8 @@ syscall, not the process ID.
 `supervise_self(policy, supervisor: :fork)` accepts a block that configures the child supervisor.
 The safer `:spawn` form starts a clean Ruby VM and supports the default pass-through handler only.
 Both forms detach the supervisor child, so broad `Process.wait` calls in the target can still
-observe related lifecycle effects.
+observe related lifecycle effects. The default pass-through handler requires `continue!` and Linux
+5.5 or newer; handler-based supervision works on Linux 5.0 or newer.
 
 ## Responses
 
@@ -137,8 +138,9 @@ If the target calls `exec`, the pipe descriptor is inherited and published as
 - I/O submitted through an existing `io_uring` does not pass through the filter;
   `io_uring_setup` is denied by default.
 - If the supervisor dies, blocked notification syscalls return `ENOSYS`.
-- `fcntl` and `sendmsg` must remain allowed because Ruby uses them to wrap and transfer the listener
-  descriptor. Policies that notify or deny them are rejected.
+- `fcntl` must remain allowed while Ruby wraps the listener descriptor, so policies that notify or
+  deny it are rejected. `sendmsg` may be filtered; only listener transfer on its reserved descriptor
+  is allowed, and that descriptor remains open across `exec` to prevent fd-number reuse.
 
 ## Examples
 

data/lib/seccomp/notify/bpf/builder.rb

@@ -32,12 +32,17 @@ module Seccomp
         private
 
         def prologue
-          [
+          instructions = [
             ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_ARCH),
             ins(Constants::BPF_JMP_JEQ_K, 1, 0, AUDIT_ARCHES.fetch(@arch)),
             ins(Constants::BPF_RET_K, 0, 0, Constants::SECCOMP_RET_KILL_PROCESS),
             ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_NR)
           ]
+          if @arch == :x86_64
+            instructions << ins(Constants::BPF_JMP_JGE_K, 0, 1, Constants::X32_SYSCALL_BIT)
+            instructions << ins(Constants::BPF_RET_K, 0, 0, Constants::SECCOMP_RET_KILL_PROCESS)
+          end
+          instructions
         end
 
         def linear(decisions)

data/lib/seccomp/notify/constants.rb

@@ -32,7 +32,9 @@ module Seccomp
       AUDIT_ARCH_X86_64 = 0xc000_003e
       AUDIT_ARCH_AARCH64 = 0xc000_00b7
       AUDIT_ARCH_I386 = 0x4000_0003
+      X32_SYSCALL_BIT = 0x4000_0000
       SYS_SECCOMP = {x86_64: 317, aarch64: 277}.freeze
+      SYS_TGKILL = {x86_64: 234, aarch64: 131}.freeze
 
       PR_SET_NO_NEW_PRIVS = 38
       PR_SET_PTRACER = 0x5961_6d61

data/lib/seccomp/notify/features.rb

@@ -12,9 +12,7 @@ module Seccomp
         result = {user_notif: supported?, continue: false, addfd: false, addfd_send: false, wait_killable_recv: false}
         return result.freeze unless result[:user_notif]
 
-        result[:continue] = probe_response(Constants::SECCOMP_USER_NOTIF_FLAG_CONTINUE)
-        result[:addfd] = probe_addfd(0)
-        result[:addfd_send] = probe_addfd(Constants::SECCOMP_ADDFD_FLAG_SEND)
+        result.update(probe_responses)
         result[:wait_killable_recv] = probe_install(Constants::SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV)
         disabled.each { |name| result[name.to_sym] = false if result.key?(name.to_sym) }
         result[:addfd_send] = false unless result[:addfd]
@@ -28,21 +26,36 @@ module Seccomp
         false
       end
 
