straycall 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3148046a174ba55ee9edf9d943c9e834391ec89f16684df60bae3b3bcecbfcf4
-  data.tar.gz: ed337c7d5cf746f9384f9ee9d6397aa53926ecd3e770adf162e43996a820bda4
+  metadata.gz: 40a825fdd8eb649cf8455faec21e607cac5bf89f93c1136fdec311990361d1ae
+  data.tar.gz: e3eac0d6b59c484f603bf17ebb7ea72a4fc5d1e27916ada148572712b050ae09
 SHA512:
-  metadata.gz: 7e8833fbe0ec64716d1ca1bf179b2b7572006e0ea4743d351f1813e10d16a9de61e9ca7d192adffab6e239b610c290b86a247db844b82c18b6cc92f5a0b54611
-  data.tar.gz: 27df7b94480aaeb6c99742b55a32ad0f212b988fabcea451fbe8d6a1063baad91719060e14efb104c32849a25fa1cf458a42b7a0dd41097232b1b3ed5612eef0
+  metadata.gz: a23da98781ebfbe39409b9fc601ae3e5bbef513ec8d4fd482a0f2efb15153b275f6af23359cb6d9b11f562db2d39e562b450014649af681b959316103a6344fa
+  data.tar.gz: b4b5533a953cd033fd9a0f1d6db5f838b38e855450bf07e3eb22c21ec6ad15d1b3233dba451ec15dec9ea9e2b0bcddee0b4e7dade5f5cc12c813896e9ceb6ca4

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to Straycall are documented here.
 
+## v0.2.0 - 2026-08-24
+
+- Reuse CLI supervision from RSpec and Minitest integrations and prevent descendant Ruby processes from consuming another process's reporter messages.
+- Keep listener-transfer descriptors reserved and warn when in-process installation cannot cover existing threads.
+- Cover additional filesystem mutation syscalls, writable shared mappings, listeners, and local netlink sockets.
+- Make recorded policies non-destructive, exact, and replayable for raw socket families and unbound listeners.
+- Resolve executable aliases and support directory-scoped executable allow rules.
+- Reduce notification and report-writing overhead, handle IPv4-mapped loopback addresses, and warn when supervision is unavailable.
+- Require seccomp-notify 0.3 for thread-safe termination, x32 rejection, and listener-transfer hardening.
+
 ## v0.1.0 - 2026-08-23
 
 - Initial release.

data/README.md

@@ -1,40 +1,116 @@
-# Straycall
-
-Straycall reports and blocks unintended network, filesystem, and process access from Ruby builds and test suites. It runs an unfiltered supervisor over Linux `seccomp` user notifications and includes the responsible Ruby backtrace in its report.
+<h1 align="center">Straycall</h1>
+
+<p align="center">
+  <strong>Report and block unintended syscalls in Ruby builds and tests</strong>
+</p>
+
+<p align="center">
+  <a href="https://rubygems.org/gems/straycall"><img src="https://img.shields.io/gem/v/straycall.svg?colorB=38bdf8" alt="Gem Version"></a>
+  <a href="https://rubygems.org/gems/straycall"><img src="https://img.shields.io/gem/dt/straycall.svg" alt="Downloads"></a>
+  <img src="https://img.shields.io/badge/ruby-%3E%3D%203.1-ruby.svg" alt="Ruby Version">
+  <a href="https://github.com/ydah/straycall/actions/workflows/main.yml"><img src="https://github.com/ydah/straycall/actions/workflows/main.yml/badge.svg" alt="Ruby CI"></a>
+  <img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License">
+</p>
+
+<p align="center">
+  <a href="https://ydah.github.io/straycall/">Website</a> ·
+  <a href="#features">Features</a> ·
+  <a href="#installation">Installation</a> ·
+  <a href="#quick-start">Quick Start</a> ·
+  <a href="#configuration">Configuration</a> ·
+  <a href="#integrations">Integrations</a> ·
+  <a href="#how-it-works">How It Works</a> ·
+  <a href="#known-limitations">Limitations</a>
+</p>
+
+---
+
+Straycall runs an unfiltered supervisor over Linux [seccomp user notifications](https://www.kernel.org/doc/html/latest/userspace-api/seccomp_filter.html) to report and block unintended network, filesystem, and process access. Each report includes the responsible Ruby backtrace when available.
 
