seccomp-tools 1.6.1 → 1.7.0

data/lib/seccomp-tools/symbolic/executor.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+
+require 'set'
+
+require 'seccomp-tools/symbolic/constraint'
+require 'seccomp-tools/symbolic/expr'
+require 'seccomp-tools/symbolic/state'
+
+module SeccompTools
+  module Symbolic
+    # Symbolic executor for classic BPF (the byte-code seccomp filters are written in).
+    #
+    # A normal interpreter (see +SeccompTools::Emulator+) runs a program *once* with concrete inputs
+    # and follows the one path those inputs select. A symbolic executor instead keeps the inputs
+    # *unknown* ({Expr}) and explores **every** path through the program at once. Wherever the
+    # program branches, it walks both sides, remembering on each side the {Constraint} that made
+    # that branch taken. When a path reaches a +return+, the executor records a {Leaf}: the value
+    # returned plus the exact list of conditions that lead there. The collection of leaves is a
+    # complete, input-independent description of what the program does.
+    #
+    # The machine model is classic BPF: two registers (A and X), 16 scratch-memory slots, and a
+    # read-only input buffer addressed by byte offset. Jumps are always forward, so a single walk
+    # with a visited-set terminates and never loops.
+    #
+    # @example
+    #   # instructions come from `SeccompTools::Disasm.to_bpf(raw, arch).map(&:inst)`
+    #   leaves, truncated = SeccompTools::Symbolic::Executor.new(instructions).run
+    #   leaves.first.ret   #=> an Expr describing the returned value
+    #   leaves.first.path  #=> the Array<Constraint> under which it is returned
+    class Executor
+      # A reached +return+: the accumulated path condition, the value returned (an {Expr}), and the
+      # line the +return+ is on.
+      Leaf = Struct.new(:path, :ret, :line)
+
+      # Upper bound on the number of states visited, so a pathological program cannot make the walk
+      # run unboundedly. When hit, {#run} stops early and reports +truncated+.
+      STEP_CAP = 100_000
+
+      # Maps a comparison operator to the pair of {Constraint} operators implied on the taken and
+      # not-taken branches (e.g. a +>=+ test learns +>=+ if taken, +<+ if not).
+      SPLIT = {
+        :== => %i[== !=],
+        :> => %i[> <=],
+        :>= => %i[>= <],
+        :& => %i[set unset]
+      }.freeze
+
+      # @param [Array<Instruction::Base>] instructions
+      #   The program to execute, as +SeccompTools::Disasm.to_bpf(raw, arch).map(&:inst)+. Only the
+      #   duck-typed +#symbolize+ method is used, so any classic-BPF instruction set works.
+      def initialize(instructions)
+        @instructions = instructions
+      end
+
+      # Walks every path and returns the reachable leaves.
+      #
+      # Leaves whose path condition is self-contradictory (e.g. +A == 1+ and +A == 2+ on the same
+      # word) are dropped - a conditional jump forks both ways regardless of feasibility, so the
+      # walk can construct paths that can never happen at runtime. See {#feasible?} for exactly
+      # what can (and deliberately cannot) be proven contradictory.
+      # @return [Array(Array<Leaf>, Boolean)]
+      #   The feasible leaves, and whether the walk was truncated at {STEP_CAP}.
+      def run
+        leaves, truncated = walk
+        [leaves.select { |leaf| feasible?(leaf.path) }, truncated]
+      end
+
+      private
+
+      # Depth-first walk of the control-flow graph. Because jumps are always forward, every successor
+      # line is strictly greater, so the walk terminates; identical +(line, state)+ pairs are
+      # visited once so that re-merging control-flow does not explode.
+      # @return [Array(Array<Leaf>, Boolean)]
+      def walk
+        leaves = []
+        visited = Set.new
+        stack = [[0, State.initial]]
+        steps = 0
+        until stack.empty?
+          return [leaves, true] if steps >= STEP_CAP
+
+          steps += 1
+          pc, st = stack.pop
+          next if pc >= @instructions.size
+          next unless visited.add?([pc, st.key])
+
+          step(pc, st, leaves, stack)
+        end
+        [leaves, false]
+      end
+
+      # Interprets one instruction symbolically, pushing the successor state(s) onto +stack+ (or
+      # appending a {Leaf} when it is a +return+).
+      def step(pc, st, leaves, stack)
+        op, *args = @instructions[pc].symbolize
+        case op
+        when :ret then leaves << Leaf.new(st.path, args[0] == :a ? st.a : Expr.imm(args[0]), pc)
+        when :ld then stack << [pc + 1, load(st, args[0], args[1])]
+        when :st then stack << [pc + 1, store(st, args[0], args[1])]
+        when :alu then stack << [pc + 1, st.with(a: st.a.apply(args[0], alu_operand(st, args[1])))]
+        when :misc then stack << [pc + 1, args[0] == :txa ? st.with(a: st.x) : st.with(x: st.a)]
+        when :jmp then stack << [pc + args[0] + 1, st]
+        when :cmp then branch_cmp(pc, st, args, stack)
+        end
+      end
+
+      # The right operand of an ALU instruction: the X register, an immediate, or +nil+ for the
