seccomp-ruby 0.1.0

data/ext/seccomp_ext/notify.c

@@ -0,0 +1,184 @@
+#include "seccomp_ext.h"
+#include <errno.h>
+#include <ruby/thread.h>
+#include <string.h>
+#include <sys/ioctl.h>
+
+struct seccomp_receive_args {
+    int fd;
+    struct seccomp_notif *request;
+    int rc;
+};
+
+static void *
+seccomp_ext_notify_receive_without_gvl(void *pointer)
+{
+    struct seccomp_receive_args *args = pointer;
+
+    args->rc = seccomp_notify_receive(args->fd, args->request);
+    return NULL;
+}
+
+static VALUE
+seccomp_ext_notify_receive_free(VALUE pointer)
+{
+    struct seccomp_receive_args *args = (struct seccomp_receive_args *)pointer;
+
+    seccomp_notify_free(args->request, NULL);
+    args->request = NULL;
+    return Qnil;
+}
+
+static VALUE
+seccomp_ext_notify_receive_call(VALUE pointer)
+{
+    struct seccomp_receive_args *args = (struct seccomp_receive_args *)pointer;
+    VALUE result;
+    VALUE values;
+    uint64_t request_args[6];
+    int index;
+
+    do {
+        rb_thread_call_without_gvl(seccomp_ext_notify_receive_without_gvl,
+                                   args, RUBY_UBF_IO, NULL);
+    } while (args->rc == -EINTR);
+    if (args->rc < 0)
+        return rb_ary_new_from_args(2, INT2NUM(args->rc), Qnil);
+
+    result = rb_hash_new();
+    rb_hash_aset(result, ID2SYM(rb_intern("id")), ULL2NUM(args->request->id));
+    rb_hash_aset(result, ID2SYM(rb_intern("pid")), UINT2NUM(args->request->pid));
+    rb_hash_aset(result, ID2SYM(rb_intern("flags")), UINT2NUM(args->request->flags));
+    rb_hash_aset(result, ID2SYM(rb_intern("syscall")), INT2NUM(args->request->data.nr));
+    rb_hash_aset(result, ID2SYM(rb_intern("arch")),
+                 seccomp_ext_uint32(args->request->data.arch));
+    rb_hash_aset(result, ID2SYM(rb_intern("instruction_pointer")),
+                 ULL2NUM(args->request->data.instruction_pointer));
+    memcpy(request_args, args->request->data.args, sizeof(request_args));
+    values = rb_ary_new_capa(6);
+    for (index = 0; index < 6; index++)
+        rb_ary_push(values, ULL2NUM(request_args[index]));
+    rb_hash_aset(result, ID2SYM(rb_intern("args")), values);
+    return rb_ary_new_from_args(2, INT2NUM(0), result);
+}
+
+static VALUE
+seccomp_ext_notify_fd(VALUE self, VALUE object)
+{
+    seccomp_filter_t *filter = seccomp_ext_filter_check(object);
+
+    (void)self;
+    return INT2NUM(seccomp_notify_fd(filter->ctx));
+}
+
+static VALUE
+seccomp_ext_notify_receive(VALUE self, VALUE fd_value)
+{
+    struct seccomp_receive_args args = {
+        .fd = seccomp_ext_num_to_int(fd_value, "fd"),
+        .request = NULL,
+        .rc = 0,
+    };
+    int rc;
+
+    (void)self;
+    rc = seccomp_notify_alloc(&args.request, NULL);
+    if (rc < 0)
+        return rb_ary_new_from_args(2, INT2NUM(rc), Qnil);
+    return rb_ensure(seccomp_ext_notify_receive_call, (VALUE)&args,
+                     seccomp_ext_notify_receive_free, (VALUE)&args);
+}
+
+static VALUE
+seccomp_ext_notify_respond(VALUE self, VALUE fd_value, VALUE id, VALUE value,
+                           VALUE error, VALUE flags)
+{
+    struct seccomp_notif_resp *response = NULL;
+    uint64_t response_id;
