seccomp-notify 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4348459a8a4722dfdc17dcf0acf21b0e7802f6b9b5fe80e1821d9cb1964d7802
-  data.tar.gz: 3d8776d6b56396439b30b17897eb862dde5fbe8c591ce3e58d62a1c928c90e72
+  metadata.gz: ace169c2d9c0677fc63afda27695ec1afcf8dbfa2ee0b7e935690ee1b48c9c13
+  data.tar.gz: 159c4ea512b51d37cef181ba13cfc95b176b7ad5044ab1131cdc626ac281f419
 SHA512:
-  metadata.gz: b3c6841b95077468dea06d50250d91f660386cf21e33240bcf270b07b7f7efabe6e890a0ee1e6ca22d6492d9cb6837b1cd25954c4eb93d195c77a4ce025221ac
-  data.tar.gz: 63d5fdf903dc3541c9ded5eb90deb66de7ea4171304b375f6228aae690462816cd5880eef05de9d27df95bb843fb84c573e89b6ffc718cee50c2e693827ff731
+  metadata.gz: 6875777a81e6507e7ea582ecfe3078b193c9dda9a896e424112e1976c3ee6bd9e943f41294bed8dd49e50cb2a8aa91f9560c3093ad49700402b154c4c1af627b
+  data.tar.gz: 0cb483dd0df1793bf30df385c73bd14daf2c30ed81dabcbe714e8ecdbc56c84308386b9c277145c206bc2543465370ec080b11e8ebefdc39d048aab8c56e4133

data/CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to seccomp-notify are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and versions follow [Semantic Versioning](https://semver.org/).
 
+## v0.2.0 - 2026-08-22
+
+- Stop supervising a non-child target once it becomes a zombie.
+- Read target memory from the current address space after `exec` and normalize EOF failures.
+
 ## v0.1.0 - 2026-08-22
 
 - Initial release

data/README.md

@@ -1,82 +1,169 @@
-# seccomp-notify
-
-Pure Ruby plumbing for Linux [`SECCOMP_RET_USER_NOTIF`](https://www.kernel.org/doc/html/latest/userspace-api/seccomp_filter.html). It builds cBPF filters, transfers listener file descriptors, supervises notifications, reads target memory, and injects file descriptors without a native extension.
+<h1 align="center">seccomp-notify</h1>
+
+<p align="center">
+  <strong>Pure Ruby bindings for Linux seccomp user notifications</strong>
+</p>
+
+<p align="center">
+  <a href="https://rubygems.org/gems/seccomp-notify"><img src="https://img.shields.io/gem/v/seccomp-notify.svg?colorB=319e8c" alt="Gem Version"></a>
+  <a href="https://rubygems.org/gems/seccomp-notify"><img src="https://img.shields.io/gem/dt/seccomp-notify.svg" alt="Downloads"></a>
+  <img src="https://img.shields.io/badge/ruby-%3E%3D%203.1-ruby.svg" alt="Ruby Version">
+  <img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License">
+</p>
+
+<p align="center">
+  <a href="#features">Features</a> ·
+  <a href="#installation">Installation</a> ·
+  <a href="#quick-start">Quick Start</a> ·
+  <a href="https://ydah.github.io/seccomp-notify/">API Docs</a> ·
+  <a href="#responses">Responses</a> ·
+  <a href="#security">Security</a> ·
+  <a href="#development">Development</a>
+</p>
+
+---
+
+`seccomp-notify` provides the plumbing for Linux
+[`SECCOMP_RET_USER_NOTIF`](https://www.kernel.org/doc/html/latest/userspace-api/seccomp_filter.html).
+It builds cBPF filters, transfers listener file descriptors, supervises syscall notifications,
+reads target memory, and injects file descriptors without a native extension.
 