+      # unary +neg+ (whose symbolized operand is +nil+).
+      def alu_operand(st, src)
+        return st.x if src == :x
+
+        src && Expr.imm(src)
+      end
+
+      # Loads an immediate, a scratch slot, or a data-buffer word into register A or X.
+      def load(st, dst, src)
+        val = case src[:rel]
+              when :immi then Expr.imm(src[:val])
+              when :mem then st.mem[src[:val]]
+              when :data then Expr.data(src[:val])
+              end
+        dst == :x ? st.with(x: val) : st.with(a: val)
+      end
+
+      # Stores register A or X into a scratch slot.
+      def store(st, reg, idx)
+        mem = st.mem.dup
+        mem[idx] = reg == :x ? st.x : st.a
+        st.with(mem:)
+      end
+
+      # Forks a conditional jump into its taken and not-taken successors, recording the {Constraint}
+      # each branch implies. A comparison between two constants (e.g. against the guaranteed-zero
+      # initial A or X) does not fork: only the branch it actually selects is walked, and no fact
+      # is recorded.
+      def branch_cmp(pc, st, args, stack)
+        op, src, jt, jf = args
+        # jt == jf: the jump is unconditional, so no fact is learned.
+        return stack << [pc + jt + 1, st] if jt == jf
+
+        rhs = src == :x ? st.x : Expr.imm(src)
+        taken, els = SPLIT[op]
+        if st.a.imm? && rhs.imm?
+          j = Constraint.evaluate(st.a.val, taken, rhs.val) ? jt : jf
+          return stack << [pc + j + 1, st]
+        end
+
+        stack << [pc + jt + 1, st.with(path: st.path + [Constraint.new(st.a, taken, rhs)])]
+        stack << [pc + jf + 1, st.with(path: st.path + [Constraint.new(st.a, els, rhs)])]
+      end
+
+      # Is +path+ satisfiable? Deliberately a small rule-based check, not a solver.
+      #
+      # Only facts of the shape "untransformed data word compared to a constant" are examined,
+      # grouped by which word they constrain; any other fact (a transformed word, a comparison
+      # against X, an opaque value) is assumed satisfiable. So an impossible path is never
+      # *wrongly* dropped - the cost of not understanding a fact is noise in the caller's output,
+      # never hidden behavior.
+      #
+      # That fragment is where essentially all real contradictions live. The walk forks every
+      # conditional both ways, so re-merging tests over the same word manufacture impossible
+      # paths: a syscall allowlist behind an x32 range guard yields
+      # +sys >= 0x40000000 && sys == 2+, libseccomp's binary-search dispatch yields the same
+      # equality-versus-range shapes, and sentinel tests yield +sys == 0xffffffff && sys == 2+.
+      # All of these are caught, and since the data words are independent inputs, checking
+      # word-by-word is exact for this fragment, not an approximation: a conjunction of
+      # single-word facts is satisfiable iff each word's facts are.
+      #
+      # What it cannot prove infeasible are contradictions through *derived* values:
+      # +(args[0] & 0xff) == 0x100+ (impossible by masking), wraparound arithmetic like
+      # +args[0] + 1 == 0 && args[0] == 5+, or relations between two transforms of one word
+      # (+sys >> 8 == 1 && sys < 0x100+). Deciding those in general is bit-vector SMT; a filter
+      # convoluted enough to produce them (a deliberately obfuscated challenge, not a seccomp
+      # library) calls for a real solver anyway, so rule-based pruning of that space would add
+      # complexity without making such filters readable. Their paths are kept and rendered with
+      # their full conditions instead.
+      # @param [Array<Constraint>] path
+      # @return [Boolean]
+      def feasible?(path)
+        path.select(&:plain_data_fact?)
+            .group_by { |c| c.lhs.offset }
+            .all? { |_offset, cs| cell_feasible?(cs) }
+      end
+
+      # Are the constraints on a single data word jointly satisfiable? Two different +==+ values
+      # are impossible (+A == 1 && A == 2+). A single +==+ pins the word, so every other fact -
+      # +!=+, the four bounds, and both jset forms - is simply evaluated against it
+      # (+A >= 0x40000000 && A == 2+ dies here). With no +==+, the inequalities must leave a
+      # non-empty range (+A > 10 && A < 5+); +!=+ and jset facts are ignored in that case, since
+      # ruling out a 32-bit word with them alone would take a filter no library generates.
+      def cell_feasible?(constraints)
+        eqs = constraints.select { |c| c.op == :== }.map { |c| c.rhs.val }.uniq
+        return false if eqs.size > 1
+        return constraints.all? { |c| Constraint.evaluate(eqs.first, c.op, c.rhs.val) } unless eqs.empty?
+
+        lo = 0
+        hi = 0xffffffff
+        constraints.each do |c|
+          case c.op
+          when :> then lo = [lo, c.rhs.val + 1].max
+          when :>= then lo = [lo, c.rhs.val].max
+          when :< then hi = [hi, c.rhs.val - 1].min
+          when :<= then hi = [hi, c.rhs.val].min
+          end
+        end
+        lo <= hi
+      end
+    end
+  end
+end