 > [!WARNING]
 > Straycall detects accidents; it is not a security boundary for hostile code. Pointer-based policy checks, symbolic links, existing file descriptors, and kernel interfaces outside seccomp's reach leave intentional escape routes.
 
-On macOS, Windows, non-MRI Ruby, an unsupported kernel, or with `STRAYCALL=0`, requiring and configuring Straycall is a no-op. The wrapped command runs normally.
-
-## Requirements
+On unsupported platforms, non-MRI Ruby, or with `STRAYCALL=0`, Straycall is a no-op and the wrapped command runs normally.
 
-- Linux x86_64 or aarch64 with seccomp user notifications and `CONTINUE` (Linux 5.5+)
-- MRI Ruby 3.1+
-- `seccomp-notify` 0.2.x
+## Features
 
-Container runtimes may block `seccomp(2)` in their own profile. Use an isolated container with `--security-opt seccomp=unconfined` when needed.
+- Network policies for connections, Unix sockets, binds, and listeners
+- Filesystem policies for writes and sensitive reads
+- Process policies for allowed and denied executables
+- Ruby backtraces with native-library fallback
+- `fail`, `warn`, `record`, and interactive `prompt` modes
+- CLI, YAML, and Ruby configuration
+- RSpec and Minitest integrations
+- Console and versioned JSON reports
+- Automatic no-op behavior outside supported Linux environments
 
 ## Installation
 
+Add Straycall to your Gemfile:
+
 ```ruby
 gem "straycall"
 ```
 
-## CLI (recommended)
+Then install:
+
+```sh
+bundle install
+```
+
+### Requirements
+
+- Linux x86_64 or aarch64
+- Linux 5.5+ with seccomp user notifications and `CONTINUE`
+- MRI Ruby 3.1+
+- `seccomp-notify` 0.2.x
+
+Container runtimes may block `seccomp(2)` in their own profile. Use an isolated container with `--security-opt seccomp=unconfined` when needed.
+
+## Quick Start
 
 The CLI keeps the supervisor outside the filtered command, so it does not interfere with the command's `Process.wait` calls.
 
+Run a test suite with a YAML policy:
+
 ```sh
 straycall --config .straycall.yml -- bundle exec rspec
+```
+
+Write a JSON report:
+
+```sh
 straycall --report-path tmp/straycall.json -- ruby script.rb
-straycall --record --policy-path .straycall.yml -- bundle exec rspec
+```
+
+Record observed access as a reviewable policy:
+
+```sh
+straycall --record -- bundle exec rspec
+```
+
+Prompt while installing dependencies:
+
+```sh
 straycall --preset=bundle-install -- bundle install
 ```
 
-`--warn` and `--record` allow the syscall after reporting it. `--prompt` asks through `/dev/tty`; without a TTY it denies. The default `fail` mode and a denied prompt return `EPERM` and make the CLI exit nonzero.
+### Violation Modes
 
-## YAML policy
+| Mode | Behavior |
+|------|----------|
+| `fail` | Deny the syscall with `EPERM` and exit nonzero |
+| `warn` | Allow the syscall and report it |
+| `record` | Allow the syscall and write a reviewable policy |
+| `prompt` | Ask through `/dev/tty`; deny when no TTY is available |
+
+The default mode is `fail`.
+
+Record mode writes `.straycall.recorded.yml` and refuses to replace an existing file. Review it before moving it to `.straycall.yml`; pass `--force` only when replacing a previous recording intentionally.
+
+## Configuration
+
+Create `.straycall.yml` in your project root:
 
 ```yaml
 network:
@@ -43,21 +119,36 @@ network:
     - host: 127.0.0.1
       ports: [5432, 6379]
     - unix: /var/run/postgresql/.s.PGSQL.5432
+    - domain: 17 # platform socket-family number
+  allow_unbound_listen: false
+
 write:
   default: deny
   allow: [tmp, log, coverage, /tmp]
   deny_read: [/etc/shadow, ~/.ssh, ~/.aws, ~/.gem/credentials]
+
 exec:
-  default: allow
-  deny: [/usr/bin/curl, /usr/bin/wget]
+  default: deny
+  allow_under: [/usr/bin]
+
 on_violation: fail
 report_backtrace: true
 report_path: tmp/straycall.json
 ```
 