-      def probe_response(flags)
-        probe do |listener, request|
-          response = [request.unpack1("Q<"), 0, 0, flags].pack(Structs::RESPONSE_FORMAT)
-          Ioctl.call(listener, Ioctl::NOTIF_SEND, response)
-        end
-      end
-
-      def probe_addfd(flags)
+      def probe_responses
+        parent, child = UNIXSocket.pair
+        listener = nil
+        pid = nil
         File.open("/dev/null") do |source|
-          probe do |listener, request|
-            id = request.unpack1("Q<")
-            injected = Ioctl.call(listener, Ioctl::NOTIF_ADDFD, [id, flags, source.fileno, 0, 0].pack(Structs::ADDFD_FORMAT))
-            Ioctl.call(listener, Ioctl::NOTIF_SEND, [id, injected, 0, 0].pack(Structs::RESPONSE_FORMAT)) if flags.zero?
+          pid = fork do
+            parent.close
+            listener = Filter.install!(BPF::Builder.new(Policy.new { notify :getpid }).build)
+            FdPassing.send_fd(child, listener)
+            3.times { Libc::SYSCALL.call(Syscalls.number(:getpid), 0, 0, 0) }
+            exit! 0
+          rescue StandardError
+            exit! 1
           end
+          child.close
+          listener = FdPassing.recv_fd(parent, timeout: 2)
+          result = {
+            continue: probe_response(listener, Constants::SECCOMP_USER_NOTIF_FLAG_CONTINUE),
+            addfd: probe_addfd(listener, source, 0),
+            addfd_send: probe_addfd(listener, source, Constants::SECCOMP_ADDFD_FLAG_SEND)
+          }
+          return result if wait_for_probe(pid).success?
         end
+        {continue: false, addfd: false, addfd_send: false}
+      rescue SystemCallError, EOFError, Timeout::Error
+        terminate_probe(pid)
+        {continue: false, addfd: false, addfd_send: false}
+      ensure
+        listener&.close unless listener&.closed?
+        parent&.close unless parent&.closed?
       end
 
       def probe_install(flags)
@@ -67,30 +80,31 @@ module Seccomp
         parent&.close unless parent&.closed?
       end
 
-      def probe
-        parent, child = UNIXSocket.pair
-        pid = fork do
-          parent.close
-          listener = Filter.install!(BPF::Builder.new(Policy.new { notify :getpid }).build)
-          FdPassing.send_fd(child, listener)
-          Libc::SYSCALL.call(Syscalls.number(:getpid), 0, 0, 0)
-          exit! 0
-        rescue StandardError
-          exit! 1
-        end
-        child.close
-        listener = FdPassing.recv_fd(parent, timeout: 2)
+      def probe_response(listener, flags)
         request = "\0" * Structs::NOTIF_SIZE
         Ioctl.call(listener, Ioctl::NOTIF_RECV, request)
-        yield listener, request
-        status = wait_for_probe(pid)
-        status.success?
-      rescue SystemCallError, EOFError, Timeout::Error
-        terminate_probe(pid)
+        id = request.unpack1("Q<")
+        Ioctl.call(listener, Ioctl::NOTIF_SEND, [id, 0, 0, flags].pack(Structs::RESPONSE_FORMAT))
+        true
+      rescue SystemCallError
+        respond_to_probe(listener, id)
         false
-      ensure
-        listener&.close unless listener&.closed?
-        parent&.close unless parent&.closed?
+      end
+
+      def probe_addfd(listener, source, flags)
+        request = "\0" * Structs::NOTIF_SIZE
+        Ioctl.call(listener, Ioctl::NOTIF_RECV, request)
+        id = request.unpack1("Q<")
+        injected = Ioctl.call(listener, Ioctl::NOTIF_ADDFD, [id, flags, source.fileno, 0, 0].pack(Structs::ADDFD_FORMAT))
+        respond_to_probe(listener, id, injected) if flags.zero?
+        true
+      rescue SystemCallError
+        respond_to_probe(listener, id)
+        false
+      end
+
+      def respond_to_probe(listener, id, value = 0)
+        Ioctl.call(listener, Ioctl::NOTIF_SEND, [id, value, 0, 0].pack(Structs::RESPONSE_FORMAT)) if id
       end
 
       def wait_for_probe(pid)

data/lib/seccomp/notify/libc.rb

@@ -46,17 +46,25 @@ module Seccomp
       end
 
       def seccomp(operation, flags, buffer = 0)
-        pointer = buffer.is_a?(String) ? Fiddle::Pointer[buffer] : buffer
-        SYSCALL.call(Constants::SYS_SECCOMP.fetch(architecture), operation, flags, pointer.to_i)
+        with_pointer(buffer) do |pointer|
+          SYSCALL.call(Constants::SYS_SECCOMP.fetch(architecture), operation, flags, pointer.to_i)
+        end
+      end
+
+      def tgkill(tgid, tid, signal)
+        result = SYSCALL.call(Constants::SYS_TGKILL.fetch(architecture), tgid, tid, signal)
+        raise SystemCallError.new("tgkill", Fiddle.last_error) if result.negative?
+
+        result
       end
 
       def ioctl(fd, request, buffer)
-        IOCTL.call(fd, request, Fiddle::Pointer[buffer])
+        with_pointer(buffer) { |pointer| IOCTL.call(fd, request, pointer) }
       end
 
       def poll_hup?(fd)
         buffer = [fd, 1, 0].pack("l<s<s<")
-        result = POLL.call(Fiddle::Pointer[buffer], 1, 0)
+        result = with_pointer(buffer) { |pointer| POLL.call(pointer, 1, 0) }
         raise SystemCallError.new("poll", Fiddle.last_error) if result.negative?
 
