seccomp-tools 1.5.0 → 1.6.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +98 -18
- data/lib/seccomp-tools/asm/asm.rb +8 -6
- data/lib/seccomp-tools/asm/compiler.rb +130 -224
- data/lib/seccomp-tools/asm/sasm.tab.rb +780 -0
- data/lib/seccomp-tools/asm/sasm.y +175 -0
- data/lib/seccomp-tools/asm/scalar.rb +129 -0
- data/lib/seccomp-tools/asm/scanner.rb +163 -0
- data/lib/seccomp-tools/asm/statement.rb +32 -0
- data/lib/seccomp-tools/asm/token.rb +29 -0
- data/lib/seccomp-tools/bpf.rb +31 -7
- data/lib/seccomp-tools/cli/asm.rb +1 -1
- data/lib/seccomp-tools/cli/base.rb +4 -4
- data/lib/seccomp-tools/cli/disasm.rb +26 -2
- data/lib/seccomp-tools/const.rb +25 -4
- data/lib/seccomp-tools/consts/sys_nr/amd64.rb +1 -0
- data/lib/seccomp-tools/consts/sys_nr/s390x.rb +365 -0
- data/lib/seccomp-tools/disasm/context.rb +2 -2
- data/lib/seccomp-tools/disasm/disasm.rb +15 -9
- data/lib/seccomp-tools/dumper.rb +1 -2
- data/lib/seccomp-tools/emulator.rb +5 -10
- data/lib/seccomp-tools/error.rb +31 -0
- data/lib/seccomp-tools/instruction/base.rb +1 -1
- data/lib/seccomp-tools/instruction/jmp.rb +14 -1
- data/lib/seccomp-tools/instruction/ld.rb +3 -1
- data/lib/seccomp-tools/syscall.rb +13 -8
- data/lib/seccomp-tools/templates/asm.s390x.asm +26 -0
- data/lib/seccomp-tools/util.rb +2 -1
- data/lib/seccomp-tools/version.rb +1 -1
- metadata +17 -15
- data/lib/seccomp-tools/asm/tokenizer.rb +0 -169
data/lib/seccomp-tools/util.rb
CHANGED
@@ -21,6 +21,7 @@ module SeccompTools
|
|
21
21
|
when /x86_64/ then :amd64
|
22
22
|
when /i386/ then :i386
|
23
23
|
when /aarch64/ then :aarch64
|
24
|
+
when /s390x/ then :s390x
|
24
25
|
else :unknown
|
25
26
|
end
|
26
27
|
end
|
@@ -78,7 +79,7 @@ module SeccompTools
|
|
78
79
|
# @return [String]
|
79
80
|
# Content of the file.
|
80
81
|
def template(filename)
|
81
|
-
|
82
|
+
File.binread(File.join(__dir__, 'templates', filename))
|
82
83
|
end
|
83
84
|
end
|
84
85
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: seccomp-tools
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.6.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- david942j
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2023-09-19 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: rake
|
@@ -58,34 +58,28 @@ dependencies:
|
|
58
58
|
requirements:
|
59
59
|
- - "~>"
|
60
60
|
- !ruby/object:Gem::Version
|
61
|
-
version: '1
|
61
|
+
version: '1'
|
62
62
|
type: :development
|
63
63
|
prerelease: false
|
64
64
|
version_requirements: !ruby/object:Gem::Requirement
|
65
65
|
requirements:
|
66
66
|
- - "~>"
|
67
67
|
- !ruby/object:Gem::Version
|
68
|
-
version: '1
|
68
|
+
version: '1'
|
69
69
|
- !ruby/object:Gem::Dependency
|
70
70
|
name: simplecov
|
71
71
|
requirement: !ruby/object:Gem::Requirement
|
72
72
|
requirements:
|
73
73
|
- - "~>"
|
74
74
|
- !ruby/object:Gem::Version
|
75
|
-
version: '0.