+    int64_t response_value;
+    int response_error;
+    uint32_t response_flags;
+    int fd;
+    int rc;
+
+    (void)self;
+    response_id = seccomp_ext_num_to_uint64(id, "id");
+    if (!RB_INTEGER_TYPE_P(value))
+        rb_raise(rb_eTypeError, "value must be an Integer");
+    response_value = NUM2LL(value);
+    response_error = seccomp_ext_num_to_int(error, "error");
+    response_flags = seccomp_ext_num_to_uint32(flags, "flags");
+    fd = seccomp_ext_num_to_int(fd_value, "fd");
+    rc = seccomp_notify_alloc(NULL, &response);
+    if (rc < 0)
+        return INT2NUM(rc);
+    response->id = response_id;
+    response->val = response_value;
+    response->error = response_error;
+    response->flags = response_flags;
+    rc = seccomp_notify_respond(fd, response);
+    seccomp_notify_free(NULL, response);
+    return INT2NUM(rc);
+}
+
+static VALUE
+seccomp_ext_notify_id_valid(VALUE self, VALUE fd_value, VALUE id)
+{
+    (void)self;
+    return INT2NUM(seccomp_notify_id_valid(seccomp_ext_num_to_int(fd_value, "fd"),
+                                           seccomp_ext_num_to_uint64(id, "id")));
+}
+
+static VALUE
+seccomp_ext_notify_addfd(VALUE self, VALUE fd_value, VALUE id, VALUE flags,
+                         VALUE source_fd, VALUE new_fd, VALUE new_fd_flags)
+{
+#if defined(HAVE_SECCOMP_NOTIFY_ADDFD) || defined(HAVE_SECCOMP_IOCTL_NOTIF_ADDFD)
+    uint32_t target_flags = seccomp_ext_num_to_uint32(new_fd_flags, "new fd flags");
+    struct seccomp_notif_addfd addfd = {
+        .id = seccomp_ext_num_to_uint64(id, "id"),
+        .flags = seccomp_ext_num_to_uint32(flags, "flags"),
+        .srcfd = seccomp_ext_num_to_uint32(source_fd, "source fd"),
+        .newfd = seccomp_ext_num_to_uint32(new_fd, "new fd"),
+#ifdef HAVE_STRUCT_SECCOMP_NOTIF_ADDFD_NEWFD_FLAGS
+        .newfd_flags = target_flags,
+#endif
+    };
+    int fd = seccomp_ext_num_to_int(fd_value, "fd");
+
+    (void)self;
+#ifndef HAVE_STRUCT_SECCOMP_NOTIF_ADDFD_NEWFD_FLAGS
+    if (target_flags != 0)
+        rb_raise(rb_path2class("Seccomp::NotSupportedError"),
+                 "new fd flags are unavailable with these headers");
+#endif
+#ifdef HAVE_SECCOMP_NOTIFY_ADDFD
+    return INT2NUM(seccomp_notify_addfd(fd, &addfd));
+#else
+    {
+        int rc = ioctl(fd, SECCOMP_IOCTL_NOTIF_ADDFD, &addfd);
+
+        return INT2NUM(rc < 0 ? -errno : rc);
+    }
+#endif
+#else
+    (void)self;
+    (void)fd_value;
+    (void)id;
+    (void)flags;
+    (void)source_fd;
+    (void)new_fd;
+    (void)new_fd_flags;
+    rb_raise(rb_path2class("Seccomp::NotSupportedError"), "seccomp_notify_addfd unavailable");
+#endif
+}
+
+void
+seccomp_ext_init_notify(void)
+{
+    rb_define_singleton_method(mSeccompLowLevel, "notify_fd", seccomp_ext_notify_fd, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "notify_receive", seccomp_ext_notify_receive, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "notify_respond", seccomp_ext_notify_respond, 5);
+    rb_define_singleton_method(mSeccompLowLevel, "notify_id_valid", seccomp_ext_notify_id_valid, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "notify_addfd", seccomp_ext_notify_addfd, 6);
+}