-Hosts are resolved once while loading the configuration. Paths are expanded but symbolic links are deliberately not resolved.
+| Option | Default | Description |
+|--------|---------|-------------|
+| `network.default` | `deny` | Allow or deny network endpoints not listed in `network.allow` |
+| `network.allow_unbound_listen` | `false` | Permit listeners whose bound endpoint cannot be recovered |
+| `write.default` | `allow` | Allow or deny writes outside `write.allow` |
+| `exec.default` | `allow` | Allow or deny executables outside `exec.allow` |
+| `on_violation` | `fail` | Select `fail`, `warn`, `record`, or `prompt` |
+| `report_backtrace` | `true` | Include Ruby backtraces in reports |
+| `report_path` | unset | Write a versioned JSON report to this path |
+
+Hosts are resolved once while loading the configuration. Filesystem paths are expanded; executable paths are resolved through symbolic links when possible.
 
-## Ruby configuration
+### Ruby Configuration
 
 ```ruby
 require "straycall"
@@ -67,19 +158,25 @@ Straycall.configure do |config|
   config.allow_loopback ports: [5432, 6379]
   config.allow_host "registry.internal.example", ports: [443]
   config.allow_unix "/var/run/postgresql/.s.PGSQL.5432"
+  config.allow_socket_domain Socket::AF_PACKET
+  config.allow_unbound_listen!
 
   config.allow_write_under "tmp", "log", "coverage", Dir.tmpdir
   config.deny_write_elsewhere!
   config.deny_read "/etc/shadow", "~/.ssh"
 
   config.allow_exec "/usr/bin/git", "/usr/bin/make"
+  config.allow_exec_under "/opt/project/bin"
   config.deny_exec_elsewhere!
   # config.allow_io_uring! # disables complete syscall coverage
+
   config.report_path = "tmp/straycall.json"
 end
 ```
 
-## RSpec and Minitest
+## Integrations
+
+### RSpec and Minitest
 
 Load the integration at the top of the test helper:
 
@@ -91,35 +188,68 @@ require "straycall/rspec"
 require "straycall/minitest"
 ```
 
-This in-process mode starts a clean detached supervisor with `Process.spawn`, associates violations with the current test, and checks the supervisor health pipe. Prefer the CLI if tests use broad `Process.wait` calls or fork heavily; filters are inherited and cannot be removed.
+In-process mode starts a clean detached supervisor with `Process.spawn`, associates violations with the current test, and checks the supervisor health pipe. When it runs below the `straycall` CLI, it reuses the CLI supervisor instead of installing a second seccomp listener. Prefer the CLI if tests use broad `Process.wait` calls or fork heavily; filters are inherited and cannot be removed.
 
-## Reports
+### Reports
 
-Console output includes the syscall, target, current test, Ruby backtrace (MRI), a `/proc/<tid>/maps` native-library fallback, and an allow-list suggestion. `report_path` writes a versioned JSON document:
+Console reports include the syscall, target, current test, Ruby backtrace, native-library fallback, and an allow-list suggestion. Set `report_path` to write a versioned JSON document:
 
