seccomp-ruby 0.1.0

data/lib/seccomp/filter.rb

@@ -0,0 +1,425 @@
+# frozen_string_literal: true
+
+require "monitor"
+
+module Seccomp
+  # Mutable seccomp filter with automatic native-resource management.
+  class Filter
+    include MonitorMixin
+    include Attributes
+    include Arg::DSL
+    include DSL
+
+    NOTIFICATION_MONITOR = Monitor.new
+    private_constant :NOTIFICATION_MONITOR
+
+    # @param default_action [Symbol, Integer] default filter action
+    # @return [void]
+    # @raise [Error] if native initialization fails
+    # @example `Filter.new(:allow)`
+    def initialize(default_action = :kill_process)
+      super()
+      @default_action = Action.resolve(default_action)
+      @notification_rule = @default_action == Action::NOTIFY
+      @listener_active = false
+      @notification_receive_lock = Mutex.new
+      @context = LowLevel.init(@default_action)
+    end
+
+    # @param default_action [Symbol, Integer] default action
+    # @yield [Filter] filter closed after the block
+    # @return [Object, Filter] block result, or a filter without a block
+    # @raise [Error] if initialization fails
+    # @example `Filter.open(:allow) { |filter| filter.allow(:read) }`
+    def self.open(default_action = :kill_process)
+      filter = new(default_action)
+      return filter unless block_given?
+
+      begin
+        yield filter
+      ensure
+        filter.close
+      end
+    end
+
+    # @return [nil]
+    # @example `filter.close`
+    def close
+      NOTIFICATION_MONITOR.synchronize do
+        synchronize do
+          LowLevel.release(@context)
+          @listener_active = false
+          nil
+        end
+      end
+    end
+
+    # @return [Boolean] whether native resources were released
+    # @example `filter.closed?`
+    def closed?
+      synchronize { LowLevel.closed?(@context) }
+    end
+
+    # @param default_action [Symbol, Integer, nil] replacement action
+    # @return [Filter] receiver
+    # @raise [Error] if reset fails
+    # @example `filter.reset(:allow)`
+    def reset(default_action = nil)
+      synchronize do
+        action = Action.resolve(default_action.nil? ? @default_action : default_action)
+        ensure_notification_tsync_supported!(notification_action: action == Action::NOTIFY)
+        Error.check!(LowLevel.reset(@context, action), call: "seccomp_reset")
+        @default_action = action
+        @notification_rule = action == Action::NOTIFY
+      end
+      self
+    end
+
+    # @param other [Filter] source consumed on success
+    # @return [Filter] receiver
+    # @raise [Error] if filters are incompatible
+    # @raise [TypeError] unless other is a Filter
+    # @example `destination.merge!(source)`
+    def merge!(other)
+      raise TypeError, "other must be a Seccomp::Filter" unless other.is_a?(Filter)
+      raise ArgumentError, "cannot merge a filter into itself" if equal?(other)
+
+      first, second = [self, other].sort_by(&:object_id)
+      first.synchronize do
+        second.synchronize do
+          notification_rule = @notification_rule || other.instance_variable_get(:@notification_rule)
+          if notification_rule
+            ensure_notification_tsync_supported!(notification_action: true,
+                                                 tsync: tsync? || other.tsync?)
+          end
+          Error.check!(LowLevel.merge(@context, other.__send__(:context)), call: "seccomp_merge")
+          merge_state_from(other)
+        end
+      end
+      self
+    end
+
+    # @param arch [Symbol, String, Integer] architecture
+    # @return [Filter] receiver
+    # @raise [Error] if it cannot be added
+    # @example `filter.add_arch(:x86)`
+    def add_arch(arch)
+      change_arch(:arch_add, arch)
+    end
+
+    # @param arch [Symbol, String, Integer] architecture
+    # @return [Filter] receiver
+    # @raise [Error] if it cannot be removed
+    # @example `filter.remove_arch(:x86)`
+    def remove_arch(arch)
+      change_arch(:arch_remove, arch)
+    end
+
+    # @param arch [Symbol, String, Integer] architecture
+    # @return [Boolean] whether present
+    # @raise [Error] if the query fails
+    # @example `filter.arch?(:x86_64)`
+    def arch?(arch)
+      synchronize do
+        result = LowLevel.arch_exist(@context, Arch.resolve(arch))
+        return true if result.zero?