data/lib/seccomp-tools/symbolic/expr.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+require 'seccomp-tools/instruction/alu'
+
+module SeccompTools
+  # Generic symbolic execution of classic BPF, with no seccomp knowledge. Where +SeccompTools::Emulator+
+  # runs a program once with concrete inputs, the {Executor} here keeps the inputs unknown and walks
+  # *every* path, reporting each reachable +return+ together with the conditions that lead to it. The
+  # values it manipulates are the {Expr}, {Constraint}, and {State} types; see {Executor} for the
+  # full picture.
+  module Symbolic
+    # A value the executor only knows *symbolically* - that is, without picking concrete inputs.
+    #
+    # Every register and scratch slot in the {State} holds an {Expr}, which is one of:
+    # * {.imm} - a known 32-bit constant, e.g. the result of +A = 5+.
+    # * {.data} - a single word of the input data buffer, at some byte +offset+. Its value is
+    #   unknown; we only remember where it was read from.
+    # * {.binop} - an arithmetic combination of two sub-expressions, e.g. +data[16] & 0xffff+ or even
+    #   +data[16] & data[24]+ (two buffer words combined). This is what lets a caller later describe a
+    #   branch condition faithfully.
+    # * {.unop} - a unary operation on a sub-expression; the only one BPF has is negation (+-A+).
+    # * {.opaque} - a value we cannot describe (an unsupported operation, or one whose operand is
+    #   itself opaque). Nothing can be concluded about it.
+    class Expr
+      # The binary ALU operators {#apply} accepts - exactly the ones +Instruction::ALU#symbolize+
+      # can produce (its unary +neg+ is handled separately).
+      REPRESENTABLE = Instruction::ALU::OP_SYM.values.freeze
+
+      # @return [:imm, :data, :binop, :unop, :opaque] Which kind of expression this is.
+      attr_reader :kind
+      # @return [Integer?] The constant, when +kind+ is +:imm+.
+      attr_reader :val
+      # @return [Integer?] The byte offset into the input data buffer, when +kind+ is +:data+.
+      attr_reader :offset
+      # @return [Symbol?] The operator, when +kind+ is +:binop+ or +:unop+.
+      attr_reader :op
+      # @return [Expr?] The left and right operands, when +kind+ is +:binop+; a +:unop+ keeps its
+      #   only operand in +lhs+.
+      attr_reader :lhs, :rhs
+
+      # A known constant.
+      # @param [Integer] val
+      # @return [Expr]
+      def self.imm(val)
+        new(:imm, val: val & 0xffffffff)
+      end
+
+      # A single word of the input data buffer.
+      # @param [Integer] offset
+      #   Byte offset into the buffer.
+      # @return [Expr]
+      def self.data(offset)
+        new(:data, offset:)
+      end
+
+      # An arithmetic combination of two expressions.
+      # @param [Symbol] op
+      # @param [Expr] lhs
+      # @param [Expr] rhs
+      # @return [Expr]
+      def self.binop(op, lhs, rhs)
+        new(:binop, op:, lhs:, rhs:)
+      end
+
+      # A unary operation on one expression (its operand is kept in +lhs+).
+      # @param [Symbol] op
+      # @param [Expr] operand
+      # @return [Expr]
+      def self.unop(op, operand)
+        new(:unop, op:, lhs: operand)
+      end
+
+      # A value that cannot be described symbolically.
+      # @return [Expr]
+      def self.opaque
+        new(:opaque)
+      end
+
+      # @param [:imm, :data, :binop, :unop, :opaque] kind
+      # @param [Hash] fields
+      #   The kind-specific fields: +:val+, +:offset+, +:op+, +:lhs+, +:rhs+.
+      def initialize(kind, **fields)
+        @kind = kind
+        @val = fields[:val]
+        @offset = fields[:offset]
+        @op = fields[:op]
+        @lhs = fields[:lhs]
+        @rhs = fields[:rhs]
+      end
+
+      # @return [Boolean]