data/ext/seccomp_ext/seccomp_ext.c

@@ -0,0 +1,20 @@
+#include "seccomp_ext.h"
+
+VALUE mSeccomp;
+VALUE mSeccompLowLevel;
+VALUE cSeccompContext;
+VALUE eSeccompClosedFilterError;
+
+void
+Init_seccomp_ext(void)
+{
+    mSeccomp = rb_define_module("Seccomp");
+    mSeccompLowLevel = rb_define_module_under(mSeccomp, "LowLevel");
+    eSeccompClosedFilterError = rb_path2class("Seccomp::ClosedFilterError");
+
+    seccomp_ext_init_util();
+    seccomp_ext_init_constants();
+    seccomp_ext_init_filter();
+    seccomp_ext_init_syscall();
+    seccomp_ext_init_notify();
+}

data/ext/seccomp_ext/seccomp_ext.h

@@ -0,0 +1,35 @@
+#ifndef SECCOMP_EXT_H
+#define SECCOMP_EXT_H
+
+#include "ruby.h"
+#include <seccomp.h>
+
+typedef struct {
+    scmp_filter_ctx ctx;
+    int loaded;
+    int notify_fd;
+    int in_transaction;
+    int has_notification;
+    int notification_used;
+    int transaction_has_notification;
+} seccomp_filter_t;
+
+extern VALUE mSeccomp;
+extern VALUE mSeccompLowLevel;
+extern VALUE cSeccompContext;
+extern VALUE eSeccompClosedFilterError;
+extern const rb_data_type_t seccomp_filter_type;
+
+seccomp_filter_t *seccomp_ext_filter_check(VALUE object);
+VALUE seccomp_ext_uint32(uint32_t value);
+uint32_t seccomp_ext_num_to_uint32(VALUE value, const char *name);
+int seccomp_ext_num_to_int(VALUE value, const char *name);
+uint64_t seccomp_ext_num_to_uint64(VALUE value, const char *name);
+
+void seccomp_ext_init_constants(void);
+void seccomp_ext_init_filter(void);
+void seccomp_ext_init_syscall(void);
+void seccomp_ext_init_notify(void);
+void seccomp_ext_init_util(void);
+
+#endif

data/ext/seccomp_ext/syscall.c

@@ -0,0 +1,86 @@
+#include "seccomp_ext.h"
+#include <stdlib.h>
+
+static VALUE
+seccomp_ext_syscall_name_to_string(VALUE pointer)
+{
+    return rb_str_new_cstr((char *)pointer);
+}
+
+static VALUE
+seccomp_ext_syscall_name_free(VALUE pointer)
+{
+    free((char *)pointer);
+    return Qnil;
+}
+
+static VALUE
+seccomp_ext_arch_resolve_name(VALUE self, VALUE name)
+{
+    (void)self;
+    Check_Type(name, T_STRING);
+    return seccomp_ext_uint32(seccomp_arch_resolve_name(StringValueCStr(name)));
+}
+
+static VALUE
+seccomp_ext_arch_native(VALUE self)
+{
+    (void)self;
+    return seccomp_ext_uint32(seccomp_arch_native());
+}
+
+static VALUE
+seccomp_ext_syscall_resolve_name(VALUE self, VALUE name)
+{
+    (void)self;
+    Check_Type(name, T_STRING);
+    return INT2NUM(seccomp_syscall_resolve_name(StringValueCStr(name)));
+}
+
+static VALUE
+seccomp_ext_syscall_resolve_name_arch(VALUE self, VALUE arch, VALUE name)
+{
+    (void)self;
+    Check_Type(name, T_STRING);
+    return INT2NUM(seccomp_syscall_resolve_name_arch(
+        seccomp_ext_num_to_uint32(arch, "arch"), StringValueCStr(name)));
+}
+
+static VALUE
+seccomp_ext_syscall_resolve_name_rewrite(VALUE self, VALUE arch, VALUE name)
+{
+    (void)self;
+    Check_Type(name, T_STRING);
+    return INT2NUM(seccomp_syscall_resolve_name_rewrite(
+        seccomp_ext_num_to_uint32(arch, "arch"), StringValueCStr(name)));
+}
+
+static VALUE
+seccomp_ext_syscall_resolve_num_arch(VALUE self, VALUE arch, VALUE number)
+{
+    char *name;
+
+    (void)self;
+    name = seccomp_syscall_resolve_num_arch(seccomp_ext_num_to_uint32(arch, "arch"),
+                                            seccomp_ext_num_to_int(number, "number"));
+    if (name == NULL)
+        return Qnil;
+    return rb_ensure(seccomp_ext_syscall_name_to_string, (VALUE)name,
+                     seccomp_ext_syscall_name_free, (VALUE)name);
+}
+
+void
+seccomp_ext_init_syscall(void)
+{
+    rb_define_singleton_method(mSeccompLowLevel, "arch_resolve_name",
+                               seccomp_ext_arch_resolve_name, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "arch_native", seccomp_ext_arch_native, 0);
+    rb_define_singleton_method(mSeccompLowLevel, "syscall_resolve_name",
+                               seccomp_ext_syscall_resolve_name, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "syscall_resolve_name_arch",
+                               seccomp_ext_syscall_resolve_name_arch, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "syscall_resolve_name_rewrite",
+                               seccomp_ext_syscall_resolve_name_rewrite, 2);
+    rb_define_singleton_method(mSeccompLowLevel, "syscall_resolve_num_arch",
+                               seccomp_ext_syscall_resolve_num_arch, 2);
+}