+        return false if result == -Errno::EEXIST::Errno
+
+        Error.check!(result, call: "seccomp_arch_exist", hint: "architecture #{arch}")
+      end
+    end
+
+    # @return [Array<Symbol>] configured architectures
+    # @raise [Error] if a query fails
+    # @example `filter.archs`
+    def archs
+      synchronize { Arch.all.keys.select { |arch| arch != :native && arch?(arch) } }
+    end
+
+    # @param action [Symbol, Integer, Array] rule action
+    # @param syscall [Symbol, String, Integer] syscall
+    # @param comparisons [Array<ArgCmp>] argument comparisons
+    # @return [Filter] receiver
+    # @raise [Error] if the rule is invalid
+    # @example `filter.add_rule(:allow, :write, filter.arg(0).eq(1))`
+    def add_rule(action, syscall, *comparisons)
+      add_rule_with(:rule_add_array, action, syscall, comparisons)
+    end
+
+    # @param action [Symbol, Integer, Array] rule action
+    # @param syscall [Symbol, String, Integer] syscall
+    # @param comparisons [Array<ArgCmp>] argument comparisons
+    # @return [Filter] receiver
+    # @raise [Error] if an exact rule cannot be represented
+    # @example `filter.add_rule_exact(:allow, :write)`
+    def add_rule_exact(action, syscall, *comparisons)
+      add_rule_with(:rule_add_exact_array, action, syscall, comparisons)
+    end
+
+    # @param syscall [Symbol, String, Integer] first syscall
+    # @param arguments [Array] additional syscalls followed by comparisons
+    # @return [Filter] receiver
+    # @raise [Error] if a rule is invalid
+    # @example `filter.allow(:read, :write)`
+    def allow(syscall, *arguments)
+      comparisons = arguments.drop_while { |argument| !argument.is_a?(ArgCmp) }
+      syscalls = [syscall, *arguments.take(arguments.length - comparisons.length)]
+      raise TypeError, "syscalls must precede comparisons" unless comparisons.all?(ArgCmp)
+
+      synchronize { syscalls.each { |name| add_rule(:allow, name, *comparisons) } }
+      self
+    end
+
+    # @param syscall [Symbol, String, Integer] syscall
+    # @param comparisons [Array<ArgCmp>] argument comparisons
+    # @param errno [Integer, SystemCallError, Class] denial errno
+    # @return [Filter] receiver
+    # @raise [Error] if the rule is invalid
+    # @example `filter.deny(:ptrace, errno: Errno::EPERM)`
+    def deny(syscall, *comparisons, errno: Errno::EPERM)
+      add_rule(Action.errno(errno), syscall, *comparisons)
+    end
+
+    # @param syscall [Symbol, String, Integer] syscall
+    # @param comparisons [Array<ArgCmp>] argument comparisons
+    # @return [Filter] receiver
+    # @raise [Error] if the rule is invalid
+    # @example `filter.kill(:ptrace)`
+    def kill(syscall, *comparisons)
+      add_rule(:kill_process, syscall, *comparisons)
+    end
+
+    # @param syscall [Symbol, String, Integer] syscall
+    # @param comparisons [Array<ArgCmp>] argument comparisons
+    # @return [Filter] receiver
+    # @raise [Error] if the rule is invalid
+    # @example `filter.log(:socket)`
+    def log(syscall, *comparisons)
+      add_rule(:log, syscall, *comparisons)
+    end
+
+    # @param syscall [Symbol, String, Integer] syscall
+    # @param comparisons [Array<ArgCmp>] argument comparisons
+    # @return [Filter] receiver
+    # @raise [Error] if notifications are unsupported
+    # @example `filter.notify(:openat)`
+    def notify(syscall, *comparisons)
+      add_rule(:notify, syscall, *comparisons)
+    end
+
+    # @param syscall [Symbol, String, Integer] syscall
+    # @param comparisons [Array<ArgCmp>] argument comparisons
+    # @return [Filter] receiver
+    # @raise [Error] if the rule is invalid
+    # @example `filter.trap(:ptrace)`
+    def trap(syscall, *comparisons)
+      add_rule(:trap, syscall, *comparisons)
+    end
+
