seccomp-tools 1.6.1 → 1.7.0

data/completions/_seccomp-tools

@@ -0,0 +1,83 @@
+#compdef seccomp-tools
+
+# zsh completion for seccomp-tools
+#
+# Load it with either:
+#   eval "$(seccomp-tools completion zsh)"    # in ~/.zshrc, after `compinit`
+# or drop this file (named `_seccomp-tools`) into a directory on your $fpath.
+
+_seccomp-tools() {
+  local -a arches=(aarch64 amd64 i386 riscv64 s390x)
+
+  # $words is 1-indexed; words[1]=seccomp-tools, words[2]=subcommand.
+  if (( CURRENT == 2 )); then
+    local -a commands=(
+      'asm:Seccomp bpf assembler'
+      'audit:Assess a filter for weaknesses and escape routes'
+      'completion:Print a shell completion script'
+      'disasm:Disassemble seccomp bpf'
+      'dump:Automatically dump seccomp bpf from executable(s)'
+      'emu:Emulate seccomp rules'
+      'explain:Summarize a filter as a per-action policy'
+    )
+    _describe 'command' commands
+    return
+  fi
+
+  case ${words[2]} in
+    asm)
+      _arguments \
+        '(-o --output)'{-o,--output}'[write output to FILE]:file:_files' \
+        '(-f --format)'{-f,--format}'[output format]:format:(inspect raw c_array c_source assembly)' \
+        '(-a --arch)'{-a,--arch}"[architecture]:arch:($arches)" \
+        '1:input asm file:_files'
+      ;;
+    disasm)
+      _arguments \
+        '(-o --output)'{-o,--output}'[write output to FILE]:file:_files' \
+        '(-a --arch)'{-a,--arch}"[architecture]:arch:($arches)" \
+        '--asm-able[emit output that is valid input for asm]' \
+        '(--bpf --no-bpf)--no-bpf[hide the raw BPF bytes]' \
+        '(--arg-infer --no-arg-infer)--no-arg-infer[do not infer argument names]' \
+        '1:bpf file:_files'
+      ;;
+    dump)
+      _arguments \
+        '(-c --sh-exec)'{-c,--sh-exec}'[run command via sh and dump its seccomp]:command:' \
+        '(-p --pid)'{-p,--pid}'[dump filters of a running process]:pid:' \
+        '(-l --limit)'{-l,--limit}'[dump only the first N filters]:limit:' \
+        '(-t --timeout)'{-t,--timeout}'[timeout in seconds]:seconds:' \
+        '(-f --format)'{-f,--format}'[output format]:format:(disasm raw inspect)' \
+        '(-o --output)'{-o,--output}'[write output to FILE]:file:_files' \
+        '1:executable:_files'
+      ;;
+    audit|explain)
+      _arguments \
+        '(-c --sh-exec)'{-c,--sh-exec}'[run command via sh]:command:' \
+        '(-p --pid)'{-p,--pid}'[analyze a running process]:pid:' \
+        '(-l --limit)'{-l,--limit}'[analyze only the first N filters]:limit:' \
+        '(-t --timeout)'{-t,--timeout}'[timeout in seconds]:seconds:' \
+        '(-a --arch)'{-a,--arch}"[architecture]:arch:($arches)" \
+        '(-f --format)'{-f,--format}'[output format]:format:(human json)' \
+        '1:bpf file or executable:_files'
+      ;;
+    emu)
+      _arguments \
+        '(-a --arch)'{-a,--arch}"[architecture]:arch:($arches)" \
+        '(-q --quiet)'{-q,--quiet}'[only show the emulation result]' \
+        '(-i --ip)'{-i,--ip}'[set the instruction pointer]:ip:' \
+        '1:bpf file:_files'
+      ;;
+    completion)
+      _arguments '1:shell:(bash zsh fish)'
+      ;;
+  esac
+}
+
+# When autoloaded from $fpath the completion system calls this function directly;
+# when eval'd or sourced, register it instead of running it.
+if [ "${funcstack[1]}" = "_seccomp-tools" ]; then
+  _seccomp-tools "$@"
+else
+  compdef _seccomp-tools seccomp-tools
+fi