         revents = buffer.unpack1("@6S<")
@@ -71,6 +79,15 @@ module Seccomp
         notif, resp, data = buffer.unpack("S<S<S<")
         {notif: notif, resp: resp, data: data}.freeze
       end
+
+      def with_pointer(buffer)
+        return yield buffer unless buffer.is_a?(String)
+
+        pointer = Fiddle::Pointer.malloc(buffer.bytesize)
+        pointer[0, buffer.bytesize] = buffer
+        yield(pointer).tap { buffer.replace(pointer[0, buffer.bytesize]) }
+      end
+      private_class_method :with_pointer
     end
   end
 end

data/lib/seccomp/notify/policy.rb

@@ -87,6 +87,9 @@ module Seccomp
       private
 
       def validate!
+        conflict = (@notifications + @conditional_notifications.map(&:first)).find { |name| @denials.key?(name) }
+        raise InvalidPolicyError, "#{conflict} cannot be both notified and denied" if conflict
+
         invalid_bootstrap = BOOTSTRAP_SYSCALLS.find { |name| notified?(name) || @denials.key?(name) }
         if invalid_bootstrap
           raise InvalidPolicyError, "#{invalid_bootstrap} must be allowed while transferring the listener fd"

data/lib/seccomp/notify/request.rb

@@ -79,6 +79,10 @@ module Seccomp
       # Emulates a successful syscall return.
       # @return [void]
       def allow!(value = 0)
+        unless value.is_a?(Integer) && (-(1 << 63)...(1 << 63)).cover?(value) && !(-Constants::MAX_ERRNO..-1).cover?(value)
+          raise ArgumentError, "value must be a signed 64-bit integer outside the errno range"
+        end
+
         respond!(value:, error: 0, flags: 0)
       end
 
@@ -130,8 +134,10 @@ module Seccomp
 
       def kill!(signal = "KILL")
         ensure_unresponded!
-        Process.kill(signal, @tid)
-        @responded = true
+        signal = Signal.list.fetch(signal.to_s.delete_prefix("SIG")) { raise ArgumentError, "unknown signal: #{signal.inspect}" } unless signal.is_a?(Integer)
+        tgid = Integer(File.read("/proc/#{@tid}/status")[/^Tgid:\s+(\d+)/, 1])
+        Libc.tgkill(tgid, @tid, signal)
+        error!
       end
 
       def mark_pointer_read!

data/lib/seccomp/notify/supervisor.rb

@@ -54,6 +54,7 @@ module Seccomp
         @unknown_handler = ->(request) { request.error!(@default_errno) }
         @error_handler = ->(error, _request) { warn("seccomp-notify supervisor: #{error.full_message(highlight: false, order: :top)}") }
         @receive_mutex = Mutex.new
+        @state_mutex = Mutex.new
         @stop = false
         @listener_closed = false
       end
@@ -95,18 +96,18 @@ module Seccomp
       def run
         workers = Array.new(@concurrency) { Thread.new { event_loop } }
         status = wait_for_target
-        wait_until_listener_closes if @target_pid && !@stop
-        @stop = true
+        wait_until_listener_closes if @target_pid && !stopped?
+        stop
         workers.each(&:join)
         status
       ensure
-        @stop = true
+        stop
         @listener.close unless @listener.closed?
         @health_writer&.close unless @health_writer&.closed?
       end
 
       def stop
-        @stop = true
+        @state_mutex.synchronize { @stop = true }
       end
 
       private
@@ -115,7 +116,7 @@ module Seccomp
         return wait_until_listener_closes unless @target_pid
 
         loop do
-          return if @stop
+          return if stopped?
 
           waited = Process.waitpid2(@target_pid, Process::WNOHANG)
           return waited.last if waited
@@ -129,7 +130,7 @@ module Seccomp
 
       def wait_for_non_child
         loop do
-          return if @stop
+          return if stopped?
           return if target_zombie?
 