+    # @param syscall [Symbol, String, Integer] syscall
+    # @param value [Integer] trace payload
+    # @param comparisons [Array<ArgCmp>] argument comparisons
+    # @return [Filter] receiver
+    # @raise [Error] if the rule is invalid
+    # @example `filter.trace(:ptrace, 42)`
+    def trace(syscall, value, *comparisons)
+      add_rule(Action.trace(value), syscall, *comparisons)
+    end
+
+    # @param syscall [Symbol, String, Integer] syscall
+    # @param value [Integer] priority from 0 through 255
+    # @return [Filter] receiver
+    # @raise [Error] if rejected
+    # @example `filter.priority(:write, 100)`
+    def priority(syscall, value)
+      synchronize do
+        Error.check!(LowLevel.syscall_priority(@context, Syscall.number(syscall), value),
+                     call: "seccomp_syscall_priority", hint: "syscall #{syscall}")
+      end
+      self
+    end
+
+    # @param io [IO] writable IO
+    # @return [nil]
+    # @raise [Error] if export fails
+    # @example `filter.export_pfc($stdout)`
+    def export_pfc(io)
+      export_to(:export_pfc, io)
+    end
+
+    # @param io [IO] writable binary IO
+    # @return [nil]
+    # @raise [Error] if export fails
+    # @example `filter.export_bpf(file)`
+    def export_bpf(io)
+      export_to(:export_bpf, io)
+    end
+
+    # @return [String] pseudo filter code
+    # @raise [Error] if export fails
+    # @example `puts filter.to_pfc`
+    def to_pfc
+      export_string(:export_pfc)
+    end
+
+    # @return [String] binary BPF program
+    # @raise [Error] if export fails
+    # @example `filter.to_bpf.bytesize`
+    def to_bpf
+      if Seccomp.supports?(:bpf_mem)
+        synchronize do
+          rc, result = LowLevel.export_bpf_mem(@context)
+          Error.check!(rc, call: "seccomp_export_bpf_mem")
+          result
+        end
+      else
+        export_string(:export_bpf, binmode: true)
+      end
+    end
+
+    # @return [Filter] receiver
+    # @raise [NotSupportedError] when unavailable
+    # @example `filter.precompute`
+    def precompute
+      synchronize do
+        Error.check!(LowLevel.precompute(@context), call: "seccomp_precompute")
+      end
+      self
+    end
+
+    # @return [nil]
+    # @raise [Error] if the irreversible load fails
+    # @example `fork { filter.load!; Process.exit!(0) }`
+    def load!
+      NOTIFICATION_MONITOR.synchronize do
+        synchronize do
+          ensure_notification_tsync_supported!
+          if notification_action? && LowLevel.notify_fd(@context) >= 0
+            raise NotificationError, "a notification listener is already active"
+          end
+
+          Error.check!(LowLevel.load(@context), call: "seccomp_load")
+          @listener_active ||= @notification_rule
+        end
+      end
+      nil
+    end
+
+    # @return [Boolean] whether load succeeded at least once
+    # @example `filter.loaded?`
+    def loaded?
+      synchronize { LowLevel.loaded?(@context) }
+    end
+
+    # @yield transactional filter changes
+    # @return [Object] block result
+    # @raise [NotSupportedError] when unavailable
+    # @example `filter.transaction { filter.allow(:read) }`
+    def transaction
+      synchronize do
+        raise ArgumentError, "nested transactions are not allowed" if @in_transaction
+
+        previous_notification_rule = @notification_rule
+        begin
+          Error.check!(LowLevel.transaction_start(@context), call: "seccomp_transaction_start")
+          @in_transaction = true
+          result = yield
+          Error.check!(LowLevel.transaction_commit(@context), call: "seccomp_transaction_commit")
+          committed = true
+          result
+        ensure
+          LowLevel.transaction_reject(@context) if @in_transaction && !committed && !closed?