data/completions/seccomp-tools.bash

@@ -0,0 +1,59 @@
+# bash completion for seccomp-tools
+#
+# Load it with either:
+#   eval "$(seccomp-tools completion bash)"    # in ~/.bashrc
+# or drop this file into a bash-completion directory named `seccomp-tools`, e.g.
+#   ~/.local/share/bash-completion/completions/seccomp-tools
+
+_seccomp_tools() {
+  local cur prev cmd
+  cur="${COMP_WORDS[COMP_CWORD]}"
+  prev="${COMP_WORDS[COMP_CWORD-1]}"
+
+  local commands="asm audit completion disasm dump emu explain"
+  local arches="aarch64 amd64 i386 riscv64 s390x"
+
+  # Position 1: the subcommand.
+  if [[ $COMP_CWORD -eq 1 ]]; then
+    COMPREPLY=( $(compgen -W "$commands --help --version" -- "$cur") )
+    return
+  fi
+
+  cmd="${COMP_WORDS[1]}"
+
+  # The previous word expects a value: complete just that value.
+  case "$prev" in
+    -a|--arch) COMPREPLY=( $(compgen -W "$arches" -- "$cur") ); return ;;
+    -o|--output) COMPREPLY=( $(compgen -f -- "$cur") ); return ;;
+    -f|--format)
+      case "$cmd" in
+        asm)   COMPREPLY=( $(compgen -W "inspect raw c_array c_source assembly" -- "$cur") ) ;;
+        audit) COMPREPLY=( $(compgen -W "human json" -- "$cur") ) ;;
+        dump)  COMPREPLY=( $(compgen -W "disasm raw inspect" -- "$cur") ) ;;
+      esac
+      return ;;
+  esac
+
+  if [[ $cmd == completion ]]; then
+    COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") )
+    return
+  fi
+
+  # Otherwise: this subcommand's flags (when typing a -flag) or a file.
+  local opts="-h --help"
+  case "$cmd" in
+    asm)     opts+=" -o --output -f --format -a --arch" ;;
+    disasm)  opts+=" -o --output -a --arch --bpf --no-bpf --arg-infer --no-arg-infer --asm-able" ;;
+    dump)    opts+=" -c --sh-exec -l --limit -p --pid -t --timeout -f --format -o --output" ;;
+    emu)     opts+=" -a --arch -q --no-quiet -i --ip" ;;
+    explain) opts+=" -c --sh-exec -l --limit -p --pid -t --timeout -a --arch" ;;
+    audit)   opts+=" -c --sh-exec -l --limit -p --pid -t --timeout -a --arch -f --format" ;;
+  esac
+
+  if [[ $cur == -* ]]; then
+    COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
+  else
+    COMPREPLY=( $(compgen -f -- "$cur") )
+  fi
+}
+complete -F _seccomp_tools seccomp-tools

