seccomp-ruby 0.1.0

data/ext/seccomp_ext/filter.c

@@ -0,0 +1,685 @@
+#include "seccomp_ext.h"
+#include <errno.h>
+#include <fcntl.h>
+#include <ruby/thread.h>
+#include <unistd.h>
+
+struct seccomp_export_args {
+    scmp_filter_ctx ctx;
+    int fd;
+    int rc;
+};
+
+struct seccomp_bpf_mem_args {
+    scmp_filter_ctx ctx;
+    void *buffer;
+    size_t length;
+    size_t capacity;
+    int rc;
+};
+
+struct seccomp_precompute_args {
+    scmp_filter_ctx ctx;
+    int rc;
+};
+
+struct seccomp_load_args {
+    scmp_filter_ctx ctx;
+    int rc;
+};
+
+static int seccomp_ext_any_filter_loaded;
+
+static void *
+seccomp_ext_load_without_gvl(void *pointer)
+{
+    struct seccomp_load_args *args = pointer;
+
+    args->rc = seccomp_load(args->ctx);
+    return NULL;
+}
+
+static void *
+seccomp_ext_export_pfc_without_gvl(void *pointer)
+{
+    struct seccomp_export_args *args = pointer;
+
+    args->rc = seccomp_export_pfc(args->ctx, args->fd);
+    return NULL;
+}
+
+static void *
+seccomp_ext_export_bpf_without_gvl(void *pointer)
+{
+    struct seccomp_export_args *args = pointer;
+
+    args->rc = seccomp_export_bpf(args->ctx, args->fd);
+    return NULL;
+}
+
+#ifdef HAVE_SECCOMP_EXPORT_BPF_MEM
+static void *
+seccomp_ext_export_bpf_mem_without_gvl(void *pointer)
+{
+    struct seccomp_bpf_mem_args *args = pointer;
+
+    args->rc = seccomp_export_bpf_mem(args->ctx, args->buffer, &args->length);
+    return NULL;
+}
+
+static VALUE
+seccomp_ext_export_bpf_mem_free(VALUE pointer)
+{
+    struct seccomp_bpf_mem_args *args = (struct seccomp_bpf_mem_args *)pointer;
+
+    xfree(args->buffer);
+    args->buffer = NULL;
+    return Qnil;
+}
+
+static VALUE
+seccomp_ext_export_bpf_mem_call(VALUE pointer)
+{
+    struct seccomp_bpf_mem_args *args = (struct seccomp_bpf_mem_args *)pointer;
+    VALUE result;
+
+    rb_thread_call_without_gvl(seccomp_ext_export_bpf_mem_without_gvl,
+                               args, RUBY_UBF_IO, NULL);
+    if (args->rc < 0)
+        return rb_ary_new_from_args(2, INT2NUM(args->rc), Qnil);
+    if (args->length > args->capacity)
+        return rb_ary_new_from_args(2, INT2NUM(-ERANGE), Qnil);
+    result = rb_str_new(args->buffer, args->length);
+    return rb_ary_new_from_args(2, INT2NUM(0), result);
+}
+#endif
+
+#ifdef HAVE_SECCOMP_PRECOMPUTE
+static void *
+seccomp_ext_precompute_without_gvl(void *pointer)
+{
+    struct seccomp_precompute_args *args = pointer;
+
+    args->rc = seccomp_precompute(args->ctx);
+    return NULL;
+}
+#endif
+
+static void
+seccomp_ext_filter_close_notify_fd(seccomp_filter_t *filter)
+{
+    scmp_filter_ctx probe;
+    unsigned int api_level;
+
+    if (filter->notify_fd < 0)
+        return;
+
+    /* A global reset clears feature flags and the syscall number, but not the API cache. */
+    api_level = seccomp_api_get();
+    seccomp_reset(NULL, SCMP_ACT_ALLOW);
+    /* Reprobe the syscall number before restoring the cached feature flags. */
+    probe = seccomp_init(SCMP_ACT_NOTIFY);
+    if (probe != NULL) {
+        seccomp_release(probe);
+        seccomp_api_set(api_level);
+    }
+    filter->notify_fd = -1;
+}
+
+static void
+seccomp_filter_free(void *pointer)
+{
+    seccomp_filter_t *filter = pointer;
+
+    seccomp_ext_filter_close_notify_fd(filter);
+    if (filter->ctx != NULL) {
+        seccomp_release(filter->ctx);
+        filter->ctx = NULL;
+    }
+    xfree(filter);
+}
+
+static size_t
+seccomp_filter_memsize(const void *pointer)
+{
+    return pointer == NULL ? 0 : sizeof(seccomp_filter_t);
+}
+
+const rb_data_type_t seccomp_filter_type = {
+    .wrap_struct_name = "Seccomp::LowLevel::Context",
+    .function = {
+        .dmark = NULL,
