seccomp-tools 1.7.0 → 1.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 74e6aff6030647eb1f380b641cfe55b58717a22c3e5dc2a0187e6da9b74263e3
-  data.tar.gz: 2c0a322b81f7d4b950686dc5c72d565cad5e3a278f47a442d7271c0ac4e03417
+  metadata.gz: a82e64649a42a26b1011701568ba1ca9c3a7a905cebb3653f10c0811a16c4f95
+  data.tar.gz: 75b0b1eac26826b39c85f5245f0ad6fe4564959bc6b6a59a1fef42637a736891
 SHA512:
-  metadata.gz: 2a8793275d9dd37fc1ed1dc0abc67a07c9aca17f9aa4b03f26c2a0ce31b27861b64f0e85608588b47841a644ae98cb4b4c34460eef8a37c5ca3a6fa0664fbb01
-  data.tar.gz: f7ab61c28a821022989c3d1ef31ab9fb966e132d6211f861339d64bf9cdffe451f970d932a4d47a890220914bf8451a0fb35afdaca191391a6b0bea4d26f9227
+  metadata.gz: 97c2d819038edc38e9af6f3c2abf815695c136e6ef2b44789f120b9c2150694ed72003f681fb42528654b1d659e84f3a52e6dc49b6ba2e5edaa891ac93b0af07
+  data.tar.gz: 934be74f304f9ff5912e82b1db3166799b9137aac7ef3bda21a9b083e793bfff8d171cef7e24523dc6b1590b0936230393ae80591ca311e2486baaa2a7d65642

data/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.7.1] - 2026-08-06
+
+### Added
+- `audit` now flags `io_uring_setup` reaching ALLOW: io_uring performs reads/writes/opens as ring operations, bypassing seccomp filters on those syscalls. The `openat2`/`clone3` equivalent-syscall gaps are also detected now that the syscall tables know those names.
+
+### Changed
+- Updated the syscall tables to Linux 7.1: amd64, i386, aarch64 and s390x were years out of date and missing modern syscalls (io_uring, clone3, openat2, the landlock family, futex_waitv, mseal, ...), so they now show up by name in disasm/explain/audit instead of as raw numbers. Existing numbers are unchanged.
+- Refreshed syscall argument names to Linux 7.1, so disasm labels the arguments of the modern syscalls (e.g. `openat2(dfd, filename, how, size)`) instead of showing bare `args[n]`.
+- Dropped the `os` gem dependency; host-OS detection now uses `RbConfig`, so seccomp-tools installs with fewer dependencies.
+
+### Fixed
+- i386 syscall 283 is now named `kexec_load`, matching every other architecture; it was mistakenly `sys_kexec_load`, so `kexec_load` did not resolve in asm/disasm on i386.
+
 ## [1.7.0] - 2026-08-01
 
 ### Added
@@ -138,7 +151,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - Initial release: the `dump` and `disasm` commands, ptrace-based dumping with `--limit` and `--output`, and i386 support.
 
-[Unreleased]: https://github.com/david942j/seccomp-tools/compare/v1.7.0...HEAD
+[Unreleased]: https://github.com/david942j/seccomp-tools/compare/v1.7.1...HEAD
+[1.7.1]: https://github.com/david942j/seccomp-tools/compare/v1.7.0...v1.7.1
 [1.7.0]: https://github.com/david942j/seccomp-tools/compare/v1.6.2...v1.7.0
 [1.6.2]: https://github.com/david942j/seccomp-tools/compare/v1.6.1...v1.6.2
 [1.6.1]: https://github.com/david942j/seccomp-tools/compare/v1.6.0...v1.6.1

data/README.md

@@ -497,6 +497,10 @@ $ seccomp-tools audit spec/data/twctf-2016-diary.bpf -a amd64
 #     another AUDIT_ARCH, so the checks can be dodged by invoking through a different ABI (e.g. i386 numbering on amd64).
 #     fix:  Compare data[4] against your AUDIT_ARCH_* and KILL every architecture you do not explicitly handle.
 #
+# [HIGH] io_uring_setup is allowed (amd64)
+#     io_uring_setup reaches ALLOW - reads/writes/opens as ring operations, bypassing filters on those syscalls.
+#     fix:  Block io_uring_setup unless the program genuinely needs it.