data/completions/seccomp-tools.fish

@@ -0,0 +1,52 @@
+# fish completion for seccomp-tools
+#
+# Load it with either:
+#   seccomp-tools completion fish | source    # in ~/.config/fish/config.fish
+# or drop this file into ~/.config/fish/completions/seccomp-tools.fish
+
+# Disable file completion by default; re-enabled per option/positional below.
+complete -c seccomp-tools -f
+
+# Subcommands (offered only when none has been given yet).
+complete -c seccomp-tools -n __fish_use_subcommand -a asm        -d 'Seccomp bpf assembler'
+complete -c seccomp-tools -n __fish_use_subcommand -a audit      -d 'Assess a filter for weaknesses and escape routes'
+complete -c seccomp-tools -n __fish_use_subcommand -a completion -d 'Print a shell completion script'
+complete -c seccomp-tools -n __fish_use_subcommand -a disasm     -d 'Disassemble seccomp bpf'
+complete -c seccomp-tools -n __fish_use_subcommand -a dump       -d 'Automatically dump seccomp bpf from executable(s)'
+complete -c seccomp-tools -n __fish_use_subcommand -a emu        -d 'Emulate seccomp rules'
+complete -c seccomp-tools -n __fish_use_subcommand -a explain    -d 'Summarize a filter as a per-action policy'
+complete -c seccomp-tools -n __fish_use_subcommand -l version    -d 'Show version'
+complete -c seccomp-tools -s h -l help -d 'Show help'
+
+# --arch, shared by the analysis commands.
+complete -c seccomp-tools -n '__fish_seen_subcommand_from asm disasm emu explain audit' \
+  -s a -l arch -x -a 'aarch64 amd64 i386 riscv64 s390x' -d Architecture
+
+# --format, whose valid values differ per command.
+complete -c seccomp-tools -n '__fish_seen_subcommand_from asm'   -s f -l format -x -a 'inspect raw c_array c_source assembly' -d 'Output format'
+complete -c seccomp-tools -n '__fish_seen_subcommand_from dump'  -s f -l format -x -a 'disasm raw inspect' -d 'Output format'
+complete -c seccomp-tools -n '__fish_seen_subcommand_from audit' -s f -l format -x -a 'human json' -d 'Output format'
+
+# --output takes a file.
+complete -c seccomp-tools -n '__fish_seen_subcommand_from asm disasm dump' -s o -l output -r -d 'Write output to FILE'
+
+# Options shared by the commands that read from a process.
+complete -c seccomp-tools -n '__fish_seen_subcommand_from dump explain audit' -s c -l sh-exec -x -d 'Run command via sh and analyze its seccomp'
+complete -c seccomp-tools -n '__fish_seen_subcommand_from dump explain audit' -s p -l pid     -x -d 'Analyze a running process'
+complete -c seccomp-tools -n '__fish_seen_subcommand_from dump explain audit' -s l -l limit   -x -d 'Analyze only the first N filters'
+complete -c seccomp-tools -n '__fish_seen_subcommand_from dump explain audit' -s t -l timeout -x -d 'Timeout in seconds'
+
+# disasm-only flags.
+complete -c seccomp-tools -n '__fish_seen_subcommand_from disasm' -l asm-able     -d 'Emit output that is valid input for asm'
+complete -c seccomp-tools -n '__fish_seen_subcommand_from disasm' -l no-bpf       -d 'Hide the raw BPF bytes'
+complete -c seccomp-tools -n '__fish_seen_subcommand_from disasm' -l no-arg-infer -d 'Do not infer argument names'
+
+# emu-only flags.
+complete -c seccomp-tools -n '__fish_seen_subcommand_from emu' -s i -l ip    -x -d 'Set the instruction pointer'
+complete -c seccomp-tools -n '__fish_seen_subcommand_from emu' -s q -l quiet -d 'Only show the emulation result'
+
+# completion takes a shell name.
+complete -c seccomp-tools -n '__fish_seen_subcommand_from completion' -a 'bash zsh fish' -d Shell
+
+# The commands whose positional argument is a file/executable get file completion.
+complete -c seccomp-tools -n '__fish_seen_subcommand_from asm disasm dump emu explain audit' -F

data/ext/ptrace/ptrace.c

@@ -48,9 +48,9 @@ ptrace_peekuser(VALUE _mod, VALUE pid, VALUE off, VALUE _data, VALUE bits) {
     uint32_t val32;
     uint64_t val64;
   } val;
-  // Dynamically allocate a buffer to store registers-well, at least enough
+  // Dynamically allocate a buffer to store registers - well, at least enough
   // registers to reach the offset we want. Normally we'd want to use
-  // user_pt_regs or similar, but it's difficult to find it available in the
+  // user_pt_regs or similar, but it's difficult to find it available in
   // the same header across different versions of Linux or libcs, or even with
   // the same *name*, so this is the compromise.
   size_t size = offset + width;