|
76
|
-
- - "<"
|
77
|
-
- !ruby/object:Gem::Version
|
78
|
-
version: '0.18'
|
75
|
+
version: '0.21'
|
79
76
|
type: :development
|
80
77
|
prerelease: false
|
81
78
|
version_requirements: !ruby/object:Gem::Requirement
|
82
79
|
requirements:
|
83
80
|
- - "~>"
|
84
81
|
- !ruby/object:Gem::Version
|
85
|
-
version: '0.
|
86
|
-
- - "<"
|
87
|
-
- !ruby/object:Gem::Version
|
88
|
-
version: '0.18'
|
82
|
+
version: '0.21'
|
89
83
|
- !ruby/object:Gem::Dependency
|
90
84
|
name: yard
|
91
85
|
requirement: !ruby/object:Gem::Requirement
|
@@ -138,7 +132,12 @@ files:
|
|
138
132
|
- lib/seccomp-tools.rb
|
139
133
|
- lib/seccomp-tools/asm/asm.rb
|
140
134
|
- lib/seccomp-tools/asm/compiler.rb
|
141
|
-
- lib/seccomp-tools/asm/
|
135
|
+
- lib/seccomp-tools/asm/sasm.tab.rb
|
136
|
+
- lib/seccomp-tools/asm/sasm.y
|
137
|
+
- lib/seccomp-tools/asm/scalar.rb
|
138
|
+
- lib/seccomp-tools/asm/scanner.rb
|
139
|
+
- lib/seccomp-tools/asm/statement.rb
|
140
|
+
- lib/seccomp-tools/asm/token.rb
|
142
141
|
- lib/seccomp-tools/bpf.rb
|
143
142
|
- lib/seccomp-tools/cli/asm.rb
|
144
143
|
- lib/seccomp-tools/cli/base.rb
|
@@ -151,10 +150,12 @@ files:
|
|
151
150
|
- lib/seccomp-tools/consts/sys_nr/aarch64.rb
|
152
151
|
- lib/seccomp-tools/consts/sys_nr/amd64.rb
|
153
152
|
- lib/seccomp-tools/consts/sys_nr/i386.rb
|
153
|
+
- lib/seccomp-tools/consts/sys_nr/s390x.rb
|
154
154
|
- lib/seccomp-tools/disasm/context.rb
|
155
155
|
- lib/seccomp-tools/disasm/disasm.rb
|
156
156
|
- lib/seccomp-tools/dumper.rb
|
157
157
|
- lib/seccomp-tools/emulator.rb
|
158
|
+
- lib/seccomp-tools/error.rb
|
158
159
|
- lib/seccomp-tools/instruction/alu.rb
|
159
160
|
- lib/seccomp-tools/instruction/base.rb
|
160
161
|
- lib/seccomp-tools/instruction/instruction.rb
|
@@ -170,6 +171,7 @@ files:
|
|
170
171
|
- lib/seccomp-tools/templates/asm.amd64.asm
|
171
172
|
- lib/seccomp-tools/templates/asm.c
|
172
173
|
- lib/seccomp-tools/templates/asm.i386.asm
|
174
|
+
- lib/seccomp-tools/templates/asm.s390x.asm
|
173
175
|
- lib/seccomp-tools/util.rb
|
174
176
|
- lib/seccomp-tools/version.rb
|
175
177
|
homepage:
|
@@ -188,14 +190,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
188
190
|
requirements:
|
189
191
|
- - ">="
|
190
192
|
- !ruby/object:Gem::Version
|
191
|
-
version: '2.
|
193
|
+
version: '2.6'
|
192
194
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
193
195
|
requirements:
|
194
196
|
- - ">="
|
195
197
|
- !ruby/object:Gem::Version
|
196
198
|
version: '0'
|
197
199
|
requirements: []
|
198
|
-
rubygems_version: 3.1.