 ```json
-{"version":1,"violations":[{"syscall":"connect","tid":123,"target":{"type":"inet","host":"192.0.2.1","port":443},"action":"denied"}]}
+{
+  "version": 1,
+  "violations": [
+    {
+      "syscall": "connect",
+      "tid": 123,
+      "target": {
+        "type": "inet",
+        "host": "192.0.2.1",
+        "port": 443
+      },
+      "action": "denied"
+    }
+  ]
+}
 ```
 
-## Known limitations
+## How It Works
+
+1. Straycall starts an unfiltered supervisor before the target command.
+2. The target installs a seccomp filter for the configured syscall classes.
+3. Linux pauses matching syscalls and sends user notifications to the supervisor.
+4. The supervisor reads the target, evaluates the policy, and allows or denies the call.
+5. Straycall joins violations with the current test and Ruby backtrace, then writes the configured reports.
 
-1. This is not a security boundary. Allowing a pointer-based syscall with `continue!` is subject to TOCTOU.
+## Known Limitations
+
+1. Straycall is not a security boundary. Allowing a pointer-based syscall with `continue!` is subject to TOCTOU.
 2. vDSO calls such as normal clock reads cannot be intercepted.
 3. File descriptors opened before filter installation are outside the policy.
 4. `io_uring_setup` is denied so io_uring cannot bypass monitored syscalls. `allow_io_uring!` opts out, but network and filesystem coverage is then incomplete.
 5. Ruby backtraces require MRI 3.1+; native calls fall back to `/proc/<tid>/maps`.
 6. Filesystem checks use the unresolved path string. A symlink can point outside an allowed root.
 7. If the supervisor dies, the kernel returns `ENOSYS`; integrations detect the health-pipe closure as soon as they regain control.
-8. A connected `sendto`/`sendmsg`/`sendmmsg` without an explicit destination relies on the earlier monitored `connect`; Straycall cannot recover a peer address from the target file descriptor.
+8. A connected `sendto`, `sendmsg`, or `sendmmsg` without an explicit destination relies on the earlier monitored `connect`; Straycall cannot recover a peer address from the target file descriptor.
 9. Listener tracking observes an allowed `bind` before the kernel returns. It prevents accidental auto-bind listeners, but it is not a hostile-code boundary.
+10. In-process integrations only filter the thread that installs seccomp. Load them before starting application threads; Straycall warns when threads already exist.
+11. `ptrace` is denied inside supervised processes, so attach profilers and debuggers from outside the target.
 
 ## Development
 