data/ext/seccomp_ext/util.c

@@ -0,0 +1,110 @@
+#include "seccomp_ext.h"
+#include <limits.h>
+
+VALUE
+seccomp_ext_uint32(uint32_t value)
+{
+    return ULONG2NUM(value);
+}
+
+uint32_t
+seccomp_ext_num_to_uint32(VALUE value, const char *name)
+{
+    unsigned long long number;
+
+    if (!RB_INTEGER_TYPE_P(value))
+        rb_raise(rb_eTypeError, "%s must be an Integer", name);
+    number = NUM2ULL(value);
+    if (number > UINT32_MAX)
+        rb_raise(rb_eRangeError, "%s must fit in uint32", name);
+    return (uint32_t)number;
+}
+
+int
+seccomp_ext_num_to_int(VALUE value, const char *name)
+{
+    long long number;
+
+    if (!RB_INTEGER_TYPE_P(value))
+        rb_raise(rb_eTypeError, "%s must be an Integer", name);
+    number = NUM2LL(value);
+    if (number < INT_MIN || number > INT_MAX)
+        rb_raise(rb_eRangeError, "%s must fit in int", name);
+    return (int)number;
+}
+
+uint64_t
+seccomp_ext_num_to_uint64(VALUE value, const char *name)
+{
+    if (!RB_INTEGER_TYPE_P(value))
+        rb_raise(rb_eTypeError, "%s must be an Integer", name);
+    if (RTEST(rb_funcall(value, rb_intern("<"), 1, INT2FIX(0))))
+        rb_raise(rb_eRangeError, "%s must not be negative", name);
+    return NUM2ULL(value);
+}
+
+static VALUE
+seccomp_ext_version(VALUE self)
+{
+    const struct scmp_version *version = seccomp_version();
+
+    (void)self;
+    return rb_ary_new_from_args(3, UINT2NUM(version->major),
+                               UINT2NUM(version->minor), UINT2NUM(version->micro));
+}
+
+static VALUE
+seccomp_ext_api_get(VALUE self)
+{
+    (void)self;
+    return UINT2NUM(seccomp_api_get());
+}
+
+static VALUE
+seccomp_ext_api_set(VALUE self, VALUE level)
+{
+    (void)self;
+    return INT2NUM(seccomp_api_set(seccomp_ext_num_to_uint32(level, "level")));
+}
+
+static VALUE
+seccomp_ext_supports(VALUE self, VALUE feature)
+{
+    ID id;
+
+    (void)self;
+    if (!SYMBOL_P(feature))
+        rb_raise(rb_eTypeError, "feature must be a Symbol");
+    id = SYM2ID(feature);
+#ifdef HAVE_SECCOMP_PRECOMPUTE
+    if (id == rb_intern("precompute")) return Qtrue;
+#endif
+#if defined(HAVE_SECCOMP_NOTIFY_ALLOC)
+    if (id == rb_intern("notify")) return Qtrue;
+#endif
+#if defined(HAVE_SECCOMP_NOTIFY_ADDFD) || defined(HAVE_SECCOMP_IOCTL_NOTIF_ADDFD)
+    if (id == rb_intern("notify_addfd")) return Qtrue;
+#endif
+#if defined(HAVE_SECCOMP_TRANSACTION_START) && defined(HAVE_SECCOMP_TRANSACTION_COMMIT) && defined(HAVE_SECCOMP_TRANSACTION_REJECT)
+    if (id == rb_intern("transaction")) return Qtrue;
+#endif
+#ifdef HAVE_SECCOMP_EXPORT_BPF_MEM
+    if (id == rb_intern("bpf_mem")) return Qtrue;
+#endif
+#ifdef HAVE_SCMP_ACT_TRAPX
+    if (id == rb_intern("trapx")) return Qtrue;
+#endif
+#ifdef HAVE_CONST_SCMP_FLTATR_CTL_WAITKILL
+    if (id == rb_intern("wait_killable")) return Qtrue;
+#endif
+    return Qfalse;
+}
+
+void
+seccomp_ext_init_util(void)
+{
+    rb_define_singleton_method(mSeccompLowLevel, "version", seccomp_ext_version, 0);
+    rb_define_singleton_method(mSeccompLowLevel, "api_get", seccomp_ext_api_get, 0);
+    rb_define_singleton_method(mSeccompLowLevel, "api_set", seccomp_ext_api_set, 1);
+    rb_define_singleton_method(mSeccompLowLevel, "supports?", seccomp_ext_supports, 1);
+}