|
200
|
+
rubygems_version: 3.1.6
|
199
201
|
signing_key:
|
200
202
|
specification_version: 4
|
201
203
|
summary: seccomp-tools
|
@@ -1,169 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
require 'seccomp-tools/const'
|
4
|
-
require 'seccomp-tools/instruction/alu'
|
5
|
-
|
6
|
-
module SeccompTools
|
7
|
-
module Asm
|
8
|
-
# Fetch tokens from a string.
|
9
|
-
#
|
10
|
-
# Internal used by {Compiler}.
|
11
|
-
# @private
|
12
|
-
class Tokenizer
|
13
|
-
# a valid label
|
14
|
-
LABEL_REGEXP = /[A-Za-z_]\w*/.freeze
|
15
|
-
attr_accessor :cur
|
16
|
-
|
17
|
-
# @param [String] str
|
18
|
-
# @example
|
19
|
-
# Tokenizer.new('return ALLOW')
|
20
|
-
def initialize(str)
|
21
|
-
@str = str
|
22
|
-
@cur = @str.dup
|
23
|
-
end
|
24
|
-
|
25
|
-
# Fetch a token without raising errors.
|
26
|
-
def fetch(type)
|
27
|
-
fetch!(type)
|
28
|
-
rescue ArgumentError
|
29
|
-
nil
|
30
|
-
end
|
31
|
-
|
32
|
-
# Fetch a token. When expected token is not found,
|
33
|
-
# error with proper message would be raised.
|
34
|
-
#
|
35
|
-
# @param [String, Symbol] type
|
36
|
-
# @example
|
37
|
-
# tokenizer = Tokenizer.new('return ALLOW')
|
38
|
-
# tokenfizer.fetch!('return')
|
39
|
-
# #=> "return"
|
40
|
-
# tokenizer.fetch!(:ret)
|
41
|
-
# #=> 2147418112
|
42
|
-
def fetch!(type)
|
43
|
-
@last_match_size = 0
|
44
|
-
res = case type
|
45
|
-
when String then fetch_str(type) || raise_expected("token #{type.inspect}")
|
46
|
-
when :comparison then fetch_strs(COMPARISON).to_sym || raise_expected('a comparison operator')
|
47
|
-
when :sys_num_x then fetch_sys_num_arch_x || raise_expected("a syscall number or 'X'")
|
48
|
-
when :goto then fetch_number || fetch_label || raise_expected('a number or label name')
|
49
|
-
when :ret then fetch_return || raise(ArgumentError, <<-EOS)
|
50
|
-
Invalid return type: #{cur.inspect}.
|
51
|
-
EOS
|
52
|
-
when :ax then fetch_ax || raise_expected("'A' or 'X'")
|
53
|
-
when :ary then fetch_ary || raise_expected('data[<num>], mem[<num>], or args[<num>]')
|
54
|
-
when :alu_op then fetch_alu || raise_expected('an ALU operator')
|
55
|
-
else raise ArgumentError, "Unsupported type: #{type.inspect}"
|
56
|
-
end
|
57
|
-
slice!
|
58
|
-
res
|
59
|
-
end
|
60
|
-
|
61
|
-
private
|
62
|
-
|
63
|
-
COMPARISON = %w[== != <= >= < >].freeze
|
64
|
-
|
65
|
-
def fetch_strs(strs)
|
66
|
-
strs.find(&method(:fetch_str))
|
67
|
-
end
|
68
|
-
|
69
|
-
def fetch_str(str)
|
70
|
-
return nil unless cur.start_with?(str)
|
71
|
-
return nil if str =~ /\A[A-Za-z0-9_]+\Z/ && cur[str.size] =~ /[A-Za-z0-9_]/
|
72
|
-
|
73
|
-
@last_match_size = str.size
|
74
|
-
str
|
75
|
-
end
|
76
|
-
|
77
|
-
def fetch_ax
|
78
|
-
return :a if fetch_str('A')
|
79
|
-
return :x if fetch_str('X')
|
80
|
-
|
81
|
-
nil
|
82
|
-
end
|
83
|
-
|
84
|
-
def fetch_sys_num_arch_x
|
85
|
-
return :x if fetch_str('X')
|
86
|
-
|
87
|
-
fetch_number || fetch_syscall || fetch_arch
|
88
|
-
end
|
89
|
-
|
90
|
-
# Currently only supports 10-based decimal numbers.
|
91
|
-
def fetch_number
|
92
|
-
res = fetch_regexp(/^0x[0-9a-f]+/) || fetch_regexp(/^[0-9]+/)
|
93
|
-
return nil if res.nil?