 ```sh
-ruby -Ilib -S rspec
+bundle install
+bundle exec rake
 gem build straycall.gemspec
 ```
 
 Real seccomp integration examples skip automatically outside supported Linux environments.
 
-On Linux, `ruby benchmark/require_overhead.rb` checks that read-only `openat` overhead stays below 10% across 100,000 generated require files, using the median ratio of five alternating pairs after warmup. Set `STRAYCALL_BENCHMARK_FILES` to scale the workload.
+On Linux, `ruby benchmark/require_overhead.rb` checks that read-only `openat` overhead stays below 10% across 100,000 generated require files. Set `STRAYCALL_BENCHMARK_FILES` to scale the workload.
+
+## Contributing
+
+Bug reports and pull requests are welcome at https://github.com/ydah/straycall.
+
+## License
+
+Released under the [MIT License](LICENSE.txt).

data/exe/straycall-supervisor

@@ -27,3 +27,4 @@ supervisor = Seccomp::Notify::Supervisor.new(
 guard.register(supervisor)
 health_writer.write("S")
 supervisor.run
+guard.flush_report

data/lib/straycall/cli.rb

@@ -17,14 +17,17 @@ module Straycall
 
     def run
       parse!
-      return exec(*@argv) unless Straycall.available?
+      unless Straycall.available?
+        Straycall.warn_unavailable!
+        return exec(*@argv)
+      end
 
       require "seccomp/notify"
       require_relative "supervisor"
       status, violations = Supervisor.new(Straycall.config).run(@argv)
       if Straycall.config.on_violation == :record
         require_relative "recorder"
-        Recorder.new(@policy_path).write(violations)
+        Recorder.new(@policy_path, force: @force).write(violations)
       end
       return 1 if violations.any? { |violation| violation.action == :denied }
 
@@ -50,6 +53,7 @@ module Straycall
         options.on("--report-path PATH") { |value| @config_actions << ->(config) { config.report_path = value } }
         options.on("--record") { @config_actions << ->(config) { config.on_violation = :record } }
         options.on("--policy-path PATH") { |value| @policy_path = value }
+        options.on("--force") { @force = true }
         options.on("--warn") { @config_actions << ->(config) { config.on_violation = :warn } }
         options.on("--prompt") { @config_actions << ->(config) { config.on_violation = :prompt } }
         options.on("--preset NAME") { |value| @config_actions << ->(config) { apply_preset(config, value) } }
@@ -57,7 +61,7 @@ module Straycall
       parser.order!(@argv)
       @argv.shift if @argv.first == "--"
       raise OptionParser::MissingArgument, "command" if @argv.empty?
-      @policy_path ||= ".straycall.yml"
+      @policy_path ||= ".straycall.recorded.yml"
       Straycall.config = @config_path ? Config.load(@config_path) : Straycall.config
       @config_actions.each { |action| action.call(Straycall.config) }
     end

data/lib/straycall/config.rb

@@ -53,6 +53,14 @@ module Straycall
       network.allow_host(host, ports:)
     end
 
+    def allow_socket_domain(domain)
+      network.allow_domain(domain)
+    end
+
+    def allow_unbound_listen!
+      network.allow_unbound_listen!
+    end
+
     def allow_write_under(*paths)
       paths.each { |path| filesystem.allow_write_under(path) }
     end
@@ -69,6 +77,10 @@ module Straycall
       paths.each { |path| exec.allow(path) }
     end
 
+    def allow_exec_under(*paths)
+      paths.each { |path| exec.allow_under(path) }
+    end
+
     def deny_exec_elsewhere!
       exec.deny_elsewhere!
     end
@@ -127,29 +139,35 @@ module Straycall
     private
 
     def apply_network(data)
-      validate_keys!(data, %w[default allow], "network")
+      validate_keys!(data, %w[default allow allow_unbound_listen], "network")
       default = key?(data, "default") ? fetch(data, "default") : "deny"
       raise ConfigurationError, "network.default must be allow or deny" unless %w[allow deny].include?(default)
 
       default == "allow" ? network.allow! : network.deny!
       array(data, "allow").each do |rule|
         raise ConfigurationError, "network allow rules must be mappings" unless rule.is_a?(Hash)
-        validate_keys!(rule, %w[host ports unix], "network allow rule")
+        validate_keys!(rule, %w[host ports unix domain], "network allow rule")
 
         unix = key?(rule, "unix")
         host = key?(rule, "host")
-        raise ConfigurationError, "network allow rule requires exactly one of host or unix" if unix == host
+        domain = key?(rule, "domain")
+        raise ConfigurationError, "network allow rule requires exactly one of host, unix, or domain" unless [unix, host, domain].count(true) == 1
 
         if unix
           raise ConfigurationError, "unix network allow rules cannot specify ports" if key?(rule, "ports")
 
           path = fetch(rule, "unix")
           allow_unix(string(path, "unix"))
-        else
+        elsif host
           address = fetch(rule, "host")
           allow_host(string(address, "host"), ports: fetch(rule, "ports"))
+        else
+          raise ConfigurationError, "socket domain rules cannot specify ports" if key?(rule, "ports")