+        .dfree = seccomp_filter_free,
+        .dsize = seccomp_filter_memsize,
+    },
+    .flags = RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
+};
+
+seccomp_filter_t *
+seccomp_ext_filter_check(VALUE object)
+{
+    seccomp_filter_t *filter;
+
+    TypedData_Get_Struct(object, seccomp_filter_t, &seccomp_filter_type, filter);
+    if (filter->ctx == NULL)
+        rb_raise(eSeccompClosedFilterError, "filter is closed");
+    return filter;
+}
+
+static VALUE
+seccomp_ext_filter_init(VALUE self, VALUE action)
+{
+    seccomp_filter_t *filter;
+    uint32_t action_value = seccomp_ext_num_to_uint32(action, "action");
+    VALUE object;
+
+    (void)self;
+    object = TypedData_Make_Struct(cSeccompContext, seccomp_filter_t,
+                                   &seccomp_filter_type, filter);
+    filter->ctx = seccomp_init(action_value);
+    filter->loaded = 0;
+    filter->notify_fd = -1;
+    filter->in_transaction = 0;
+    filter->has_notification = action_value == SCMP_ACT_NOTIFY;
+    filter->notification_used = filter->has_notification;
+    filter->transaction_has_notification = 0;
+    if (filter->ctx == NULL)
+        rb_raise(rb_path2class("Seccomp::OutOfMemoryError"), "seccomp_init failed");
+    return object;
+}
+
+static VALUE
+seccomp_ext_filter_release(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter;
+
+    (void)self;
+    TypedData_Get_Struct(object, seccomp_filter_t, &seccomp_filter_type, filter);
+    seccomp_ext_filter_close_notify_fd(filter);
+    if (filter->ctx != NULL) {
+        seccomp_release(filter->ctx);
+        filter->ctx = NULL;
+    }
+    return Qnil;
+}
+
+static VALUE
+seccomp_ext_filter_closed(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter;
+
+    (void)self;
+    TypedData_Get_Struct(object, seccomp_filter_t, &seccomp_filter_type, filter);
+    return filter->ctx == NULL ? Qtrue : Qfalse;
+}
+
+static VALUE
+seccomp_ext_filter_reset(VALUE self, VALUE object, VALUE action)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+    uint32_t action_value = seccomp_ext_num_to_uint32(action, "action");
+    int rc;
+
+    (void)self;
+    rc = seccomp_reset(filter->ctx, action_value);
+    if (rc == 0) {
+        filter->in_transaction = 0;
+        filter->has_notification = action_value == SCMP_ACT_NOTIFY;
+        filter->notification_used = filter->has_notification;
+    }
+    return INT2NUM(rc);
+}
+
+static int
+seccomp_ext_filter_merge_reverse(scmp_filter_ctx destination, scmp_filter_ctx source)
+{
+    /* Preserve destination-only attributes while working around lost NOTIFY state in 2.5/2.6. */
+    static const enum scmp_filter_attr attributes[] = {
+        SCMP_FLTATR_ACT_BADARCH,
+        SCMP_FLTATR_API_TSKIP,
+        SCMP_FLTATR_CTL_LOG,
+        SCMP_FLTATR_CTL_SSB,
+#ifdef HAVE_CONST_SCMP_FLTATR_CTL_OPTIMIZE
+        SCMP_FLTATR_CTL_OPTIMIZE,
+#endif
+#ifdef HAVE_CONST_SCMP_FLTATR_API_SYSRAWRC
+        SCMP_FLTATR_API_SYSRAWRC,
+#endif
+#ifdef HAVE_CONST_SCMP_FLTATR_CTL_WAITKILL
+        SCMP_FLTATR_CTL_WAITKILL,
+#endif
+    };
+    uint32_t destination_values[sizeof(attributes) / sizeof(attributes[0])];
+    uint32_t source_values[sizeof(attributes) / sizeof(attributes[0])];
+    size_t index;
+    int merge_rc;
+    int rc;
+
+    for (index = 0; index < sizeof(attributes) / sizeof(attributes[0]); index++) {
+        rc = seccomp_attr_get(destination, attributes[index], &destination_values[index]);
+        if (rc < 0)
+            return rc;
+        rc = seccomp_attr_get(source, attributes[index], &source_values[index]);
+        if (rc < 0)
+            return rc;
+    }
+
+    for (index = 0; index < sizeof(attributes) / sizeof(attributes[0]); index++) {