 > [!WARNING]
-> This gem is a mechanism, not a security policy or a complete sandbox. Never inspect a pointer argument and then use `continue!` as a security decision: another target thread can change that memory between inspection and syscall execution (TOCTOU). Reject the syscall or emulate it instead.
+> This gem is a mechanism, not a security policy or a complete sandbox. Never inspect a pointer
+> argument and then use `continue!` as a security decision: another target thread can change that
+> memory between inspection and syscall execution (TOCTOU). Reject or emulate the syscall instead.
+
+## Features
+
+- Pure Ruby cBPF filter generation and seccomp installation
+- Parent supervisor with a filtered child through `Seccomp::Notify.spawn`
+- Existing-process supervision through `Seccomp::Notify.supervise_self`
+- Syscall handlers with errno, emulation, continuation, and process termination responses
+- Target memory helpers for strings, bytes, and socket addresses
+- File descriptor injection with atomic and fallback ADDFD paths
+- Runtime detection for optional kernel features
+- Handler timeouts, concurrent workers, and supervisor health checks
+- Linux x86_64 and aarch64 support
 
-Seccomp cannot intercept vDSO calls, I/O submitted through an existing `io_uring`, operations on already-open file descriptors, or indirect shared-memory effects. `io_uring_setup` is denied by default. If the supervisor dies, blocked notification syscalls return `ENOSYS`.
+## Installation
 
-`fcntl` and `sendmsg` must remain allowed because Ruby uses them to wrap and transfer the listener fd; policies that try to notify or deny them are rejected.
+Add the gem to your Gemfile:
 
-## Requirements
+```ruby
+gem "seccomp-notify"
+```
+
+Then install:
+
+```sh
+bundle install
+```
+
+### Requirements
 
 - Linux on x86_64 or aarch64
 - Ruby 3.1 or newer
-- Linux 5.0 or newer; ADDFD needs 5.9 or newer
+- Linux 5.0 or newer; ADDFD requires Linux 5.9 or newer
 - `CONFIG_SECCOMP_FILTER=y`
 
-Container runtimes may block `seccomp(2)` with their own profile. For Docker development, use an isolated test container with:
+Container runtimes may block `seccomp(2)` with their own profile. For Docker development, use an
+isolated test container with seccomp disabled:
 
 ```sh
 docker run --rm --security-opt seccomp=unconfined -v "$PWD:/app" -w /app ruby:3.4 bundle exec rake
 ```
 
-## Installation
-
-```ruby
-gem "seccomp-notify"
-```
-
-## Usage
+## Quick Start
 
-The recommended shape keeps the unfiltered supervisor in the parent and installs the filter in a child:
+Keep the unfiltered supervisor in the parent and install the filter in a child:
 
 ```ruby
 require "seccomp/notify"
 
-open_syscalls = RUBY_PLATFORM.include?("x86_64") ? %i[open openat] : %i[openat]
 policy = Seccomp::Notify::Policy.new do
-  notify(*open_syscalls, :connect)
+  notify :connect, :sendto
 end
 
 supervisor = Seccomp::Notify.spawn(policy) do
-  exec("bundle", "install")
+  exec("curl", "https://example.com")
 end
 
-open_handler = proc do |request|
-  path_argument = request.syscall == :open ? 0 : 1
-  path = request.read_string(request.args[path_argument])
-  if path == "/etc/shadow"
-    request.error!(Errno::EACCES)
-  else
-    request.continue!(unsafe: true)
-  end
-end
-open_syscalls.each { |syscall| supervisor.on(syscall, &open_handler) }
-
 supervisor.on(:connect) { |request| request.error!(Errno::ENETUNREACH) }
+supervisor.on(:sendto) { |request| request.error!(Errno::ENETUNREACH) }
+
 status = supervisor.run
 ```
 
-`request.pid` is an alias for `request.tid`: the kernel reports the thread ID that issued the syscall, not the process ID.
+`request.pid` is an alias for `request.tid`: the kernel reports the thread ID that issued the
+syscall, not the process ID.
+
+### Supervise the current process
+
+`supervise_self(policy, supervisor: :fork)` accepts a block that configures the child supervisor.
+The safer `:spawn` form starts a clean Ruby VM and supports the default pass-through handler only.
+Both forms detach the supervisor child, so broad `Process.wait` calls in the target can still
+observe related lifecycle effects.
+
+## Responses
+
+| Method | Behavior | Requirement |
+|--------|----------|-------------|
+| `allow!(value = 0)` | Emulate a successful return value without running the syscall | Linux 5.0+ |
+| `error!(Errno::EPERM)` | Return an errno | Linux 5.0+ |
+| `continue!` | Run the original syscall | Linux 5.5+ |
+| `add_fd!(io)` | Inject a file descriptor and return its number | Linux 5.9+ |
+| `kill!` | Terminate the issuing process | — |
+
+Use `Seccomp::Notify.features` to inspect runtime support. Set
+`SECCOMP_NOTIFY_DISABLE_FEATURES=addfd,continue` to force feature fallbacks in tests.
+
+Targets started by this gem can call `Seccomp::Notify.supervisor_alive?` to poll the health pipe.
+If the target calls `exec`, the pipe descriptor is inherited and published as
+`SECCOMP_NOTIFY_HEALTH_FD`.
 