+#
 # [HIGH] process_vm_readv is allowed (amd64)
 #     process_vm_readv reaches ALLOW - read another process's memory.
 #     fix:  Block process_vm_readv unless the program genuinely needs it.
@@ -509,11 +513,20 @@ $ seccomp-tools audit spec/data/twctf-2016-diary.bpf -a amd64
 #     ptrace reaches ALLOW - inspect/inject into other processes.
 #     fix:  Block ptrace unless the program genuinely needs it.
 #
+# [HIGH] A file can be opened and its contents copied out (amd64)
+#     openat2, read and write all reach ALLOW, so the contents of an arbitrary file (e.g. the flag) can be copied straight
+#     back out.
+#     fix:  Deny the open-family syscalls unless the program genuinely needs arbitrary files.
+#
 # [HIGH] Default action is ALLOW (denylist) (amd64)
 #     Any syscall the filter does not explicitly block is allowed; a denylist is bypassable by any syscall the author
 #     overlooked.
 #     fix:  Use an allowlist: default to KILL/ERRNO and permit only the needed syscalls.
 #
+# [HIGH] open/openat blocked but openat2 allowed (amd64)
+#     open, openat denied, but the equivalent openat2 reaches ALLOW - same capability, different syscall number.
+#     fix:  Deny every equivalent in the group: also block openat2.
+#
 # [HIGH] x32 ABI is not guarded (amd64)
 #     Syscalls blocked by their native number are reachable via their x32 number (nr | 0x40000000): open, clone, fork,
 #     vfork, execve, creat, openat, execveat.
@@ -526,6 +539,10 @@ $ seccomp-tools audit spec/data/twctf-2016-diary.bpf -a amd64
 # [MEDIUM] socket is allowed (amd64)
 #     socket reaches ALLOW - network access (exfiltration).
 #     fix:  Block socket unless the program genuinely needs it.
+#
+# [MEDIUM] fork/vfork/clone blocked but clone3 allowed (amd64)
+#     fork, vfork, clone denied, but the equivalent clone3 reaches ALLOW - same capability, different syscall number.
+#     fix:  Deny every equivalent in the group: also block clone3.
 ```
 
 Use `--format json` for CI or tooling:

data/lib/seccomp-tools/audit/catalog.rb

@@ -18,6 +18,9 @@ module SeccompTools
         ptrace: { severity: :high, why: 'inspect/inject into other processes' },
         process_vm_readv: { severity: :high, why: "read another process's memory" },
         process_vm_writev: { severity: :high, why: "write another process's memory" },
+        io_uring_setup: {
+          severity: :high, why: 'reads/writes/opens as ring operations, bypassing filters on those syscalls'
+        },
         socket: { severity: :medium, why: 'network access (exfiltration)' },
         connect: { severity: :medium, why: 'network access (exfiltration)' }
       }.freeze

data/lib/seccomp-tools/consts/sys_arg.rb

@@ -11,26 +11,32 @@
   io_pgetevents: %w[ctx_id min_nr nr events timeout sig],
   io_pgetevents_time32: %w[ctx_id min_nr nr events timeout sig],
   io_uring_setup: %w[entries p],
-  io_uring_enter: %w[fd to_submit min_complete flags sig sigsz],
+  io_uring_enter: %w[fd to_submit min_complete flags argp argsz],
   io_uring_register: %w[fd op arg nr_args],
   setxattr: %w[path name value size flags],
+  setxattrat: %w[dfd path at_flags name args size],
   lsetxattr: %w[path name value size flags],
   fsetxattr: %w[fd name value size flags],
   getxattr: %w[path name value size],
+  getxattrat: %w[dfd path at_flags name args size],