data/lib/seccomp-tools/asm/asm.rb

@@ -8,19 +8,24 @@ module SeccompTools
   module Asm
     module_function
 
-    # Assembler of seccomp bpf.
+    # Compiles seccomp assembly into raw BPF bytes.
     # @param [String] str
+    #   The assembly source to be compiled.
     # @param [String] filename
     #   Only used for error messages.
     # @param [Symbol?] arch
+    #   Target architecture, must be one of {SeccompTools::Util.supported_archs}.
+    #   Defaults to {SeccompTools::Util.system_arch} when +nil+.
     # @return [String]
     #   Raw BPF bytes.
+    # @raise [SeccompTools::Error]
+    #   If +str+ is not valid seccomp assembly.
     # @example
     #   SeccompTools::Asm.asm(<<-EOS)
-    #     # lines start with '#' are comments
+    #     # lines starting with '#' are comments
     #     A = sys_number                # here's a comment, too
-    #     A >= 0x40000000 ? dead : next # 'next' is a keyword, denote the next instruction
-    #     A == read ? ok : next         # custom defined label 'dead' and 'ok'
+    #     A >= 0x40000000 ? dead : next # 'next' is a keyword, denoting the next instruction
+    #     A == read ? ok : next         # custom-defined labels 'dead' and 'ok'
     #     A == 1 ? ok : next            # SYS_write = 1 on amd64
     #     return ERRNO(1)
     #     dead:

data/lib/seccomp-tools/asm/compiler.rb

@@ -12,6 +12,9 @@ module SeccompTools
     #
     # Compile seccomp rules.
     class Compiler
+      # The farthest distance of a relative jump in BPF.
+      JUMP_DISTANCE_MAX = 255
+
       # Instantiate a {Compiler} object.
       #
       # @param [String] source
@@ -21,17 +24,28 @@ module SeccompTools
       # @param [Symbol] arch
       #   Architecture.
       def initialize(source, filename, arch)
-        @scanner = Scanner.new(source, arch, filename: filename)
+        @scanner = Scanner.new(source, arch, filename:)
         @arch = arch
         @symbols = {}
       end
 
       # Compiles the processed instructions.
       #
+      # Scans and parses the source, resolves the labels into relative jump distances, then emits
+      # one {BPF} per statement.
+      #
       # @return [Array<SeccompTools::BPF>]
       #   Returns the compiled {BPF} array.
-      # @raise [SeccompTools::Error]
-      #   Raises the error found during compilation.
+      # @raise [SeccompTools::UnrecognizedTokenError]
+      #   If the source contains text that is not valid assembly.
+      # @raise [SeccompTools::ParseError]
+      #   If the tokens do not form valid statements.
+      # @raise [SeccompTools::DuplicateLabelError]
+      #   If a label is defined more than once.
+      # @raise [SeccompTools::UndefinedLabelError]
+      #   If a jump refers to a label that is never defined.
+      # @raise [SeccompTools::BackwardJumpError]
+      #   If a jump goes backward, which BPF cannot express.
       def compile!
         @scanner.validate!
         statements = SeccompAsmParser.new(@scanner).parse
@@ -76,8 +90,18 @@ module SeccompTools
         end
       end
 
+      # Resolves a jump target into a relative distance from +index+.
+      #
       # @param [Integer] index
+      #   Index of the statement the jump is written in.
       # @param [SeccompTools::Asm::Token, :next] sym
+      #   The jump target, either a label token or +:next+ for the following instruction.
+      # @return [Integer]
+      #   Number of instructions to skip, +0+ meaning the next instruction.
+      # @raise [SeccompTools::UndefinedLabelError]
+      #   If +sym+ names a label that is never defined.
+      # @raise [SeccompTools::BackwardJumpError]
+      #   If the target lies before +index+.
       def resolve_symbol(index, sym)
         return 0 if sym.is_a?(Symbol) && sym == :next
 