           Process.kill(0, @target_pid)
@@ -146,16 +147,16 @@ module Seccomp
       end
 
       def wait_until_listener_closes
-        sleep(@poll_interval) until @stop || @listener_closed
+        sleep(@poll_interval) until stopped? || listener_closed?
       end
 
       def event_loop
-        process_one until @stop || @listener_closed
+        process_one until stopped? || listener_closed?
       rescue IOError, Errno::EBADF, Errno::ENOTCONN
-        @stop = true
+        stop
       rescue StandardError => error
         warn("seccomp-notify worker failed: #{error.message}")
-        @stop = true
+        stop
       end
 
       def process_one
@@ -166,17 +167,17 @@ module Seccomp
       rescue Errno::EINTR
         retry
       rescue Errno::EAGAIN
-        @listener_closed = true if Libc.poll_hup?(@listener.fileno)
+        mark_listener_closed if Libc.poll_hup?(@listener.fileno)
         nil
       rescue Errno::ENOENT
-        @listener_closed = true if Libc.poll_hup?(@listener.fileno)
+        mark_listener_closed if Libc.poll_hup?(@listener.fileno)
         nil
       end
 
       def receive_request
         return unless IO.select([@listener], nil, nil, @poll_interval)
         if Libc.poll_hup?(@listener.fileno)
-          @listener_closed = true
+          mark_listener_closed
           return
         end
 
@@ -208,6 +209,18 @@ module Seccomp
           request&.close
         end
       end
+
+      def stopped?
+        @state_mutex.synchronize { @stop }
+      end
+
+      def listener_closed?
+        @state_mutex.synchronize { @listener_closed }
+      end
+
+      def mark_listener_closed
+        @state_mutex.synchronize { @listener_closed = true }
+      end
     end
   end
 end

data/lib/seccomp/notify/target_memory.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require "ipaddr"
 require "socket"
+require "ipaddr"
 
 module Seccomp
   module Notify
@@ -55,13 +55,16 @@ module Seccomp
         case bytes.unpack1("S<")
         when Socket::AF_INET
           raise MemoryReadError, "short AF_INET sockaddr" if length < 16
-          Addrinfo.tcp(IPAddr.ntop(bytes.byteslice(4, 4)), bytes.byteslice(2, 2).unpack1("n"))
+          port = bytes.unpack1("@2n")
+          host = IPAddr.ntop(bytes.byteslice(4, 4))
+          Addrinfo.new(Socket.sockaddr_in(port, host), Socket::AF_INET, 0, 0)
         when Socket::AF_INET6
           raise MemoryReadError, "short AF_INET6 sockaddr" if length < 28
-          address = IPAddr.ntop(bytes.byteslice(8, 16))
-          scope = bytes.byteslice(24, 4).unpack1("L<")
-          address = "#{address}%#{scope}" unless scope.zero?
-          Addrinfo.tcp(address, bytes.byteslice(2, 2).unpack1("n"))
+          port = bytes.unpack1("@2n")
+          host = IPAddr.ntop(bytes.byteslice(8, 16))
+          scope = bytes.unpack1("@24L<")
+          host = "#{host}%#{scope}" unless scope.zero?
+          Addrinfo.new(Socket.sockaddr_in(port, host), Socket::AF_INET6, 0, 0)
         when Socket::AF_UNIX
           raw_path = bytes.byteslice(2..).to_s
           path = raw_path.start_with?("\0") ? raw_path : raw_path.split("\0", 2).first

data/lib/seccomp/notify/version.rb

@@ -2,6 +2,6 @@
 
 module Seccomp
   module Notify
-    VERSION = "0.2.0"
+    VERSION = "0.3.0"
   end
 end

data/lib/seccomp/notify.rb

@@ -71,8 +71,8 @@ module Seccomp
           keep_health_reader(health_reader)
           listener_fd = Filter.install!(program, flags: install_flags, raw: true)
           FdPassing.send_fd(child_socket, listener_fd)
+          keep_transfer_socket(child_socket)
           listener = IO.for_fd(listener_fd, "r")
-          child_socket.close
           listener.close
           target.call
           exit! 0
@@ -122,9 +122,9 @@ module Seccomp
         keep_health_reader(health_reader)
         listener_fd = Filter.install!(program, flags: install_flags, raw: true)
         FdPassing.send_fd(parent_socket, listener_fd)
+        keep_transfer_socket(parent_socket)
         listener = IO.for_fd(listener_fd, "r")
         listener.close
-        parent_socket.close
         Process.detach(supervisor_pid)
         supervisor_pid
       rescue StandardError
@@ -193,6 +193,11 @@ module Seccomp
         @supervisor_health_reader = reader
       end
 
+      def keep_transfer_socket(socket)
+        socket.close_on_exec = false
+        @listener_transfer_socket = socket
+      end
+
       def supervisor_health_reader
         return @supervisor_health_reader if defined?(@supervisor_health_reader)
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: seccomp-notify
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Yudai Takada