   lgetxattr: %w[path name value size],
   fgetxattr: %w[fd name value size],
   listxattr: %w[path list size],
+  listxattrat: %w[dfd path at_flags list size],
   llistxattr: %w[path list size],
   flistxattr: %w[fd list size],
   removexattr: %w[path name],
+  removexattrat: %w[dfd path at_flags name],
   lremovexattr: %w[path name],
   fremovexattr: %w[fd name],
+  file_getattr: %w[dfd filename attr usize at_flags],
+  file_setattr: %w[dfd filename attr usize at_flags],
   getcwd: %w[buf size],
-  lookup_dcookie: %w[cookie64 buf len],
   eventfd2: %w[count flags],
   epoll_create1: %w[flags],
   epoll_ctl: %w[epfd op fd event],
   epoll_pwait: %w[epfd events maxevents timeout sigmask sigsetsize],
+  epoll_pwait2: %w[epfd events maxevents timeout sigmask sigsetsize],
   dup: %w[fildes],
   dup3: %w[oldfd newfd flags],
   fcntl: %w[fd cmd arg],
@@ -55,24 +61,32 @@
   statfs64: %w[path sz buf],
   fstatfs: %w[fd buf],
   fstatfs64: %w[fd sz buf],
+  statmount: %w[req buf bufsize flags],
+  listmount: %w[req mnt_ids nr_mnt_ids flags],
+  listns: %w[req ns_ids nr_ns_ids flags],
   truncate: %w[path length],
   ftruncate: %w[fd length],
   truncate64: %w[path length],
   ftruncate64: %w[fd length],
   fallocate: %w[fd mode offset len],
   faccessat: %w[dfd filename mode],
+  faccessat2: %w[dfd filename mode flags],
   chdir: %w[filename],
   fchdir: %w[fd],
   chroot: %w[filename],
   fchmod: %w[fd mode],
   fchmodat: %w[dfd filename mode],
+  fchmodat2: %w[dfd filename mode flags],
   fchownat: %w[dfd filename user group flag],
   fchown: %w[fd user group],
   openat: %w[dfd filename flags mode],
+  openat2: %w[dfd filename how size],
   close: %w[fd],
+  close_range: %w[fd max_fd flags],
   vhangup: %w[],
   pipe2: %w[fildes flags],
   quotactl: %w[cmd special id addr],
+  quotactl_fd: %w[fd cmd id addr],
   getdents64: %w[fd dirent count],
   llseek: %w[fd offset_high offset_low result whence],
   lseek: %w[fd offset whence],
@@ -119,6 +133,10 @@
   futex_time32: %w[uaddr op val utime uaddr2 val3],
   get_robust_list: %w[pid head_ptr len_ptr],
   set_robust_list: %w[head len],
+  futex_waitv: %w[waiters nr_futexes flags timeout clockid],
+  futex_wake: %w[uaddr mask nr flags],
+  futex_wait: %w[uaddr val mask flags timespec clockid],
+  futex_requeue: %w[waiters flags nr_wake nr_requeue],
   nanosleep: %w[rqtp rmtp],
   nanosleep_time32: %w[rqtp rmtp],
   getitimer: %w[which value],
@@ -241,6 +259,7 @@
   add_key: %w[_type _description _payload plen destringid],
   request_key: %w[_type _description _callout_info destringid],
   keyctl: %w[cmd arg2 arg3 arg4 arg5],
+  clone3: %w[uargs size],
   execve: %w[filename argv envp],
   fadvise64_64: %w[fd offset len advice],
   swapon: %w[specialfile swap_flags],
@@ -253,7 +272,10 @@
   munlockall: %w[],
   mincore: %w[start len vec],
   madvise: %w[start len behavior],
+  process_madvise: %w[pidfd vec vlen behavior flags],
+  process_mrelease: %w[pidfd flags],
   remap_file_pages: %w[start size prot pgoff flags],
+  mseal: %w[start len flags],
   mbind: %w[start len mode nmask maxnode flags],
   get_mempolicy: %w[policy nmask maxnode addr flags],
   set_mempolicy: %w[mode nmask maxnode],
@@ -273,6 +295,7 @@
   clock_adjtime32: %w[which_clock tx],
   syncfs: %w[fd],
   setns: %w[fd nstype],
+  pidfd_open: %w[pid flags],
   sendmmsg: %w[fd msg vlen flags],