+      def imm?
+        kind == :imm
+      end
+
+      # Is this a bare data-buffer word (no arithmetic applied)? These are the values a caller can
+      # compare directly against a constant.
+      # @return [Boolean]
+      def plain_data?
+        kind == :data
+      end
+
+      # @return [Boolean]
+      def opaque?
+        kind == :opaque
+      end
+
+      # Applies an ALU operation, returning the resulting {Expr}. +neg+ is unary (its operand is
+      # ignored). Two constants fold into a new constant; an operation on non-opaque operands
+      # becomes a {.binop}; an opaque operand makes the result {.opaque}.
+      # @param [Symbol] op
+      #   A Ruby operator symbol as produced by +Instruction::ALU#symbolize+, or +:neg+.
+      # @param [Expr, nil] operand
+      #   The right operand (+nil+ for the unary +neg+).
+      # @return [Expr]
+      # @raise [ArgumentError]
+      #   When +op+ is not one of seccomp's ALU operators (+:neg+ or {REPRESENTABLE}).
+      def apply(op, operand)
+        return apply_neg if op == :neg
+        raise ArgumentError, "unsupported operator #{op}" unless REPRESENTABLE.include?(op)
+        return Expr.opaque if opaque? || operand.opaque?
+        return Expr.imm(self.class.fold(val, op, operand.val)) if imm? && operand.imm?
+
+        Expr.binop(op, self, operand)
+      end
+
+      # A string that uniquely identifies this expression, used for both equality and hashing;
+      # memoized, since an {Expr} is immutable. The operator is written as text, not left a {Symbol},
+      # because Ruby's +Symbol#hash+ maps the operators to very few values (+:==+ and +:!=+ hash
+      # alike) - a key carrying them would collapse when hashed and drag the walk's visited +Set+
+      # down to a linear scan; a string hashes over its bytes cleanly. The encoding is injective
+      # (leaves are +i<val>+ / +d<offset>+ / +o+, compounds are parenthesised, and no operator
+      # contains a leaf-start char, a digit, or the +;+ / +,+ that {State} joins with), so it is
+      # safe to compare on.
+      # @return [String]
+      def key
+        @key ||= case kind
+                 when :binop then "(#{lhs.key}#{op}#{rhs.key})"
+                 when :unop  then "(#{op}#{lhs.key})"
+                 when :imm   then "i#{val}"
+                 when :data  then "d#{offset}"
+                 else 'o'
+                 end
+      end
+
+      # @param [Expr] other
+      # @return [Boolean]
+      def ==(other)
+        other.is_a?(Expr) && key == other.key
+      end
+      alias eql? ==
+
+      # @return [Integer]
+      def hash
+        key.hash
+      end
+
+      # Folds a binary ALU operation on two constants, wrapping to 32 bits (classic BPF is 32-bit).
+      # Every {REPRESENTABLE} operator is a Ruby +Integer+ method, so it applies directly.
+      # @return [Integer]
+      def self.fold(lhs, op, rhs)
+        return 0 if op == :/ && rhs.zero? # a real BPF program is rejected at load for div-by-zero
+        # ... and for shifts of 32+ bits; short-circuit them to their masked result (everything
+        # shifted out) instead of building a needlessly huge integer.
+        return 0 if %i[<< >>].include?(op) && rhs >= 32
+
+        lhs.public_send(op, rhs) & 0xffffffff
+      end
+
+      private
+
+      # The unary negation +A = -A+ (two's complement, 32-bit). Negating a negation cancels - exact
+      # in 32-bit two's complement - instead of stacking into +--x+, which C would even lex as a
+      # decrement.
+      # @return [Expr]
+      def apply_neg
+        return Expr.opaque if opaque?
+        return Expr.imm(self.class.fold(0, :-, val)) if imm?
+        return lhs if kind == :unop # the only unop is :neg
+
+        Expr.unop(:neg, self)
+      end
+    end
+  end
+end