-`supervise_self(policy, supervisor: :fork)` accepts a block that configures the child supervisor. The safer `:spawn` form starts a clean Ruby VM and therefore supports only the default pass-through handler. Both forms detach the supervisor child, so broad `Process.wait` calls in the target can still observe related lifecycle effects.
+## How It Works
 
-## Responses and features
+1. The parent creates a Unix socket pair and forks the target.
+2. The target installs a cBPF filter and sends its listener descriptor to the parent with
+   `SCM_RIGHTS`.
+3. The parent receives syscall notifications and dispatches them to registered handlers.
+4. Each handler returns an errno, emulated value, continuation, or injected descriptor.
 
-- `allow!(value = 0)` emulates a successful return value without executing the syscall.
-- `error!(Errno::EPERM)` returns an errno.
-- `continue!` executes the original syscall when supported.
-- `add_fd!(io)` injects a file descriptor when supported.
-- `kill!` terminates the issuing task.
+## Security
 
-Use `Seccomp::Notify.features` to inspect runtime support. Set `SECCOMP_NOTIFY_DISABLE_FEATURES=addfd,continue` to force feature fallbacks in tests.
+- Pointer data may change after inspection. Never use it to justify `continue!`.
+- vDSO calls, existing file descriptors, and indirect shared-memory effects are outside seccomp's
+  control.
+- I/O submitted through an existing `io_uring` does not pass through the filter;
+  `io_uring_setup` is denied by default.
+- If the supervisor dies, blocked notification syscalls return `ENOSYS`.
+- `fcntl` and `sendmsg` must remain allowed because Ruby uses them to wrap and transfer the listener
+  descriptor. Policies that notify or deny them are rejected.
 
-Targets started by this gem can call `Seccomp::Notify.supervisor_alive?` to poll the health pipe. If the target `exec`s, the pipe fd is inherited and published as `SECCOMP_NOTIFY_HEALTH_FD`.
+## Examples
+
+- [`examples/deny_network.rb`](examples/deny_network.rb) rejects outbound network syscalls.
+- [`examples/emulate_open.rb`](examples/emulate_open.rb) replaces `/dev/urandom` with an injected
+  file descriptor.
+- [`examples/strace_lite.rb`](examples/strace_lite.rb) logs selected syscall notifications.
 
 ## Development
 
-Run `bundle exec rake`. Linux runs include real seccomp integration tests; other systems run only portable filter and layout tests. `spike/notify_min.c` is the reference C round trip, and `tools/gen_syscall_table.rb` regenerates architecture tables from Linux kernel headers.
+```sh
+bundle install
+bundle exec rake
+```
+
+Linux runs include real seccomp integration tests; other systems run portable filter and layout
+tests only. `spike/notify_min.c` is the reference C round trip, and
+`tools/gen_syscall_table.rb` regenerates architecture tables from Linux kernel syscall tables.
+
+## Contributing
+
+Bug reports and pull requests are welcome at https://github.com/ydah/seccomp-notify.
+
+Releases before 1.0 may change the API.
+
+## License
 
-Releases before 1.0 may change the API. The project is available under the MIT License.
+Released under the [MIT License](LICENSE.txt).

data/lib/seccomp/notify/bpf/builder.rb

@@ -4,20 +4,29 @@ module Seccomp
   module Notify
     module BPF
       class Builder
-        LINEAR_LIMIT = 64
+        LINEAR_LIMIT = 4
         AUDIT_ARCHES = {x86_64: Constants::AUDIT_ARCH_X86_64, aarch64: Constants::AUDIT_ARCH_AARCH64}.freeze
 
-        def initialize(policy, arch: Libc.architecture)
+        def initialize(policy, arch: Libc.architecture, transfer_fd: nil)
           raise NotSupportedError, "unsupported architecture: #{arch}" unless AUDIT_ARCHES.key?(arch)
+          raise ArgumentError, "transfer_fd must be a non-negative integer" if transfer_fd && (!transfer_fd.is_a?(Integer) || transfer_fd.negative?)
 