data/lib/libseccomp.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require_relative "seccomp/version"
+require_relative "seccomp/errors"
+require_relative "seccomp/low_level"
+require "seccomp_ext"
+require_relative "seccomp/action"
+require_relative "seccomp/arch"
+require_relative "seccomp/syscall"
+require_relative "seccomp/arg"
+require_relative "seccomp/attributes"
+require_relative "seccomp/dsl"
+require_relative "seccomp/filter"
+require_relative "seccomp/notification"
+require_relative "seccomp/notifier"
+
+## Native bindings and Ruby-friendly APIs for libseccomp.
+module Seccomp
+  FEATURE_API_LEVELS = { notify: 5, notify_addfd: 5, wait_killable: 7 }.freeze
+  private_constant :FEATURE_API_LEVELS
+
+  ## Semantic version of the linked libseccomp library.
+  LibraryVersion = Struct.new(:major, :minor, :micro) do
+    # @return [String] dotted version string
+    # @example `Seccomp.library_version.to_s #=> "2.6.1"`
+    def to_s
+      values.join(".")
+    end
+  end
+
+  class << self
+    # @return [LibraryVersion] linked library version
+    # @example `Seccomp.library_version.major`
+    def library_version
+      LibraryVersion.new(*LowLevel.version)
+    end
+
+    # @return [Integer] runtime libseccomp API level
+    # @example `Seccomp.api_level #=> 6`
+    def api_level
+      LowLevel.api_get
+    end
+
+    # @param level [Integer] process-global API level
+    # @return [Integer] assigned level
+    # @raise [Error] if libseccomp rejects the level
+    # @example `Seccomp.api_level = 6`
+    def api_level=(level)
+      Error.check!(LowLevel.api_set(level), call: "seccomp_api_set")
+      level
+    end
+
+    # @param feature [Symbol] feature name
+    # @return [Boolean] whether the linked build provides it
+    # @example `Seccomp.supports?(:transaction)`
+    def supports?(feature)
+      required = FEATURE_API_LEVELS[feature]
+      LowLevel.supports?(feature) && (!required || api_level >= required)
+    end
+
+    # @param default [Symbol, Integer] default action
+    # @yield [Filter] configured filter for arity-one blocks
+    # @return [Filter] configured filter
+    # @raise [Error] if configuration fails
+    # @example `Seccomp.filter(default: :allow) { deny :ptrace }`
+    def filter(default: :kill_process, &block)
+      filter = Filter.new(default)
+      return filter unless block
+
+      block.arity.zero? ? filter.instance_eval(&block) : block.call(filter)
+      completed = true
+      filter
+    ensure
+      filter&.close if block && !completed
+    end
+  end
+end