|
94
|
-
|
95
|
-
Integer(res)
|
96
|
-
end
|
97
|
-
|
98
|
-
def fetch_syscall
|
99
|
-
sys = Const::Syscall::AMD64
|
100
|
-
sys = sys.merge(Const::Syscall::I386)
|
101
|
-
fetch_strs(sys.keys.map(&:to_s).sort_by(&:size).reverse)
|
102
|
-
end
|
103
|
-
|
104
|
-
def fetch_arch
|
105
|
-
fetch_strs(Const::Audit::ARCH.keys)
|
106
|
-
end
|
107
|
-
|
108
|
-
def fetch_regexp(regexp)
|
109
|
-
idx = cur =~ regexp
|
110
|
-
return nil if idx.nil? || idx != 0
|
111
|
-
|
112
|
-
match = cur.match(regexp)[0]
|
113
|
-
@last_match_size = match.size
|
114
|
-
match
|
115
|
-
end
|
116
|
-
|
117
|
-
def fetch_label
|
118
|
-
fetch_regexp(LABEL_REGEXP)
|
119
|
-
end
|
120
|
-
|
121
|
-
# Convert <type>(num) into return value according to {Const::ACTION}
|
122
|
-
# @return [Integer, :a]
|
123
|
-
def fetch_return
|
124
|
-
regexp = /(#{Const::BPF::ACTION.keys.join('|')})(\([0-9]{1,5}\))?/
|
125
|
-
action = fetch_regexp(regexp)
|
126
|
-
return fetch_str('A') && :a if action.nil?
|
127
|
-
|
128
|
-
# check if action contains '('the next bytes are (<num>)
|
129
|
-
ret_val = 0
|
130
|
-
if action.include?('(')
|
131
|
-
action, val = action.split('(')
|
132
|
-
ret_val = val.to_i
|
133
|
-
end
|
134
|
-
Const::BPF::ACTION[action.to_sym] | ret_val
|
135
|
-
end
|
136
|
-
|
137
|
-
def fetch_ary
|
138
|
-
support_name = %w[data mem args args_h]
|
139
|
-
regexp = /(#{support_name.join('|')})\[[0-9]{1,2}\]/
|
140
|
-
match = fetch_regexp(regexp)
|
141
|
-
return nil if match.nil?
|
142
|
-
|
143
|
-
res, val = match.split('[')
|
144
|
-
val = val.to_i
|
145
|
-
[res.to_sym, val]
|
146
|
-
end
|
147
|
-
|
148
|
-
def fetch_alu
|
149
|
-
ops = %w[+ - * / | & ^ << >>]
|
150
|
-
op = fetch_strs(ops)
|
151
|
-
return nil if op.nil?
|
152
|
-
|
153
|
-
Instruction::ALU::OP_SYM.invert[op.to_sym]
|
154
|
-
end
|
155
|
-
|
156
|
-
def slice!
|
157
|
-
ret = cur.slice!(0, @last_match_size)
|
158
|
-
cur.strip!
|
159
|
-
ret
|
160
|
-
end
|
161
|
-
|
162
|
-
def raise_expected(msg)
|
163
|
-
raise ArgumentError, <<-EOS
|
164
|
-
Expected #{msg} but found #{cur.split[0].inspect}.
|
165
|
-
EOS
|
166
|
-
end
|
167
|
-
end
|
168
|
-
end
|
169
|
-
end
|