           @policy = policy
           @arch = arch
+          @transfer_fd = transfer_fd
         end
 
         def build
           decisions = @policy.decisions(@arch)
+          if @transfer_fd.nil? && @policy.default_action != Constants::SECCOMP_RET_ALLOW && !@policy.notified?(:sendmsg)
+            decisions[Syscalls.number(:sendmsg, @arch)] = Constants::SECCOMP_RET_ALLOW
+          end
           body = decisions.length <= LINEAR_LIMIT ? linear(decisions) : tree(decisions.sort)
-          Program.new(prologue + body)
+          conditions = @policy.conditional_notifications(@arch)
+          bootstrap_first = @transfer_fd && conditions.any? { |number, _argument, _mask| number == Syscalls.number(:sendmsg, @arch) }
+          conditional = conditional_notifications(conditions, decisions)
+          bootstrap = bootstrap_first ? transfer_allowance + conditional : conditional + transfer_allowance
+          Program.new(prologue + bootstrap + body)
         end
 
         private
@@ -37,6 +46,42 @@ module Seccomp
           end << ins(Constants::BPF_RET_K, 0, 0, @policy.default_action)
         end
 
+        def transfer_allowance
+          return [] unless @transfer_fd
+
+          conditional(Syscalls.number(:sendmsg, @arch), 0, @transfer_fd, Constants::BPF_JMP_JEQ_K)
+        end
+
+        def conditional_notifications(conditions, decisions)
+          last_condition = {}
+          conditions.each_with_index { |(number, _argument, _mask), index| last_condition[number] = index }
+          conditions.each_with_index.flat_map do |(number, argument, mask), index|
+            fallback = decisions.fetch(number, @policy.default_action) if last_condition.fetch(number) == index
+            conditional(number, argument, mask, Constants::BPF_JMP_JSET_K, fallback:)
+          end
+        end
+
+        def conditional(number, argument, value, comparison, fallback: nil)
+          if fallback
+            return [
+              ins(Constants::BPF_JMP_JEQ_K, 0, 4, number),
+              ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_ARGS + argument * 8),
+              ins(comparison, 0, 1, value),
+              ins(Constants::BPF_RET_K, 0, 0, Constants::SECCOMP_RET_USER_NOTIF),
+              ins(Constants::BPF_RET_K, 0, 0, fallback),
+              ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_NR)
+            ]
+          end
+
+          [
+            ins(Constants::BPF_JMP_JEQ_K, 0, 3, number),
+            ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_ARGS + argument * 8),
+            ins(comparison, 0, 1, value),
+            ins(Constants::BPF_RET_K, 0, 0, comparison == Constants::BPF_JMP_JEQ_K ? Constants::SECCOMP_RET_ALLOW : Constants::SECCOMP_RET_USER_NOTIF),
+            ins(Constants::BPF_LD_W_ABS, 0, 0, Constants::OFF_NR)
+          ]
+        end
+
         def tree(decisions)
           return [ins(Constants::BPF_RET_K, 0, 0, @policy.default_action)] if decisions.empty?
           return linear(decisions) if decisions.length <= 4

data/lib/seccomp/notify/constants.rb

@@ -35,10 +35,12 @@ module Seccomp
       SYS_SECCOMP = {x86_64: 317, aarch64: 277}.freeze
 