data/lib/seccomp-tools/symbolic/state.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require 'seccomp-tools/symbolic/expr'
+
+module SeccompTools
+  module Symbolic
+    # A snapshot of the classic-BPF machine at one point along one path of the walk: the two
+    # registers (A and X), the 16 scratch-memory slots, and the path condition (the {Constraint}s
+    # that must hold to have reached here). The walk fills values in as it interprets
+    # instructions, starting from {.initial}.
+    #
+    # A {State} is treated as immutable - stepping an instruction produces a *new* state via {#with},
+    # so the many paths of the walk can safely share the parts they have in common.
+    class State
+      # @return [Expr] Register A (the accumulator).
+      attr_reader :a
+      # @return [Expr] Register X (the index register).
+      attr_reader :x
+      # @return [Array<Expr>] The 16 scratch-memory slots (+mem[0..15]+).
+      attr_reader :mem
+      # @return [Array<Constraint>] The path condition accumulated so far.
+      attr_reader :path
+
+      # The starting state, as the kernel sets it up: both registers zero (a classic BPF program is
+      # guaranteed +A = X = 0+ on entry - the cBPF-to-eBPF converter clears them first), the
+      # scratch slots unknown, and no facts assumed. The slots stay {Expr.opaque} because nothing
+      # can rely on them: the kernel rejects a filter that reads a slot before writing it.
+      # @return [State]
+      def self.initial
+        new(a: Expr.imm(0), x: Expr.imm(0), mem: Array.new(16, Expr.opaque), path: [])
+      end
+
+      # @param [Expr] a
+      # @param [Expr] x
+      # @param [Array<Expr>] mem
+      # @param [Array<Constraint>] path
+      def initialize(a:, x:, mem:, path:)
+        @a = a
+        @x = x
+        @mem = mem
+        @path = path
+      end
+
+      # Returns a copy with the given fields replaced; unreplaced fields are shared (the state is
+      # immutable).
+      # @return [State]
+      def with(a: @a, x: @x, mem: @mem, path: @path)
+        State.new(a:, x:, mem:, path:)
+      end
+
+      # A string that identifies this state exactly, joined from each part's {Expr#key} /
+      # {Constraint#key} (the same identity, one level up). The walk uses it to skip a
+      # +(line, state)+ pair it has already visited, which keeps merging control-flow from blowing
+      # up. Both {#==} and {#hash} are decided on it; see {Expr#key} for why the key is a string.
+      # The +;+ / +,+ separators appear in no part's key, so the join stays injective.
+      # @return [String]
+      def key
+        @key ||= "#{a.key};#{x.key};#{mem.map(&:key).join(',')};#{path.map(&:key).join(',')}"
+      end
+
+      # The constant the data word at byte +offset+ is pinned to on this path (by an +==+ fact), or
+      # +nil+ when it is not pinned.
+      # @param [Integer] offset
+      # @return [Integer?]
+      def pinned(offset)
+        path.find { |c| c.plain_data_eq?(offset) }&.rhs&.val
+      end
+
+      # @param [State] other
+      # @return [Boolean]
+      def ==(other)
+        other.is_a?(State) && key == other.key
+      end
+      alias eql? ==
+
+      # @return [Integer]
+      def hash
+        key.hash
+      end
+    end
+  end
+end