+        if (destination_values[index] == source_values[index])
+            continue;
+        rc = seccomp_attr_set(source, attributes[index], destination_values[index]);
+        if (rc < 0)
+            goto restore;
+    }
+
+    merge_rc = seccomp_merge(source, destination);
+    if (merge_rc == 0)
+        return 0;
+    rc = merge_rc;
+
+restore:
+    while (index > 0) {
+        index--;
+        if (destination_values[index] != source_values[index])
+            (void)seccomp_attr_set(source, attributes[index], source_values[index]);
+    }
+    return rc;
+}
+
+static VALUE
+seccomp_ext_filter_merge(VALUE self, VALUE destination, VALUE source)
+{
+    seccomp_filter_t *dst = seccomp_ext_filter_check(destination);
+    seccomp_filter_t *src = seccomp_ext_filter_check(source);
+    int reverse;
+    int rc;
+
+    (void)self;
+    if (dst == src)
+        return INT2NUM(-EINVAL);
+    if (dst->in_transaction || src->in_transaction)
+        return INT2NUM(-EINVAL);
+    reverse = !dst->notification_used && src->notification_used;
+    rc = reverse ? seccomp_ext_filter_merge_reverse(dst->ctx, src->ctx)
+                 : seccomp_merge(dst->ctx, src->ctx);
+    if (rc == 0) {
+        if (reverse)
+            dst->ctx = src->ctx;
+        dst->loaded = dst->loaded || src->loaded;
+        dst->has_notification = dst->has_notification || src->has_notification;
+        dst->notification_used = dst->notification_used || src->notification_used;
+        if (src->notify_fd >= 0) {
+            if (dst->notify_fd < 0)
+                dst->notify_fd = src->notify_fd;
+            src->notify_fd = -1;
+        }
+        src->loaded = 0;
+        src->in_transaction = 0;
+        src->has_notification = 0;
+        src->notification_used = 0;
+        src->ctx = NULL;
+    }
+    return INT2NUM(rc);
+}
+
+static VALUE
+seccomp_ext_filter_attr_get(VALUE self, VALUE object, VALUE attribute)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+    uint32_t value = 0;
+    int rc;
+
+    (void)self;
+    rc = seccomp_attr_get(filter->ctx,
+                          (enum scmp_filter_attr)seccomp_ext_num_to_uint32(attribute, "attribute"),
+                          &value);
+    return rb_ary_new_from_args(2, INT2NUM(rc), seccomp_ext_uint32(value));
+}
+
+static VALUE
+seccomp_ext_filter_attr_set(VALUE self, VALUE object, VALUE attribute, VALUE value)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+    int rc;
+
+    (void)self;
+    rc = seccomp_attr_set(filter->ctx,
+                          (enum scmp_filter_attr)seccomp_ext_num_to_uint32(attribute, "attribute"),
+                          seccomp_ext_num_to_uint32(value, "value"));
+    return INT2NUM(rc);
+}
+
+static VALUE
+seccomp_ext_filter_arch_add(VALUE self, VALUE object, VALUE arch)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+    (void)self;
+    return INT2NUM(seccomp_arch_add(filter->ctx, seccomp_ext_num_to_uint32(arch, "arch")));
+}
+
+static VALUE
+seccomp_ext_filter_arch_remove(VALUE self, VALUE object, VALUE arch)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+    (void)self;
+    return INT2NUM(seccomp_arch_remove(filter->ctx, seccomp_ext_num_to_uint32(arch, "arch")));
+}
+
+static VALUE
+seccomp_ext_filter_arch_exist(VALUE self, VALUE object, VALUE arch)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+    (void)self;
+    return INT2NUM(seccomp_arch_exist(filter->ctx, seccomp_ext_num_to_uint32(arch, "arch")));
+}
+
+static void
+seccomp_ext_filter_comparisons(VALUE comparisons, struct scmp_arg_cmp *result,
+                               unsigned int *count)
+{
+    long length;
+    long index;
+
+    Check_Type(comparisons, T_ARRAY);