       PR_SET_NO_NEW_PRIVS = 38
+      PR_SET_PTRACER = 0x5961_6d61
       BPF_LD_W_ABS = 0x20
       BPF_JMP_JA = 0x05
       BPF_JMP_JEQ_K = 0x15
       BPF_JMP_JGE_K = 0x35
+      BPF_JMP_JSET_K = 0x45
       BPF_RET_K = 0x06
       BPF_MAXINSNS = 4096
       MAX_ERRNO = 4095

data/lib/seccomp/notify/fd_passing.rb

@@ -9,7 +9,7 @@ module Seccomp
       module_function
 
       def send_fd(socket, io)
-        socket.sendmsg("\0", 0, nil, Socket::AncillaryData.unix_rights(io))
+        socket.send_io(io)
       end
 
       def recv_fd(socket, timeout: 10)

data/lib/seccomp/notify/filter.rb

@@ -5,7 +5,7 @@ module Seccomp
     module Filter
       module_function
 
-      def install!(program, flags: 0)
+      def install!(program, flags: 0, raw: false)
         unless Libc.prctl(Constants::PR_SET_NO_NEW_PRIVS, 1).zero?
           raise SystemCallError.new("prctl(PR_SET_NO_NEW_PRIVS)", Fiddle.last_error)
         end
@@ -14,7 +14,7 @@ module Seccomp
         fd = Libc.seccomp(Constants::SECCOMP_SET_MODE_FILTER, filter_flags, program.to_sock_fprog)
         raise SystemCallError.new("seccomp(SET_MODE_FILTER)", Fiddle.last_error) if fd.negative?
 
-        IO.for_fd(fd, "r")
+        raw ? fd : IO.for_fd(fd, "r")
       end
     end
   end

data/lib/seccomp/notify/libc.rb

@@ -20,8 +20,7 @@ module Seccomp
       IOCTL = Fiddle::Function.new(
         HANDLE["ioctl"],
         [Fiddle::TYPE_INT, Fiddle::TYPE_LONG, Fiddle::TYPE_VOIDP],
-        Fiddle::TYPE_INT,
-        need_gvl: true
+        Fiddle::TYPE_INT
       )
       POLL = Fiddle::Function.new(
         HANDLE["poll"],
@@ -60,7 +59,8 @@ module Seccomp
         result = POLL.call(Fiddle::Pointer[buffer], 1, 0)
         raise SystemCallError.new("poll", Fiddle.last_error) if result.negative?
 
-        (buffer.unpack1("@6S<") & 0x10).positive?
+        revents = buffer.unpack1("@6S<")
+        (revents & 0x10).positive? && (revents & 0x01).zero?
       end
 
       def notif_sizes

data/lib/seccomp/notify/policy.rb

@@ -3,7 +3,7 @@
 module Seccomp
   module Notify
     class Policy
-      BOOTSTRAP_SYSCALLS = %i[fcntl sendmsg].freeze
+      BOOTSTRAP_SYSCALLS = %i[fcntl].freeze
       ALLOWED_FLAGS = Constants::SECCOMP_FILTER_FLAG_LOG |
         Constants::SECCOMP_FILTER_FLAG_SPEC_ALLOW |
         Constants::SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV
@@ -21,6 +21,7 @@ module Seccomp
 
         @flags = flags
         @notifications = []
+        @conditional_notifications = []
         @denials = {}
         deny_io_uring! if deny_io_uring
         instance_eval(&block) if block
@@ -34,6 +35,14 @@ module Seccomp
         @notifications.concat(names.map(&:to_sym))
       end
 
+      # Notifies only when one of the low 32 bits in a syscall argument is set.
+      def notify_if(name, argument:, mask:)
+        raise ArgumentError, "argument must be between 0 and 5" unless (0..5).cover?(argument)
+        raise ArgumentError, "mask must be between 1 and 0xffffffff" unless mask.is_a?(Integer) && (1..0xffff_ffff).cover?(mask)
+
+        @conditional_notifications << [name.to_sym, argument, mask]
+      end
+
       # Rejects syscalls in the kernel without notifying the supervisor.
       # @param names [Array<Symbol>]
       # @param errno [Class, Integer] an Errno class or numeric errno
@@ -69,6 +78,12 @@ module Seccomp
         @notifications.include?(name.to_sym)
       end
 
+      def conditional_notifications(arch)
+        @conditional_notifications.filter_map do |name, argument, mask|
+          [Syscalls.number(name, arch), argument, mask] unless notified?(name) || @denials.key?(name)
+        end
+      end
+
       private
 
       def validate!