@@ -102,6 +126,15 @@ module SeccompTools
 
       # Emits a raw BPF object.
       #
+      # @param [Array<Symbol>] args
+      #   Names of the flags to be OR-ed together into the instruction's +code+ field, looked up in
+      #   the {Const::BPF} tables. Unknown names contribute nothing.
+      # @param [Integer] k
+      #   The +k+ field, an immediate operand or a jump target.
+      # @param [Integer] jt
+      #   The +jt+ field, instructions to skip when a comparison is true.
+      # @param [Integer] jf
+      #   The +jf+ field, instructions to skip when a comparison is false.
       # @return [BPF]
       #   Returns the emitted {BPF} object.
       def emit(*args, k: 0, jt: 0, jf: 0)
@@ -115,7 +148,7 @@ module SeccompTools
           code |= Const::BPF::OP.fetch(a, 0)
           code |= Const::BPF::MISCOP.fetch(a, 0)
         end
-        BPF.new({ code: code, k: k, jt: jt, jf: jf }, @arch, @line)
+        BPF.new({ code:, k:, jt:, jf: }, @arch, @line)
       end
 
       # A = -A
@@ -144,7 +177,7 @@ module SeccompTools
 
       def emit_alu(op, val)
         src, k = val.x? ? [:x, 0] : [:k, val.to_i]
-        emit(:alu, convert_alu_op(op), src, k: k)
+        emit(:alu, convert_alu_op(op), src, k:)
       end
 
       def convert_alu_op(op)
@@ -169,9 +202,6 @@ module SeccompTools
         emit(:ret, src, k: val.to_i)
       end
 
-      # The farthest distance of a relative jump in BPF.
-      JUMP_DISTANCE_MAX = 255
-
       def emit_cmp(cmp, jt_sym, jf_sym)
         jt = jt_sym[0]
         jf = jf_sym[0]
@@ -187,7 +217,7 @@ module SeccompTools
         val = cmp[1]
         src = val.x? ? :x : :k
         k = val.x? ? 0 : val.to_i
-        emit(:jmp, jop, src, jt: jt, jf: jf, k: k)
+        emit(:jmp, jop, src, jt:, jf:, k:)
       end
 
       # == != >= <= > < &

data/lib/seccomp-tools/asm/sasm.tab.rb

@@ -1,7 +1,7 @@
 #
 # DO NOT MODIFY!!!!
-# This file is automatically generated by Racc 1.4.16
-# from Racc grammar file "".
+# This file is automatically generated by Racc 1.8.1
+# from Racc grammar file "sasm.y".
 #
 
 require 'racc/parser.rb'
@@ -9,17 +9,24 @@ require 'racc/parser.rb'
 require 'seccomp-tools/asm/scalar'
 require 'seccomp-tools/asm/scanner'
 require 'seccomp-tools/asm/statement'
+require 'seccomp-tools/const'
 
 module SeccompTools
   module Asm
     class SeccompAsmParser < Racc::Parser
 
-module_eval(<<'...end sasm.y/module_eval...', 'sasm.y', 136)
+module_eval(<<'...end sasm.y/module_eval...', 'sasm.y', 138)
   def initialize(scanner)
     @scanner = scanner
     super()
   end
 
+  # The byte offset of the low (+hi: false+) or high 32-bit word of the 8-byte seccomp_data field
+  # at +base+; on a big-endian target the high word comes first.
+  def word_offset(base, hi:)
+    base + (hi == SeccompTools::Const::Endian.big?(@scanner.arch) ? 0 : 4)
+  end
+
   # @return [Array<Statement>]
   def parse
     @tokens = @scanner.scan.dup
@@ -311,6 +318,7 @@ Racc_arg = [
   racc_shift_n,
   racc_reduce_n,
   racc_use_result_var ]
+Ractor.make_shareable(Racc_arg) if defined?(Ractor)
 