   process_vm_readv: %w[pid lvec liovcnt rvec riovcnt flags],
   process_vm_writev: %w[pid lvec liovcnt rvec riovcnt flags],
@@ -287,7 +310,7 @@
   bpf: %w[cmd attr size],
   execveat: %w[dfd filename argv envp flags],
   userfaultfd: %w[flags],
-  membarrier: %w[cmd flags],
+  membarrier: %w[cmd flags cpu_id],
   mlock2: %w[start len flags],
   copy_file_range: %w[fd_in off_in fd_out off_out len flags],
   preadv2: %w[fd vec vlen pos_l pos_h flags],
@@ -297,14 +320,30 @@
   pkey_free: %w[pkey],
   statx: %w[dfd path flags mask buffer],
   rseq: %w[rseq rseq_len flags sig],
+  rseq_slice_yield: %w[],
   open_tree: %w[dfd path flags],
+  open_tree_attr: %w[dfd path flags uattr usize],
   move_mount: %w[from_dfd from_path to_dfd to_path ms_flags],
+  mount_setattr: %w[dfd path flags uattr usize],
   fsopen: %w[fs_name flags],
   fsconfig: %w[fs_fd cmd key value aux],
   fsmount: %w[fs_fd flags ms_flags],
   fspick: %w[dfd path flags],
   pidfd_send_signal: %w[pidfd sig info flags],
+  pidfd_getfd: %w[pidfd fd flags],
+  landlock_create_ruleset: %w[attr size flags],
+  landlock_add_rule: %w[ruleset_fd rule_type rule_attr flags],
+  landlock_restrict_self: %w[ruleset_fd flags],
+  memfd_secret: %w[flags],
+  set_mempolicy_home_node: %w[start len home_node flags],
+  cachestat: %w[fd cstat_range cstat flags],
+  map_shadow_stack: %w[addr size flags],
+  lsm_get_self_attr: %w[attr ctx size flags],
+  lsm_set_self_attr: %w[attr ctx size flags],
+  lsm_list_modules: %w[ids size flags],
   ioperm: %w[from num on],
+  uretprobe: %w[],
+  uprobe: %w[],
   pciconfig_read: %w[bus dfn off len buf],
   pciconfig_write: %w[bus dfn off len buf],
   pciconfig_iobase: %w[which bus devfn],
@@ -352,10 +391,8 @@
   epoll_wait: %w[epfd events maxevents timeout],
   ustat: %w[dev ubuf],
   vfork: %w[],
-  bdflush: %w[func data],
   oldumount: %w[name],
   uselib: %w[library],
-  sysctl: %w[args],
   sysfs: %w[option arg1 arg2],
   fork: %w[],
   stime: %w[tptr],
@@ -399,6 +436,7 @@
   mmap_pgoff: %w[addr len prot flags fd pgoff],
   old_mmap: %w[arg],
   ni_syscall: %w[],
+  ni_posix_timers: %w[],
   io_submit: %w[ctx_id nr iocbpp],
   pselect6: %w[n inp outp exp tsp sig],
   pselect6_time32: %w[n inp outp exp tsp sig],

data/lib/seccomp-tools/consts/sys_nr/aarch64.rb

@@ -280,5 +280,56 @@
   pkey_mprotect: 288,
   pkey_alloc: 289,
   pkey_free: 290,
-  statx: 291
+  statx: 291,
+  io_pgetevents: 292,
+  rseq: 293,
+  kexec_file_load: 294,
+  pidfd_send_signal: 424,
+  io_uring_setup: 425,
+  io_uring_enter: 426,
+  io_uring_register: 427,
+  open_tree: 428,
+  move_mount: 429,
+  fsopen: 430,
+  fsconfig: 431,
+  fsmount: 432,
+  fspick: 433,
+  pidfd_open: 434,
+  clone3: 435,
+  close_range: 436,
+  openat2: 437,
+  pidfd_getfd: 438,
+  faccessat2: 439,
+  process_madvise: 440,
+  epoll_pwait2: 441,
+  mount_setattr: 442,
+  quotactl_fd: 443,
+  landlock_create_ruleset: 444,
+  landlock_add_rule: 445,
+  landlock_restrict_self: 446,
+  memfd_secret: 447,
+  process_mrelease: 448,
+  futex_waitv: 449,
+  set_mempolicy_home_node: 450,
+  cachestat: 451,
+  fchmodat2: 452,
+  map_shadow_stack: 453,
+  futex_wake: 454,
+  futex_wait: 455,
+  futex_requeue: 456,
+  statmount: 457,
+  listmount: 458,
+  lsm_get_self_attr: 459,
+  lsm_set_self_attr: 460,
+  lsm_list_modules: 461,
+  mseal: 462,
+  setxattrat: 463,
+  getxattrat: 464,