data/lib/seccomp/notify/request.rb

@@ -138,6 +138,10 @@ module Seccomp
         @pointer_read = true
       end
 
+      def close
+        @memory.close
+      end
+
       private
 
       def validate_id(request, buffer)

data/lib/seccomp/notify/supervisor.rb

@@ -53,8 +53,6 @@ module Seccomp
         @handlers = {}
         @unknown_handler = ->(request) { request.error!(@default_errno) }
         @error_handler = ->(error, _request) { warn("seccomp-notify supervisor: #{error.full_message(highlight: false, order: :top)}") }
-        @memory_cache = {}
-        @memory_cache_mutex = Mutex.new
         @receive_mutex = Mutex.new
         @stop = false
         @listener_closed = false
@@ -103,7 +101,6 @@ module Seccomp
         status
       ensure
         @stop = true
-        @memory_cache.each_value { |io| io.close unless io.closed? }
         @listener.close unless @listener.closed?
         @health_writer&.close unless @health_writer&.closed?
       end
@@ -133,6 +130,7 @@ module Seccomp
       def wait_for_non_child
         loop do
           return if @stop
+          return if target_zombie?
 
           Process.kill(0, @target_pid)
           sleep(@poll_interval)
@@ -141,6 +139,12 @@ module Seccomp
         nil
       end
 
+      def target_zombie?
+        File.read("/proc/#{@target_pid}/stat").match?(/\A\d+ \(.*\) [ZX] /)
+      rescue Errno::ENOENT
+        true
+      end
+
       def wait_until_listener_closes
         sleep(@poll_interval) until @stop || @listener_closed
       end
@@ -161,6 +165,9 @@ module Seccomp
         dispatch(request)
       rescue Errno::EINTR
         retry
+      rescue Errno::EAGAIN
+        @listener_closed = true if Libc.poll_hup?(@listener.fileno)
+        nil
       rescue Errno::ENOENT
         @listener_closed = true if Libc.poll_hup?(@listener.fileno)
         nil
@@ -168,6 +175,10 @@ module Seccomp
 
       def receive_request
         return unless IO.select([@listener], nil, nil, @poll_interval)
+        if Libc.poll_hup?(@listener.fileno)
+          @listener_closed = true
+          return
+        end
 
         buffer = "\0" * @sizes[:notif]
         Ioctl.call(@listener, Ioctl::NOTIF_RECV, buffer)
@@ -175,8 +186,8 @@ module Seccomp
           buffer,
           listener: @listener,
           sizes: @sizes,
-          memory_cache: @memory_cache,
-          memory_cache_mutex: @memory_cache_mutex,
+          memory_cache: nil,
+          memory_cache_mutex: nil,
           features: @features
         )
       end
@@ -191,7 +202,11 @@ module Seccomp
           warn("seccomp-notify error callback failed: #{callback_error.message}")
         end
       ensure
-        request&.error!(@default_errno) unless request&.responded?
+        begin
+          request&.error!(@default_errno) unless request&.responded?
+        ensure
+          request&.close
+        end
       end
     end
   end

data/lib/seccomp/notify/target_memory.rb

@@ -7,12 +7,16 @@ module Seccomp
   module Notify
     class TargetMemory
       PAGE_SIZE = 4096
+      SOCKADDR_STORAGE_SIZE = 128
 
-      def initialize(listener, request, cache, cache_mutex = Mutex.new)
+      def initialize(listener, request, _cache = nil, _cache_mutex = nil)
         @listener = listener
         @request = request
-        @cache = cache
-        @cache_mutex = cache_mutex
+        @memory = nil
+      end
+
+      def close
+        @memory&.close unless @memory&.closed?
       end
 
       def read(address, length)
@@ -24,7 +28,7 @@ module Seccomp
 
         @request.mark_pointer_read!
         data
-      rescue Errno::EIO, Errno::EFAULT, Errno::ENOENT, Errno::EACCES => error
+      rescue EOFError, Errno::EIO, Errno::EFAULT, Errno::ENOENT, Errno::EACCES => error
         raise MemoryReadError, error.message
       end
 