+
+          allow_socket_domain(fetch(rule, "domain"))
         end
       end
+      allow_unbound_listen! if key?(data, "allow_unbound_listen") && boolean(data, "allow_unbound_listen")
     end
 
     def apply_write(data)
@@ -163,11 +181,12 @@ module Straycall
     end
 
     def apply_exec(data)
-      validate_keys!(data, %w[default allow deny], "exec")
+      validate_keys!(data, %w[default allow allow_under deny], "exec")
       default = key?(data, "default") ? fetch(data, "default") : "allow"
       raise ConfigurationError, "exec.default must be allow or deny" unless %w[allow deny].include?(default)
 
       array(data, "allow").each { |path| allow_exec(string(path, "exec.allow")) }
+      array(data, "allow_under").each { |path| allow_exec_under(string(path, "exec.allow_under")) }
       array(data, "deny").each { |path| deny_exec(string(path, "exec.deny")) }
       deny_exec_elsewhere! if default == "deny"
     end

data/lib/straycall/handlers/filesystem.rb

@@ -38,6 +38,28 @@ module Straycall
         record_violation(request, {type: "file", path: "?"}, nil)
       end
 
+      def handle_fd_mutation(request, fd)
+        path = File.readlink("/proc/#{request.tid}/fd/#{fd}").delete_suffix(" (deleted)")
+        return request.continue! unless path.start_with?(File::SEPARATOR)
+
+        target = {type: "file", path:, operation: request.syscall.to_s}
+        if !@config.filesystem.allowed_write?(path) || @config.on_violation == :record
+          record_violation(request, target, %(allow_write_under #{File.dirname(path).inspect}))
+        else
+          request.continue!(unsafe: true)
+        end
+      rescue SystemCallError
+        record_violation(request, {type: "file", path: "?", operation: request.syscall.to_s}, nil)
+      end
+
+      def handle_mmap(request)
+        prot = request.args[2]
+        shared = (request.args[3] & 1).positive?
+        return request.continue! unless shared && (prot & 2).positive?
+
+        handle_fd_mutation(request, request.args[4])
+      end
+
       private
 
       def handle_open(request, dirfd, path_address, flags)
@@ -45,7 +67,7 @@ module Straycall
         filesystem = @config.filesystem
         write = filesystem.write?(flags)
         denied = write ? !filesystem.allowed_write?(path) : filesystem.denied_read?(path)
-        target = {type: "file", path:, flags:}
+        target = {type: "file", path:, flags:, operation: write ? "write" : "read"}
         if denied || (@config.on_violation == :record && write)
           suggestion = write ? %(allow_write_under #{File.dirname(path).inspect}) : nil
           record_violation(request, target, suggestion)

data/lib/straycall/in_process.rb

@@ -9,6 +9,7 @@ module Straycall
     module_function
 
     def install(config, report_socket:, inherited_report_socket:)
+      warn "straycall: existing threads cannot be covered by an in-process seccomp filter" if Dir.children("/proc/self/task").length > 1
       transfer_socket, supervisor_socket = UNIXSocket.pair
       health_reader, health_writer = IO.pipe
       policy = Policy.seccomp(config)
@@ -18,7 +19,7 @@ module Straycall
 
       [supervisor_socket, report_socket, health_writer].each { |io| io.close_on_exec = false }
       inherited_report_socket.close_on_exec = true
-      transfer_socket.close_on_exec = true
+      transfer_socket.close_on_exec = false
       encoded_config = Marshal.dump(config).unpack1("H*")
       clean_environment = ENV.keys.grep(/\A(?:BUNDLE|BUNDLER|RUBY(?:OPT|LIB))/).to_h { |name| [name, nil] }
       load_path = [File.expand_path("..", __dir__), File.join(Gem.loaded_specs.fetch("seccomp-notify").full_gem_path, "lib")].join(File::PATH_SEPARATOR)
@@ -53,7 +54,7 @@ module Straycall
       listener = Seccomp::Notify::Filter.install!(program, flags:)
       Seccomp::Notify::FdPassing.send_fd(transfer_socket, listener)
       listener.close
-      transfer_socket.close
+      @transfer_socket = transfer_socket
       unless IO.select([health_reader], nil, nil, 5) && health_reader.read(1) == "S"
         raise Error, "straycall supervisor failed to initialize"
       end

data/lib/straycall/minitest.rb

@@ -17,7 +17,15 @@ module Straycall
     module_function
 
     def install
-      return unless Straycall.available?
+      if RUBY_PLATFORM.include?("linux") && RUBY_ENGINE == "ruby"
+        require "seccomp/notify"
+        require_relative "target"
+        return configure_hooks if Seccomp::Notify.supervisor_alive?
+      end
+      unless Straycall.available?
+        Straycall.warn_unavailable!
+        return
+      end
 
       require "seccomp/notify"
       require_relative "in_process"
@@ -25,6 +33,10 @@ module Straycall
       supervisor_socket, target_socket = UNIXSocket.pair
       InProcess.install(Straycall.config, report_socket: supervisor_socket, inherited_report_socket: target_socket)
       Target.start(target_socket)
+      configure_hooks
+    end
+
+    def configure_hooks
       ::Minitest::Test.prepend(Hooks)
       ::Minitest.after_run do