+          @notification_rule = previous_notification_rule unless committed
+          @in_transaction = false
+        end
+      end
+    end
+
+    # @return [Notifier] notification listener
+    # @raise [NotificationError] before loading or without a listener
+    # @example `notifier = filter.notifier`
+    def notifier
+      NOTIFICATION_MONITOR.synchronize do
+        synchronize do
+          raise NotificationError, "filter has not been loaded" unless loaded?
+          unless @listener_active
+            raise NotificationError, "filter has no active notification listener"
+          end
+
+          fd = LowLevel.notify_fd(@context)
+          if fd.negative?
+            raise NotificationError.new("seccomp_notify_fd failed", errno: -fd,
+                                                                    call: "seccomp_notify_fd")
+          end
+          Notifier.new(self, fd)
+        end
+      end
+    end
+
+    protected
+
+    attr_reader :context, :notification_receive_lock
+
+    private
+
+    def add_rule_with(operation, action, syscall, comparisons)
+      action = Action.resolve(action)
+      encoded = comparisons.map do |comparison|
+        raise TypeError, "comparison must be a Seccomp::ArgCmp" unless comparison.is_a?(ArgCmp)
+
+        comparison.to_a
+      end
+      synchronize do
+        ensure_notification_tsync_supported!(notification_action: true) if action == Action::NOTIFY
+        Error.check!(LowLevel.public_send(operation, @context, action,
+                                          Syscall.number(syscall), encoded),
+                     call: "seccomp_#{operation}", hint: "syscall #{syscall}")
+        @notification_rule = true if action == Action::NOTIFY
+      end
+      self
+    end
+
+    def export_to(operation, io)
+      fd = io.fileno
+      synchronize do
+        Error.check!(LowLevel.public_send(operation, @context, fd),
+                     call: "seccomp_#{operation}")
+      end
+      io.flush
+      nil
+    end
+
+    def notification_action? = @notification_rule
+
+    def merge_state_from(other)
+      @notification_rule ||= other.instance_variable_get(:@notification_rule)
+      @listener_active ||= other.instance_variable_get(:@listener_active)
+      other.instance_variable_set(:@listener_active, false)
+    end
+
+    def ensure_notification_tsync_supported!(notification_action: notification_action?, tsync: nil)
+      return unless notification_action
+      return unless (tsync.nil? ? tsync? : tsync) && Seccomp.api_level < 6
+
+      raise NotSupportedError, "tsync with notifications requires libseccomp API level 6"
+    end
+
+    def export_string(operation, binmode: false)
+      require "tempfile"
+      Tempfile.create("seccomp") do |file|
+        file.binmode if binmode
+        export_to(operation, file)
+        file.rewind
+        return file.read
+      end
+    end
+
+    def change_arch(operation, arch)
+      synchronize do
+        Error.check!(LowLevel.public_send(operation, @context, Arch.resolve(arch)),
+                     call: "seccomp_#{operation}", hint: "architecture #{arch}")
+      end
+      self
+    end
+  end
+end

data/lib/seccomp/low_level.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+
+module Seccomp
+  # Thin C-compatible API. Methods return negative errno values unless documented otherwise.
+  module LowLevel
+    # Opaque native filter context.
+    # rubocop:disable-next Lint/EmptyClass -- the C extension supplies its implementation.