+  listxattrat: 465,
+  removexattrat: 466,
+  open_tree_attr: 467,
+  file_getattr: 468,
+  file_setattr: 469,
+  listns: 470,
+  rseq_slice_yield: 471
 }

data/lib/seccomp-tools/consts/sys_nr/amd64.rb

@@ -337,5 +337,57 @@ X32_MODE_BIT = 0x40000000
   pkey_mprotect: 329,
   pkey_alloc: 330,
   pkey_free: 331,
-  statx: 332
+  statx: 332,
+  io_pgetevents: 333,
+  rseq: 334,
+  uretprobe: 335,
+  uprobe: 336,
+  pidfd_send_signal: 424,
+  io_uring_setup: 425,
+  io_uring_enter: 426,
+  io_uring_register: 427,
+  open_tree: 428,
+  move_mount: 429,
+  fsopen: 430,
+  fsconfig: 431,
+  fsmount: 432,
+  fspick: 433,
+  pidfd_open: 434,
+  clone3: 435,
+  close_range: 436,
+  openat2: 437,
+  pidfd_getfd: 438,
+  faccessat2: 439,
+  process_madvise: 440,
+  epoll_pwait2: 441,
+  mount_setattr: 442,
+  quotactl_fd: 443,
+  landlock_create_ruleset: 444,
+  landlock_add_rule: 445,
+  landlock_restrict_self: 446,
+  memfd_secret: 447,
+  process_mrelease: 448,
+  futex_waitv: 449,
+  set_mempolicy_home_node: 450,
+  cachestat: 451,
+  fchmodat2: 452,
+  map_shadow_stack: 453,
+  futex_wake: 454,
+  futex_wait: 455,
+  futex_requeue: 456,
+  statmount: 457,
+  listmount: 458,
+  lsm_get_self_attr: 459,
+  lsm_set_self_attr: 460,
+  lsm_list_modules: 461,
+  mseal: 462,
+  setxattrat: 463,
+  getxattrat: 464,
+  listxattrat: 465,
+  removexattrat: 466,
+  open_tree_attr: 467,
+  file_getattr: 468,
+  file_setattr: 469,
+  listns: 470,
+  rseq_slice_yield: 471
 }.tap { |h| h.keys.each { |k| h[:"x32_#{k}"] = h[k] | X32_MODE_BIT } }

data/lib/seccomp-tools/consts/sys_nr/i386.rb

@@ -282,7 +282,7 @@
   mq_timedreceive: 280,
   mq_notify: 281,
   mq_getsetattr: 282,
-  sys_kexec_load: 283,
+  kexec_load: 283,
   waitid: 284,
   add_key: 286,
   request_key: 287,
@@ -381,5 +381,86 @@
   pkey_mprotect: 380,
   pkey_alloc: 381,
   pkey_free: 382,
-  statx: 383
+  statx: 383,
+  arch_prctl: 384,
+  io_pgetevents: 385,
+  rseq: 386,
+  semget: 393,
+  semctl: 394,
+  shmget: 395,
+  shmctl: 396,
+  shmat: 397,
+  shmdt: 398,
+  msgget: 399,
+  msgsnd: 400,
+  msgrcv: 401,
+  msgctl: 402,
+  clock_gettime64: 403,
+  clock_settime64: 404,
+  clock_adjtime64: 405,
+  clock_getres_time64: 406,
+  clock_nanosleep_time64: 407,
+  timer_gettime64: 408,
+  timer_settime64: 409,
+  timerfd_gettime64: 410,
+  timerfd_settime64: 411,
+  utimensat_time64: 412,
+  pselect6_time64: 413,
+  ppoll_time64: 414,
+  io_pgetevents_time64: 416,
+  recvmmsg_time64: 417,
+  mq_timedsend_time64: 418,
+  mq_timedreceive_time64: 419,
+  semtimedop_time64: 420,
+  rt_sigtimedwait_time64: 421,
+  futex_time64: 422,
+  sched_rr_get_interval_time64: 423,
+  pidfd_send_signal: 424,
+  io_uring_setup: 425,
+  io_uring_enter: 426,
+  io_uring_register: 427,
+  open_tree: 428,
+  move_mount: 429,
+  fsopen: 430,
+  fsconfig: 431,
+  fsmount: 432,
+  fspick: 433,
+  pidfd_open: 434,
+  clone3: 435,
+  close_range: 436,
+  openat2: 437,
+  pidfd_getfd: 438,
+  faccessat2: 439,
+  process_madvise: 440,
+  epoll_pwait2: 441,
+  mount_setattr: 442,
+  quotactl_fd: 443,
+  landlock_create_ruleset: 444,
+  landlock_add_rule: 445,
+  landlock_restrict_self: 446,
+  memfd_secret: 447,
+  process_mrelease: 448,
+  futex_waitv: 449,
+  set_mempolicy_home_node: 450,
+  cachestat: 451,
+  fchmodat2: 452,
+  map_shadow_stack: 453,
+  futex_wake: 454,
+  futex_wait: 455,