 Racc_token_to_s_table = [
   "$end",
@@ -387,6 +395,7 @@ Racc_token_to_s_table = [
   "alu_op",
   "args",
   "number" ]
+Ractor.make_shareable(Racc_token_to_s_table) if defined?(Ractor)
 
 Racc_debug_parser = false
 
@@ -630,47 +639,48 @@ module_eval(<<'.,.,', 'sasm.y', 70)
                 off = val[1] == '>>' ? 0 : -1
                 raise_error("operator after an argument can only be '>> 32'", off)
               end
-              val[0] + 4
+              val[0] ^ 4 # the other 32-bit word of the same 64-bit field
 
   end
 .,.,
 
 module_eval(<<'.,.,', 'sasm.y', 76)
   def _reduce_46(val, _values)
-     0
+     SeccompTools::Const::BPF::SeccompData::SYS_NUMBER
   end
 .,.,
 
 module_eval(<<'.,.,', 'sasm.y', 77)
   def _reduce_47(val, _values)
-     4
+     SeccompTools::Const::BPF::SeccompData::ARCH
   end
 .,.,
 
 module_eval(<<'.,.,', 'sasm.y', 79)
   def _reduce_48(val, _values)
                   idx = val[2].to_i
-              if idx % 4 != 0 || idx >= 64
-                raise_error(format('index of data[] must be a multiple of 4 and less than 64, got %d', idx), -1)
+              size = SeccompTools::Const::BPF::SeccompData::SIZE
+              if idx % 4 != 0 || idx >= size
+                raise_error(format('index of data[] must be a multiple of 4 and less than %d, got %d', size, idx), -1)
               end
               idx
 
   end
 .,.,
 
-module_eval(<<'.,.,', 'sasm.y', 87)
+module_eval(<<'.,.,', 'sasm.y', 88)
   def _reduce_49(val, _values)
                        idx = val[2].to_i
                    s = val[0]
                    raise_error(format('index of %s[] must between 0 and 5, got %d', s, idx), -1) unless idx.between?(0, 5)
-                   16 + idx * 8 + (s.downcase.end_with?('h') ? 4 : 0)
+                   word_offset(SeccompTools::Const::BPF::SeccompData::ARGS + idx * 8, hi: s.downcase.end_with?('h'))
 
   end
 .,.,
 
-module_eval(<<'.,.,', 'sasm.y', 92)
+module_eval(<<'.,.,', 'sasm.y', 93)
   def _reduce_50(val, _values)
-     8
+     word_offset(SeccompTools::Const::BPF::SeccompData::INSTRUCTION_POINTER, hi: false)
   end
 .,.,
 
@@ -678,7 +688,7 @@ module_eval(<<'.,.,', 'sasm.y', 92)
 
 # reduce 52 omitted
 
-module_eval(<<'.,.,', 'sasm.y', 95)
+module_eval(<<'.,.,', 'sasm.y', 96)
   def _reduce_53(val, _values)
      val[0] + val[1]
   end
@@ -688,13 +698,13 @@ module_eval(<<'.,.,', 'sasm.y', 95)
 
 # reduce 55 omitted
 
-module_eval(<<'.,.,', 'sasm.y', 98)
+module_eval(<<'.,.,', 'sasm.y', 99)
   def _reduce_56(val, _values)
      Scalar::ConstVal.new(val[0] & 0xffffffff)
   end
 .,.,
 
-module_eval(<<'.,.,', 'sasm.y', 99)
+module_eval(<<'.,.,', 'sasm.y', 100)
   def _reduce_57(val, _values)
      val[1]
   end
@@ -704,37 +714,37 @@ module_eval(<<'.,.,', 'sasm.y', 99)
 
 # reduce 59 omitted
 
-module_eval(<<'.,.,', 'sasm.y', 102)
+module_eval(<<'.,.,', 'sasm.y', 103)
   def _reduce_60(val, _values)
      Scalar::A.instance
   end
 .,.,
 