data/lib/seccomp/action.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+module Seccomp
+  # Seccomp action constants and conversions.
+  module Action
+    # Mask for action payload data.
+    # @api private
+    DATA_MASK = 0xFFFF
+    # Base value for errno actions.
+    # @api private
+    ERRNO = 0x0005_0000
+    # Base value for trace actions.
+    # @api private
+    TRACE = 0x7FF0_0000
+    # Mask selecting an action without its payload.
+    # @api private
+    ACTION_MASK = 0xFFFF_0000
+    # Minimum runtime API level for newer actions.
+    # @api private
+    API_LEVELS = {
+      KILL_PROCESS => 3,
+      LOG => 3,
+      NOTIFY => 5
+    }.freeze
+
+    # Symbol-to-action lookup.
+    # @api private
+    NAMES = {
+      kill_process: KILL_PROCESS,
+      kill_thread: KILL_THREAD,
+      kill: KILL,
+      trap: TRAP,
+      notify: NOTIFY,
+      log: LOG,
+      allow: ALLOW
+    }.freeze
+
+    module_function
+
+    # @param value [Integer, SystemCallError, Class] positive or negative errno
+    # @return [Integer] SCMP_ACT_ERRNO action
+    # @raise [ArgumentError] for an invalid value
+    # @example `Action.errno(Errno::EPERM)`
+    def errno(value)
+      number = errno_number(value)
+      raise ArgumentError, "errno must not be zero" if number.zero?
+
+      ERRNO | data(number.abs)
+    end
+
+    # @param value [Integer] 16-bit trace payload
+    # @return [Integer] SCMP_ACT_TRACE action
+    # @raise [ArgumentError] outside 0..65535
+    # @example `Action.trace(42)`
+    def trace(value)
+      TRACE | data(value)
+    end
+
+    # @param value [Integer] optional 16-bit trap payload
+    # @return [Integer] SCMP_ACT_TRAP action
+    # @raise [NotSupportedError] when parameterized traps are unavailable
+    # @example `Action.trap(7)`
+    def trap(value = 0)
+      value = data(value)
+      return TRAP if value.zero?
+      raise NotSupportedError, "SCMP_ACT_TRAPX is not available" unless Seccomp.supports?(:trapx)
+
+      TRAP | value
+    end
+
+    # @param value [Symbol, Integer, Array] action representation
+    # @return [Integer] action constant
+    # @raise [ArgumentError] for an unknown action
+    # @raise [NotSupportedError] when the runtime API level is too low
+    # @example `Action.resolve([:errno, Errno::EPERM])`
+    def resolve(value)
+      action = if value.is_a?(Integer)
+                 value
+               elsif value.is_a?(Array)
+                 resolve_tuple(value)
+               else
+                 unless value.respond_to?(:to_sym)
+                   raise ArgumentError, "unknown action: #{value.inspect}"
+                 end
+
+                 NAMES.fetch(value.to_sym) do
+                   raise ArgumentError, "unknown action: #{value.inspect}"
+                 end
+               end
+      ensure_supported!(action)
+      action
+    end
+
+    def ensure_supported!(action)
+      if (action & ACTION_MASK) == TRAP && action.anybits?(DATA_MASK) && !Seccomp.supports?(:trapx)
+        raise NotSupportedError, "SCMP_ACT_TRAPX is not available"
+      end
+
+      required = API_LEVELS.fetch(action & ACTION_MASK, 1)
+      return if required == 1 || Seccomp.api_level >= required
+
+      raise NotSupportedError, "action requires libseccomp API level #{required}"
+    end
+    private_class_method :ensure_supported!
+
+    # @param value [Integer] action value
+    # @return [String] debug representation
+    # @example `Action.describe(Action.errno(1))`
+    def describe(value)
+      return "SCMP_ACT_ERRNO(#{value & DATA_MASK})" if (value & 0xFFFF_0000) == ERRNO
+      return "SCMP_ACT_TRACE(#{value & DATA_MASK})" if (value & 0xFFFF_0000) == TRACE
+
+      name = NAMES.key(value)
+      name ? "SCMP_ACT_#{name.to_s.upcase}" : format("0x%08x", value)
+    end
+
+    def errno_number(value)
+      number = if value.is_a?(Class) && value < SystemCallError
+                 value.const_get(:Errno, false) if value.const_defined?(:Errno, false)
+               elsif value.is_a?(SystemCallError)
+                 value.errno
+               else
+                 value
+               end
+      unless number.is_a?(Integer)
+        raise ArgumentError, "errno must be an Integer or system error with an errno"
+      end
+
+      number
+    end
+    private_class_method :errno_number
+
+    def data(value)
+      unless value.is_a?(Integer) && (0..DATA_MASK).cover?(value)
+        raise ArgumentError, "action data must be between 0 and 65535"
+      end
+
+      value
+    end
+    private_class_method :data
+
+    def resolve_tuple(tuple)
+      raise ArgumentError, "unknown action: #{tuple.inspect}" unless tuple.length == 2
+
+      type, value = tuple
+      return errno(value) if type == :errno
+      return trace(value) if type == :trace
+      return trap(value) if type == :trap
+
+      raise ArgumentError, "unknown action: #{tuple.inspect}"
+    end
+    private_class_method :resolve_tuple
+  end
+end