+    class Context; end
+
+    # @!method self.version
+    #   @return [Array<Integer>] major, minor, and micro version
+    #   @example `LowLevel.version #=> [2, 6, 1]`
+    # @!method self.api_get
+    #   @return [Integer] runtime API level
+    #   @example `LowLevel.api_get`
+    # @!method self.api_set(level)
+    #   @param level [Integer]
+    #   @return [Integer] raw return code
+    #   @raise [RangeError] for an invalid integer
+    #   @example `LowLevel.api_set(6)`
+    # @!method self.supports?(feature)
+    #   @param feature [Symbol]
+    #   @return [Boolean]
+    #   @example `LowLevel.supports?(:notify)`
+    # @!method self.init(action)
+    #   @param action [Integer]
+    #   @return [Context]
+    #   @raise [OutOfMemoryError] if allocation fails
+    #   @example `LowLevel.init(Action::ALLOW)`
+    # @!method self.release(context)
+    #   @param context [Context]
+    #   @return [nil]
+    #   @example `LowLevel.release(context)`
+    # @!method self.closed?(context)
+    #   @param context [Context]
+    #   @return [Boolean]
+    #   @example `LowLevel.closed?(context)`
+    # @!method self.reset(context, action)
+    #   @param context [Context]
+    #   @param action [Integer]
+    #   @return [Integer] raw return code
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.reset(context, Action::ALLOW)`
+    # @!method self.merge(destination, source)
+    #   @param destination [Context]
+    #   @param source [Context]
+    #   @return [Integer] raw return code
+    #   @raise [ClosedFilterError] if either context is released
+    #   @example `LowLevel.merge(destination, source)`
+    # @!method self.attr_get(context, attribute)
+    #   @param context [Context]
+    #   @param attribute [Integer]
+    #   @return [Array(Integer, Integer)] raw return code and value
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.attr_get(context, FilterAttr::CTL_NNP)`
+    # @!method self.attr_set(context, attribute, value)
+    #   @param context [Context]
+    #   @param attribute [Integer]
+    #   @param value [Integer]
+    #   @return [Integer] raw return code
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.attr_set(context, FilterAttr::CTL_NNP, 1)`
+    # @!method self.arch_add(context, arch)
+    #   @param context [Context]
+    #   @param arch [Integer]
+    #   @return [Integer] raw return code
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.arch_add(context, Arch::X86)`
+    # @!method self.arch_remove(context, arch)
+    #   @param context [Context]
+    #   @param arch [Integer]
+    #   @return [Integer] raw return code
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.arch_remove(context, Arch::X86)`
+    # @!method self.arch_exist(context, arch)
+    #   @param context [Context]
+    #   @param arch [Integer]
+    #   @return [Integer] raw return code
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.arch_exist(context, Arch::X86)`
+    # @!method self.arch_resolve_name(name)
+    #   @param name [String]
+    #   @return [Integer] architecture token, or zero
+    #   @example `LowLevel.arch_resolve_name("x86_64")`
+    # @!method self.arch_native
+    #   @return [Integer] native architecture token
+    #   @example `LowLevel.arch_native`
+    # @!method self.syscall_resolve_name(name)
+    #   @param name [String]
+    #   @return [Integer] syscall number
+    #   @example `LowLevel.syscall_resolve_name("write")`
+    # @!method self.syscall_resolve_name_arch(arch, name)
+    #   @param arch [Integer]
+    #   @param name [String]
+    #   @return [Integer] syscall number
+    #   @example `LowLevel.syscall_resolve_name_arch(Arch::X86, "write")`
+    # @!method self.syscall_resolve_name_rewrite(arch, name)
+    #   @param arch [Integer]
+    #   @param name [String]
+    #   @return [Integer] rewritten syscall number
+    #   @example `LowLevel.syscall_resolve_name_rewrite(Arch::X86, "socket")`
+    # @!method self.syscall_resolve_num_arch(arch, number)
+    #   @param arch [Integer]
+    #   @param number [Integer]
+    #   @return [String, nil] syscall name
+    #   @example `LowLevel.syscall_resolve_num_arch(Arch::X86_64, 1)`
+    # @!method self.rule_add_array(context, action, syscall, comparisons)
+    #   @param context [Context]
+    #   @param action [Integer]
+    #   @param syscall [Integer]