+    length = RARRAY_LEN(comparisons);
+    if (length > 6)
+        rb_raise(rb_eArgError, "at most 6 argument comparisons are allowed");
+    *count = (unsigned int)length;
+    for (index = 0; index < length; index++) {
+        VALUE item = rb_ary_entry(comparisons, index);
+        uint32_t arg;
+        uint32_t op;
+
+        Check_Type(item, T_ARRAY);
+        if (RARRAY_LEN(item) != 4)
+            rb_raise(rb_eArgError, "comparison must contain arg, op, datum_a, datum_b");
+        arg = seccomp_ext_num_to_uint32(rb_ary_entry(item, 0), "comparison arg");
+        op = seccomp_ext_num_to_uint32(rb_ary_entry(item, 1), "comparison op");
+        if (arg > 5 || op < SCMP_CMP_NE || op > SCMP_CMP_MASKED_EQ)
+            rb_raise(rb_eArgError, "invalid argument comparison");
+        result[index].arg = arg;
+        result[index].op = (enum scmp_compare)op;
+        result[index].datum_a = seccomp_ext_num_to_uint64(rb_ary_entry(item, 2), "datum_a");
+        result[index].datum_b = seccomp_ext_num_to_uint64(rb_ary_entry(item, 3), "datum_b");
+    }
+}
+
+static VALUE
+seccomp_ext_filter_rule_add_common(VALUE object, VALUE action, VALUE syscall,
+                                   VALUE comparisons, int exact)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+    struct scmp_arg_cmp args[6];
+    unsigned int count;
+    uint32_t action_value = seccomp_ext_num_to_uint32(action, "action");
+    int rc;
+
+    seccomp_ext_filter_comparisons(comparisons, args, &count);
+    if (exact) {
+        rc = seccomp_rule_add_exact_array(filter->ctx,
+                                          action_value,
+                                          seccomp_ext_num_to_int(syscall, "syscall"), count, args);
+    } else {
+        rc = seccomp_rule_add_array(filter->ctx,
+                                    action_value,
+                                    seccomp_ext_num_to_int(syscall, "syscall"), count, args);
+    }
+    if (rc == 0 && action_value == SCMP_ACT_NOTIFY) {
+        filter->has_notification = 1;
+        filter->notification_used = 1;
+    }
+    return INT2NUM(rc);
+}
+
+static VALUE
+seccomp_ext_filter_rule_add_array(VALUE self, VALUE object, VALUE action,
+                                  VALUE syscall, VALUE comparisons)
+{
+    (void)self;
+    return seccomp_ext_filter_rule_add_common(object, action, syscall, comparisons, 0);
+}
+
+static VALUE
+seccomp_ext_filter_rule_add_exact_array(VALUE self, VALUE object, VALUE action,
+                                        VALUE syscall, VALUE comparisons)
+{
+    (void)self;
+    return seccomp_ext_filter_rule_add_common(object, action, syscall, comparisons, 1);
+}
+
+static VALUE
+seccomp_ext_filter_priority(VALUE self, VALUE object, VALUE syscall, VALUE priority)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+    uint32_t value = seccomp_ext_num_to_uint32(priority, "priority");
+
+    (void)self;
+    if (value > UINT8_MAX)
+        rb_raise(rb_eRangeError, "priority must be between 0 and 255");
+    return INT2NUM(seccomp_syscall_priority(filter->ctx,
+                                            seccomp_ext_num_to_int(syscall, "syscall"),
+                                            (uint8_t)value));
+}
+
+static VALUE
+seccomp_ext_filter_export_pfc(VALUE self, VALUE object, VALUE fd)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+    struct seccomp_export_args args = {
+        .ctx = filter->ctx,
+        .fd = seccomp_ext_num_to_int(fd, "fd"),
+        .rc = 0,
+    };
+
+    (void)self;
+    rb_thread_call_without_gvl(seccomp_ext_export_pfc_without_gvl, &args, RUBY_UBF_IO, NULL);
+    return INT2NUM(args.rc);
+}
+
+static VALUE