@@ -45,6 +49,7 @@ module Seccomp
 
       def read_sockaddr(address, length)
         raise MemoryReadError, "sockaddr is shorter than sa_family" if length < 2
+        raise MemoryReadError, "sockaddr is longer than sockaddr_storage" if length > SOCKADDR_STORAGE_SIZE
 
         bytes = read(address, length)
         case bytes.unpack1("S<")
@@ -69,9 +74,7 @@ module Seccomp
       private
 
       def memory
-        @cache[@request.tid] || @cache_mutex.synchronize do
-          @cache[@request.tid] ||= File.open("/proc/#{@request.tid}/mem", File::RDONLY)
-        end
+        @memory ||= File.open("/proc/#{@request.tid}/mem", File::RDONLY)
       end
     end
   end

data/lib/seccomp/notify/version.rb

@@ -2,6 +2,6 @@
 
 module Seccomp
   module Notify
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

data/lib/seccomp/notify.rb

@@ -62,15 +62,16 @@ module Seccomp
           raise ArgumentError, "recv_timeout must be positive"
         end
 
-        program, install_flags = prepare_supervision(policy, supervisor_options)
         parent_socket, child_socket = UNIXSocket.pair
+        program, install_flags = prepare_supervision(policy, supervisor_options, transfer_fd: child_socket.fileno)
         health_reader, health_writer = IO.pipe
         pid = fork do
           parent_socket.close
           health_writer.close
           keep_health_reader(health_reader)
-          listener = Filter.install!(program, flags: install_flags)
-          FdPassing.send_fd(child_socket, listener)
+          listener_fd = Filter.install!(program, flags: install_flags, raw: true)
+          FdPassing.send_fd(child_socket, listener_fd)
+          listener = IO.for_fd(listener_fd, "r")
           child_socket.close
           listener.close
           target.call
@@ -102,11 +103,11 @@ module Seccomp
         raise ArgumentError, "supervisor must be :spawn or :fork" unless %i[spawn fork].include?(supervisor)
         raise ArgumentError, "supervisor: :spawn does not support Ruby handler blocks" if supervisor == :spawn && configure
 
-        program, install_flags = prepare_supervision(policy, options)
         selected_features = options.fetch(:features, features)
         raise NotSupportedError, "supervise_self requires CONTINUE when no handler block is given" if !configure && !selected_features[:continue]
 
         parent_socket, supervisor_socket = UNIXSocket.pair
+        program, install_flags = prepare_supervision(policy, options, transfer_fd: parent_socket.fileno)
         health_reader, health_writer = IO.pipe
         target_pid = Process.pid
         supervisor_pid = case supervisor
@@ -119,8 +120,9 @@ module Seccomp
         supervisor_socket.close
         health_writer.close
         keep_health_reader(health_reader)
-        listener = Filter.install!(program, flags: install_flags)
-        FdPassing.send_fd(parent_socket, listener)
+        listener_fd = Filter.install!(program, flags: install_flags, raw: true)
+        FdPassing.send_fd(parent_socket, listener_fd)
+        listener = IO.for_fd(listener_fd, "r")
         listener.close
         parent_socket.close
         Process.detach(supervisor_pid)
@@ -175,14 +177,14 @@ module Seccomp
         )
       end
 
-      def prepare_supervision(policy, options)
+      def prepare_supervision(policy, options, transfer_fd: nil)
         Supervisor.validate_options!(options)
         sizes = notif_sizes
         raise NotSupportedError, "unsupported kernel notification sizes: #{sizes.inspect}" unless sizes == Supervisor::EXPECTED_SIZES
 
         selected_features = options.fetch(:features, features)
         optional_flags = selected_features[:wait_killable_recv] ? Constants::SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV : 0
-        [BPF::Builder.new(policy).build, policy.flags | optional_flags]
+        [BPF::Builder.new(policy, transfer_fd:).build, policy.flags | optional_flags]
       end
 
       def keep_health_reader(reader)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: seccomp-notify
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Yudai Takada
@@ -60,12 +60,12 @@ files:
 - lib/seccomp/notify/version.rb
 - spike/notify_min.c
 - tools/gen_syscall_table.rb
-homepage: https://rubygems.org/gems/seccomp-notify
+homepage: https://ydah.github.io/seccomp-notify/
 licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-  homepage_uri: https://rubygems.org/gems/seccomp-notify
+  homepage_uri: https://ydah.github.io/seccomp-notify/
 rdoc_options: []
 require_paths:
 - lib
@@ -80,7 +80,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.19
 specification_version: 4
 summary: Pure Ruby bindings for Linux seccomp user notifications
 test_files: []