+    #   @param comparisons [Array<Array<Integer>>]
+    #   @return [Integer] raw return code
+    #   @raise [ArgumentError] for malformed comparisons
+    #   @example `LowLevel.rule_add_array(context, Action::ALLOW, 1, [])`
+    # @!method self.rule_add_exact_array(context, action, syscall, comparisons)
+    #   @param context [Context]
+    #   @param action [Integer]
+    #   @param syscall [Integer]
+    #   @param comparisons [Array<Array<Integer>>]
+    #   @return [Integer] raw return code
+    #   @raise [ArgumentError] for malformed comparisons
+    #   @example `LowLevel.rule_add_exact_array(context, Action::ALLOW, 1, [])`
+    # @!method self.syscall_priority(context, syscall, priority)
+    #   @param context [Context]
+    #   @param syscall [Integer]
+    #   @param priority [Integer]
+    #   @return [Integer] raw return code
+    #   @raise [RangeError] outside 0..255
+    #   @example `LowLevel.syscall_priority(context, 1, 100)`
+    # @!method self.export_pfc(context, fd)
+    #   @param context [Context]
+    #   @param fd [Integer]
+    #   @return [Integer] raw return code
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.export_pfc(context, io.fileno)`
+    # @!method self.export_bpf(context, fd)
+    #   @param context [Context]
+    #   @param fd [Integer]
+    #   @return [Integer] raw return code
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.export_bpf(context, io.fileno)`
+    # @!method self.export_bpf_mem(context)
+    #   @param context [Context]
+    #   @return [Array(Integer, String)] raw return code and BPF
+    #   @raise [NotSupportedError] when unavailable
+    #   @example `LowLevel.export_bpf_mem(context)`
+    # @!method self.precompute(context)
+    #   @param context [Context]
+    #   @return [Integer] raw return code
+    #   @raise [NotSupportedError] when unavailable
+    #   @example `LowLevel.precompute(context)`
+    # @!method self.load(context)
+    #   @param context [Context]
+    #   @return [Integer] raw return code
+    #   @raise [ClosedFilterError] if released
+    #   @example `fork { LowLevel.load(context) }`
+    # @!method self.loaded?(context)
+    #   @param context [Context]
+    #   @return [Boolean]
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.loaded?(context)`
+    # @!method self.transaction_start(context)
+    #   @param context [Context]
+    #   @return [Integer] raw return code
+    #   @raise [NotSupportedError] when unavailable
+    #   @example `LowLevel.transaction_start(context)`
+    # @!method self.transaction_commit(context)
+    #   @param context [Context]
+    #   @return [Integer] raw return code
+    #   @raise [NotSupportedError] when unavailable
+    #   @example `LowLevel.transaction_commit(context)`
+    # @!method self.transaction_reject(context)
+    #   @param context [Context]
+    #   @return [Integer] zero
+    #   @raise [NotSupportedError] when unavailable
+    #   @example `LowLevel.transaction_reject(context)`
+    # @!method self.notify_fd(context)
+    #   @param context [Context]
+    #   @return [Integer] listener fd or negative errno
+    #   @raise [ClosedFilterError] if released
+    #   @example `LowLevel.notify_fd(context)`
+    # @!method self.notify_receive(fd)
+    #   @param fd [Integer]
+    #   @return [Array(Integer, Hash)] raw return code and request
+    #   @example `LowLevel.notify_receive(fd)`
+    # @!method self.notify_respond(fd, id, value, error, flags)
+    #   @param fd [Integer]
+    #   @param id [Integer]
+    #   @param value [Integer]
+    #   @param error [Integer]
+    #   @param flags [Integer]
+    #   @return [Integer] raw return code
+    #   @example `LowLevel.notify_respond(fd, id, 0, 0, 0)`
+    # @!method self.notify_id_valid(fd, id)
+    #   @param fd [Integer]
+    #   @param id [Integer]
+    #   @return [Integer] raw return code
+    #   @example `LowLevel.notify_id_valid(fd, id)`
+    # @!method self.notify_addfd(fd, id, flags, source_fd, newfd, newfd_flags)
+    #   @param fd [Integer]
+    #   @param id [Integer]
+    #   @param flags [Integer]
+    #   @param source_fd [Integer]
+    #   @param newfd [Integer]
+    #   @param newfd_flags [Integer]
+    #   @return [Integer] installed fd or negative errno
+    #   @raise [NotSupportedError] when unavailable
+    #   @example `LowLevel.notify_addfd(fd, id, 0, source.fileno, 0, 0)`
+  end
+end