+seccomp_ext_filter_export_bpf(VALUE self, VALUE object, VALUE fd)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+    struct seccomp_export_args args = {
+        .ctx = filter->ctx,
+        .fd = seccomp_ext_num_to_int(fd, "fd"),
+        .rc = 0,
+    };
+
+    (void)self;
+    rb_thread_call_without_gvl(seccomp_ext_export_bpf_without_gvl, &args, RUBY_UBF_IO, NULL);
+    return INT2NUM(args.rc);
+}
+
+static VALUE
+seccomp_ext_filter_export_bpf_mem(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+#ifdef HAVE_SECCOMP_EXPORT_BPF_MEM
+    struct seccomp_bpf_mem_args args = {
+        .ctx = filter->ctx,
+        .buffer = NULL,
+        .length = 0,
+        .capacity = 0,
+        .rc = 0,
+    };
+
+    (void)self;
+    rb_thread_call_without_gvl(seccomp_ext_export_bpf_mem_without_gvl, &args, RUBY_UBF_IO, NULL);
+    if (args.rc < 0)
+        return rb_ary_new_from_args(2, INT2NUM(args.rc), Qnil);
+    args.capacity = args.length;
+    args.buffer = xmalloc(args.capacity);
+    return rb_ensure(seccomp_ext_export_bpf_mem_call, (VALUE)&args,
+                     seccomp_ext_export_bpf_mem_free, (VALUE)&args);
+#else
+    (void)self;
+    (void)filter;
+    rb_raise(rb_path2class("Seccomp::NotSupportedError"),
+             "seccomp_export_bpf_mem is not available in this libseccomp build");
+#endif
+}
+
+static VALUE
+seccomp_ext_filter_precompute(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+#ifdef HAVE_SECCOMP_PRECOMPUTE
+    struct seccomp_precompute_args args = {.ctx = filter->ctx, .rc = 0};
+
+    (void)self;
+    rb_thread_call_without_gvl(seccomp_ext_precompute_without_gvl, &args, RUBY_UBF_IO, NULL);
+    return INT2NUM(args.rc);
+#else
+    (void)self;
+    (void)filter;
+    rb_raise(rb_path2class("Seccomp::NotSupportedError"),
+             "seccomp_precompute is not available in this libseccomp build");
+#endif
+}
+
+static VALUE
+seccomp_ext_filter_load(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+    struct seccomp_load_args args = {.ctx = filter->ctx, .rc = 0};
+    int notify_fd_before;
+    int notify_fd_after;
+    int reserved_fd = -1;
+
+    (void)self;
+    /* libseccomp retains notification state after rejecting a transaction. */
+    if (filter->notification_used && !filter->has_notification)
+        return INT2NUM(-EOPNOTSUPP);
+    if (filter->notification_used && fcntl(STDIN_FILENO, F_GETFD) < 0 && errno == EBADF)
+        reserved_fd = open("/dev/null", O_RDONLY | O_CLOEXEC);
+    notify_fd_before = seccomp_notify_fd(filter->ctx);
+    rb_thread_call_without_gvl(seccomp_ext_load_without_gvl, &args, RUBY_UBF_IO, NULL);
+    if (args.rc == 0) {
+        filter->loaded = 1;
+        seccomp_ext_any_filter_loaded = 1;
+        notify_fd_after = seccomp_notify_fd(filter->ctx);
+        if (notify_fd_after >= 0 && notify_fd_after != notify_fd_before) {
+            filter->notify_fd = notify_fd_after;
+        }
+    }
+    /* After any successful load, close(2) may already be filtered. */
+    if (reserved_fd >= 0 && args.rc < 0 && !seccomp_ext_any_filter_loaded)
+        close(reserved_fd);
+    return INT2NUM(args.rc);
+}
+
+static VALUE
+seccomp_ext_filter_loaded(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+    (void)self;
+    return filter->loaded ? Qtrue : Qfalse;
+}
+
+static VALUE
+seccomp_ext_filter_transaction_start(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+#ifdef HAVE_SECCOMP_TRANSACTION_START
+    int rc;
+
+    (void)self;
+    rc = seccomp_transaction_start(filter->ctx);
+    if (rc == 0) {
+        filter->in_transaction = 1;
+        filter->transaction_has_notification = filter->has_notification;
+    }
+    return INT2NUM(rc);
+#else
+    (void)self;
+    (void)filter;