-module_eval(<<'.,.,', 'sasm.y', 103)
+module_eval(<<'.,.,', 'sasm.y', 104)
   def _reduce_61(val, _values)
      Scalar::X.instance
   end
 .,.,
 
-module_eval(<<'.,.,', 'sasm.y', 104)
+module_eval(<<'.,.,', 'sasm.y', 105)
   def _reduce_62(val, _values)
      val[0].to_i
   end
 .,.,
 
-module_eval(<<'.,.,', 'sasm.y', 105)
+module_eval(<<'.,.,', 'sasm.y', 106)
   def _reduce_63(val, _values)
      val[0].to_i(16)
   end
 .,.,
 
-module_eval(<<'.,.,', 'sasm.y', 106)
+module_eval(<<'.,.,', 'sasm.y', 107)
   def _reduce_64(val, _values)
      Const::Audit::ARCH[val[0]]
   end
 .,.,
 
-module_eval(<<'.,.,', 'sasm.y', 108)
+module_eval(<<'.,.,', 'sasm.y', 109)
   def _reduce_65(val, _values)
                 s = val[0]
             return @scanner.syscalls[s.to_sym] unless s.include?('.')

data/lib/seccomp-tools/asm/sasm.y

@@ -72,14 +72,15 @@ rule
                 off = val[1] == '>>' ? 0 : -1
                 raise_error("operator after an argument can only be '>> 32'", off)
               end
-              val[0] + 4
+              val[0] ^ 4 # the other 32-bit word of the same 64-bit field
             }
-          | SYS_NUMBER { 0 }
-          | ARCH { 4 }
+          | SYS_NUMBER { SeccompTools::Const::BPF::SeccompData::SYS_NUMBER }
+          | ARCH { SeccompTools::Const::BPF::SeccompData::ARCH }
           | DATA LBRACK constexpr RBRACK {
               idx = val[2].to_i
-              if idx % 4 != 0 || idx >= 64
-                raise_error(format('index of data[] must be a multiple of 4 and less than 64, got %d', idx), -1)
+              size = SeccompTools::Const::BPF::SeccompData::SIZE
+              if idx % 4 != 0 || idx >= size
+                raise_error(format('index of data[] must be a multiple of 4 and less than %d, got %d', size, idx), -1)
               end
               idx
             }
@@ -88,9 +89,9 @@ rule
                    idx = val[2].to_i
                    s = val[0]
                    raise_error(format('index of %s[] must between 0 and 5, got %d', s, idx), -1) unless idx.between?(0, 5)
-                   16 + idx * 8 + (s.downcase.end_with?('h') ? 4 : 0)
+                   word_offset(SeccompTools::Const::BPF::SeccompData::ARGS + idx * 8, hi: s.downcase.end_with?('h'))
                  }
-               | INSTRUCTION_POINTER { 8 }
+               | INSTRUCTION_POINTER { word_offset(SeccompTools::Const::BPF::SeccompData::INSTRUCTION_POINTER, hi: false) }
   args: ARGS
       | ARGS_H
   alu_op_eq: alu_op ASSIGN { val[0] + val[1] }
@@ -131,6 +132,7 @@ end
 require 'seccomp-tools/asm/scalar'
 require 'seccomp-tools/asm/scanner'
 require 'seccomp-tools/asm/statement'
+require 'seccomp-tools/const'
 
 ---- inner
   def initialize(scanner)
@@ -138,6 +140,12 @@ require 'seccomp-tools/asm/statement'
     super()
   end
 
+  # The byte offset of the low (+hi: false+) or high 32-bit word of the 8-byte seccomp_data field
+  # at +base+; on a big-endian target the high word comes first.
+  def word_offset(base, hi:)
+    base + (hi == SeccompTools::Const::Endian.big?(@scanner.arch) ? 0 : 4)
+  end
+
   # @return [Array<Statement>]
   def parse
     @tokens = @scanner.scan.dup