data/lib/seccomp-tools/syscall.rb

@@ -1,8 +1,10 @@
+# encoding: ascii-8bit
 # frozen_string_literal: true
 
 require 'os'
 
 require 'seccomp-tools/const'
+require 'seccomp-tools/util'
 require 'seccomp-tools/ptrace' if OS.linux?
 
 module SeccompTools
@@ -13,25 +15,32 @@ module SeccompTools
       amd64: { number: 120, args: [112, 104, 96, 56, 72, 44], ret: 80, SYS_prctl: 157, SYS_seccomp: 317 },
       i386: { number: 44, args: [0, 4, 8, 12, 16, 20], ret: 24, SYS_prctl: 172, SYS_seccomp: 354 },
       aarch64: { number: 64, args: [0, 8, 16, 24, 32, 40, 48], ret: 0, SYS_prctl: 167, SYS_seccomp: 277 },
+      riscv64: { number: 136, args: [80, 88, 96, 104, 112, 120], ret: 80, SYS_prctl: 167, SYS_seccomp: 277 },
       # Most software invokes syscalls through "svc 0", in which case the syscall number is in r1.
       # However, it's also possible to use "svc NR": this case is not handled here.
       s390x: { number: 24, args: [32, 40, 48, 56, 64, 72], ret: 32, SYS_prctl: 172, SYS_seccomp: 348 }
     }.freeze
 
-    # @return [Integer] Process id.
+    # @return [Integer] Id of the traced process.
     attr_reader :pid
-    # @return [{Symbol => Integer, Array<Integer>}] See {ABI}.
+    # @return [{Symbol => Integer, Array<Integer>}]
+    #   The {ABI} entry of this syscall's architecture.
     attr_reader :abi
     # @return [Integer] Syscall number.
     attr_reader :number
-    # @return [Integer] Syscall arguments.
+    # @return [Array<Integer>] Syscall arguments, in register order.
     attr_reader :args
     # @return [Integer] Syscall return value.
     attr_reader :ret
 
     # Instantiate a {Syscall} object.
-    # @param [String] pid
-    #   Process-id.
+    #
+    # Reads the syscall number, arguments and return value of +pid+ through ptrace, so the process
+    # must already be stopped and attached.
+    # @param [Integer] pid
+    #   Id of the traced process.
+    # @raise [ArgumentError]
+    #   If the architecture of +pid+ is not one of {ABI}'s keys.
     def initialize(pid)
       @pid = pid
       raise ArgumentError, "Only supports #{ABI.keys.join(', ')}" if ABI[arch].nil?
@@ -42,38 +51,80 @@ module SeccompTools
       @ret = peek(abi[:ret])
     end
 
-    # Is this a +seccomp(SECCOMP_MODE_FILTER, addr)+/+prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, addr)+ syscall?
+    # Is this a seccomp installation syscall?
     #
+    # Both +SECCOMP_MODE_FILTER+ and +SECCOMP_MODE_STRICT+ installations are recognized, invoked
+    # through either +seccomp+ or +prctl(PR_SET_SECCOMP, ...)+.
     # @return [Boolean]
-    #   +true+ for is a seccomp installation syscall.
+    #   +true+ if this is a seccomp installation syscall.
     def set_seccomp?
-      # TODO: handle SECCOMP_MODE_SET_STRICT / SECCOMP_MODE_STRICT
+      filter_mode? || strict_mode?
+    end
+
+    # Is this a +seccomp(SECCOMP_SET_MODE_FILTER, ..)+/+prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, ..)+ syscall?
+    #
+    # @return [Boolean]
+    def filter_mode?
       return true if number == abi[:SYS_seccomp] && args[0] == Const::BPF::SECCOMP_SET_MODE_FILTER
 
       number == abi[:SYS_prctl] && args[0] == Const::BPF::PR_SET_SECCOMP && args[1] == Const::BPF::SECCOMP_MODE_FILTER
     end
 