+    rb_raise(rb_path2class("Seccomp::NotSupportedError"), "transactions unavailable");
+#endif
+}
+
+static VALUE
+seccomp_ext_filter_transaction_commit(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+#ifdef HAVE_SECCOMP_TRANSACTION_COMMIT
+    int rc;
+
+    (void)self;
+    rc = seccomp_transaction_commit(filter->ctx);
+    if (rc == 0)
+        filter->in_transaction = 0;
+    return INT2NUM(rc);
+#else
+    (void)self;
+    (void)filter;
+    rb_raise(rb_path2class("Seccomp::NotSupportedError"), "transactions unavailable");
+#endif
+}
+
+static VALUE
+seccomp_ext_filter_transaction_reject(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+#ifdef HAVE_SECCOMP_TRANSACTION_REJECT
+    (void)self;
+    seccomp_transaction_reject(filter->ctx);
+    if (filter->in_transaction)
+        filter->has_notification = filter->transaction_has_notification;
+    filter->in_transaction = 0;
+    return INT2NUM(0);
+#else
+    (void)self;
+    (void)filter;
+    rb_raise(rb_path2class("Seccomp::NotSupportedError"), "transactions unavailable");
+#endif
+}
+
+void
+seccomp_ext_init_filter(void)
+{
+    cSeccompContext = rb_define_class_under(mSeccompLowLevel, "Context", rb_cObject);
+    rb_undef_alloc_func(cSeccompContext);
+
+    rb_define_singleton_method(mSeccompLowLevel, "init", seccomp_ext_filter_init, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "release", seccomp_ext_filter_release, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "closed?", seccomp_ext_filter_closed, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "reset", seccomp_ext_filter_reset, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "merge", seccomp_ext_filter_merge, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "attr_get", seccomp_ext_filter_attr_get, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "attr_set", seccomp_ext_filter_attr_set, 3);
+    rb_define_singleton_method(mSeccompLowLevel, "arch_add", seccomp_ext_filter_arch_add, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "arch_remove", seccomp_ext_filter_arch_remove, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "arch_exist", seccomp_ext_filter_arch_exist, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "rule_add_array",
+                               seccomp_ext_filter_rule_add_array, 4);
+    rb_define_singleton_method(mSeccompLowLevel, "rule_add_exact_array",
+                               seccomp_ext_filter_rule_add_exact_array, 4);
+    rb_define_singleton_method(mSeccompLowLevel, "syscall_priority",
+                               seccomp_ext_filter_priority, 3);
+    rb_define_singleton_method(mSeccompLowLevel, "export_pfc",
+                               seccomp_ext_filter_export_pfc, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "export_bpf",
+                               seccomp_ext_filter_export_bpf, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "export_bpf_mem",
+                               seccomp_ext_filter_export_bpf_mem, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "precompute",
+                               seccomp_ext_filter_precompute, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "load", seccomp_ext_filter_load, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "loaded?", seccomp_ext_filter_loaded, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "transaction_start",
+                               seccomp_ext_filter_transaction_start, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "transaction_commit",
+                               seccomp_ext_filter_transaction_commit, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "transaction_reject",
+                               seccomp_ext_filter_transaction_reject, 1);
+}