+  futex_requeue: 456,
+  statmount: 457,
+  listmount: 458,
+  lsm_get_self_attr: 459,
+  lsm_set_self_attr: 460,
+  lsm_list_modules: 461,
+  mseal: 462,
+  setxattrat: 463,
+  getxattrat: 464,
+  listxattrat: 465,
+  removexattrat: 466,
+  open_tree_attr: 467,
+  file_getattr: 468,
+  file_setattr: 469,
+  listns: 470,
+  rseq_slice_yield: 471
 }

data/lib/seccomp-tools/consts/sys_nr/s390x.rb

@@ -361,5 +361,34 @@
   faccessat2: 439,
   process_madvise: 440,
   epoll_pwait2: 441,
-  mount_setattr: 442
+  mount_setattr: 442,
+  quotactl_fd: 443,
+  landlock_create_ruleset: 444,
+  landlock_add_rule: 445,
+  landlock_restrict_self: 446,
+  memfd_secret: 447,
+  process_mrelease: 448,
+  futex_waitv: 449,
+  set_mempolicy_home_node: 450,
+  cachestat: 451,
+  fchmodat2: 452,
+  map_shadow_stack: 453,
+  futex_wake: 454,
+  futex_wait: 455,
+  futex_requeue: 456,
+  statmount: 457,
+  listmount: 458,
+  lsm_get_self_attr: 459,
+  lsm_set_self_attr: 460,
+  lsm_list_modules: 461,
+  mseal: 462,
+  setxattrat: 463,
+  getxattrat: 464,
+  listxattrat: 465,
+  removexattrat: 466,
+  open_tree_attr: 467,
+  file_getattr: 468,
+  file_setattr: 469,
+  listns: 470,
+  rseq_slice_yield: 471
 }

data/lib/seccomp-tools/dumper.rb

@@ -1,19 +1,18 @@
 # frozen_string_literal: true
 
-require 'os'
 require 'timeout'
 
 require 'seccomp-tools/logger'
-require 'seccomp-tools/ptrace' if OS.linux?
-require 'seccomp-tools/syscall'
 require 'seccomp-tools/util'
+require 'seccomp-tools/ptrace' if SeccompTools::Util.linux?
+require 'seccomp-tools/syscall'
 
 module SeccompTools
   # Dump seccomp-bpf using ptrace of binary.
   module Dumper
     # Whether the dumper is supported.
     # Dumper works based on ptrace, so we need the platform to be Linux.
-    SUPPORTED = OS.linux?
+    SUPPORTED = Util.linux?
 
     module_function
 

data/lib/seccomp-tools/syscall.rb

@@ -1,11 +1,9 @@
 # encoding: ascii-8bit
 # frozen_string_literal: true
 
-require 'os'
-
 require 'seccomp-tools/const'
 require 'seccomp-tools/util'
-require 'seccomp-tools/ptrace' if OS.linux?
+require 'seccomp-tools/ptrace' if SeccompTools::Util.linux?
 
 module SeccompTools
   # Record syscall number, arguments, return value.

data/lib/seccomp-tools/util.rb

@@ -16,6 +16,12 @@ module SeccompTools
                               .sort
     end
 
+    # Whether the host operating system is Linux, where the +ptrace+-based dumping works.
+    # @return [Boolean]
+    def linux?
+      RbConfig::CONFIG['host_os'].include?('linux')
+    end
+
     # Detect system architecture.
     # @return [Symbol]
     #   One of {supported_archs}, or +:unknown+ if the host CPU is not supported.

data/lib/seccomp-tools/version.rb

@@ -2,5 +2,5 @@
 
 module SeccompTools
   # Gem version.
-  VERSION = '1.7.0'
+  VERSION = '1.7.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: seccomp-tools
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.7.1
 platform: ruby
 authors:
 - david942j
@@ -121,26 +121,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: os
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.1'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.1.1
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.1'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.1.1
 - !ruby/object:Gem::Dependency
   name: racc
   requirement: !ruby/object:Gem::Requirement