-    # Dump bpf byte from +args[2]+.
+    # Is this a +seccomp(SECCOMP_SET_MODE_STRICT, ..)+/+prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT)+ syscall?
+    #
+    # @return [Boolean]
+    def strict_mode?
+      return true if number == abi[:SYS_seccomp] && args[0] == Const::BPF::SECCOMP_SET_MODE_STRICT
+
+      number == abi[:SYS_prctl] && args[0] == Const::BPF::PR_SET_SECCOMP && args[1] == Const::BPF::SECCOMP_MODE_STRICT
+    end
+
+    # Constructs a BPF program equivalent to what +SECCOMP_MODE_STRICT+ enforces: only read, write,
+    # exit, and sigreturn are allowed, while any other syscall kills the thread.
+    #
+    # @param [Symbol] arch
+    #   Target architecture, one of {ABI}'s keys.
+    # @return [String]
+    #   Raw BPF bytes.
+    def self.strict_bpf(arch)
+      # Required lazily because the assembler's scanner refers to {ABI} at load time.
+      require 'seccomp-tools/asm/asm'
+
+      # The kernel checks sigreturn on architectures that have it and rt_sigreturn on the others.
+      sigreturn = Const::Syscall.const_get(arch.to_s.upcase)[:sigreturn] ? :sigreturn : :rt_sigreturn
+      Asm.asm(<<-EOS, arch: arch)
+        A = sys_number
+        A == read ? ok : next
+        A == write ? ok : next
+        A == exit ? ok : next
+        A == #{sigreturn} ? ok : next
+        return KILL
+        ok:
+        return ALLOW
+      EOS
+    end
+
+    # Dumps the BPF of the filter being installed.
+    #
+    # Only meaningful when {#set_seccomp?} is +true+. In filter mode +args[2]+ points to a
+    # +struct sock_fprog+ in the traced process, whose BPF bytes are read out. Strict mode installs
+    # no BPF, so an equivalent filter built by {.strict_bpf} is returned instead.
     # @return [String]
+    #   The raw BPF bytes of the filter being installed.
     def dump_bpf
+      return self.class.strict_bpf(arch) if strict_mode?
+
       addr = args[2]
       len = Ptrace.peekdata(pid, addr, 0) & 0xffff # len is unsigned short
-      filter = Ptrace.peekdata(pid, addr + bits / 8, 0) & ((1 << bits) - 1)
-      Array.new(len) { |i| Ptrace.peekdata(pid, filter + i * 8, 0) }.pack('Q*')
+      filter = Ptrace.peekdata(pid, addr + (bits / 8), 0) & ((1 << bits) - 1)
+      Array.new(len) { |i| Ptrace.peekdata(pid, filter + (i * 8), 0) }.pack('Q*')
     end
 
-    # @return [Symbol]
-    #   Architecture of this syscall.
+    # Architecture of this syscall, i.e. of the traced process.
+    # @return [Symbol?]
+    #   See {SeccompTools::Util.process_arch}.
     def arch
-      @arch ||= File.open("/proc/#{pid}/exe", 'rb') do |f|
-        f.pos = 18
-        {
-          "\x03\x00" => :i386,
-          "\x3e\x00" => :amd64,
-          "\xb7\x00" => :aarch64,
-          "\x00\x16" => :s390x
-        }[f.read(2)]
-      end
+      @arch ||= Util.process_arch(pid)
     end
 
     private
@@ -83,6 +134,7 @@ module SeccompTools
         i386: 32,
         amd64: 64,
         aarch64: 64,
+        riscv64: 64,
         s390x: 64
       }[arch]
     end