         begin

data/lib/straycall/policy/exec.rb

@@ -6,21 +6,27 @@ module Straycall
       def initialize
         @default = :allow
         @allowed = []
+        @allowed_roots = []
         @denied = []
       end
 
       def allow(path)
         validate_path!(path)
-        @allowed << File.expand_path(path)
+        @allowed << normalize(path)
       end
 
       def deny_elsewhere!
         @default = :deny
       end
 
+      def allow_under(path)
+        validate_path!(path)
+        @allowed_roots << normalize(path)
+      end
+
       def deny(path)
         validate_path!(path)
-        @denied << File.expand_path(path)
+        @denied << normalize(path)
       end
 
       def active?
@@ -28,8 +34,8 @@ module Straycall
       end
 
       def allowed?(path)
-        path = File.expand_path(path)
-        @default == :allow ? !@denied.include?(path) : @allowed.include?(path)
+        path = normalize(path)
+        @default == :allow ? !@denied.include?(path) : @allowed.include?(path) || @allowed_roots.any? { |root| under?(path, root) }
       end
 
       private
@@ -39,6 +45,16 @@ module Straycall
 
         raise ConfigurationError, "executable paths must be non-empty strings without NUL bytes"
       end
+
+      def normalize(path)
+        File.realpath(path)
+      rescue SystemCallError
+        File.expand_path(path)
+      end
+
+      def under?(path, root)
+        path == root || path.start_with?("#{root}#{File::SEPARATOR}")
+      end
     end
   end
 end

data/lib/straycall/policy/filesystem.rb

@@ -63,7 +63,7 @@ module Straycall
           File.readlink("/proc/#{tid}/cwd")
         else
           File.readlink("/proc/#{tid}/fd/#{signed(dirfd)}")
-        end
+        end.delete_suffix(" (deleted)")
         File.expand_path(path, base)
       rescue SystemCallError => error
         raise PathResolutionError, "cannot resolve target path through /proc: #{error.message}"

data/lib/straycall/policy/network.rb

@@ -12,6 +12,8 @@ module Straycall
         @default = :deny
         @inet = []
         @unix = []
+        @domains = []
+        @allow_unbound_listen = false
       end
 
       def deny!
@@ -47,17 +49,43 @@ module Straycall
         raise ConfigurationError, "cannot resolve host #{host.inspect}: #{error.message}"
       end
 
+      def allow_domain(domain)
+        raise ConfigurationError, "socket domains must be non-negative integers" unless domain.is_a?(Integer) && domain >= 0
+
+        @domains << domain
+      end
+
+      def allow_unbound_listen!
+        @allow_unbound_listen = true
+      end
+
+      def allowed_domain?(domain)
+        @default == :allow || @domains.include?(domain)
+      end
+
+      def unbound_listen_allowed?
+        @default == :allow || @allow_unbound_listen
+      end
+
       def allowed?(address)
         return true if @default == :allow
-        return @unix.any? { |prefix| address.unix_path.start_with?(prefix) } if address.unix?
+        if address.unix?
+          path = address.unix_path
+          return @unix.any? { |prefix| path == prefix || path.start_with?(File.join(prefix, "")) }
+        end
         return false unless address.ip?
 
         ip = IPAddr.new(address.ip_address.split("%", 2).first)
+        ip = ip.native if ip.ipv4_mapped?
         @inet.any? do |rule|
           rule.address.include?(ip) && (rule.ports.nil? || rule.ports.any? { |port| port === address.ip_port })
         end
       end
 
+      def endpoint?(address)
+        address.unix? || address.ip?
+      end
+
       def allow_all?
         @default == :allow
       end
@@ -71,7 +99,8 @@ module Straycall
       def normalize_ports(ports)
         return if ports.nil?
 
-        Array(ports).each do |port|
+        ports = [ports] unless ports.is_a?(Array)
+        ports.each do |port|
           next if port.is_a?(Range) && port.begin.is_a?(Integer) && port.end.is_a?(Integer) && port.begin.between?(1, port.end) && port.end <= 65_535
           next if port.is_a?(Integer) && (1..65_535).cover?(port)
 

data/lib/straycall/policy.rb

@@ -2,31 +2,36 @@
 
 module Straycall
   module Policy
-    FORBIDDEN_NOTIFY = %i[read write recvfrom ppoll poll select futex clock_nanosleep rt_sigreturn].freeze
-
     module_function
 
-    FILESYSTEM_NOTIFY = %i[openat openat2 unlinkat renameat renameat2 mkdirat].freeze
-    LEGACY_FILESYSTEM_NOTIFY = %i[open creat unlink rename mkdir].freeze
+    NETWORK_NOTIFY = %i[socket connect bind listen sendto sendmsg sendmmsg].freeze
+    FILESYSTEM_NOTIFY = %i[
+      openat openat2 unlinkat renameat renameat2 mkdirat linkat symlinkat
+      truncate ftruncate fchmod fchmodat fchmodat2 fchown fchownat utimensat copy_file_range mmap
+    ].freeze
+    LEGACY_FILESYSTEM_NOTIFY = %i[
+      open creat unlink rename mkdir rmdir link symlink chmod chown lchown
+    ].freeze
     EXEC_NOTIFY = %i[execve execveat].freeze
 
     def seccomp(config)
       notified = notification_names(config)
-      validate_notified!(*notified)
 
       conditional = []
       conditional << :openat if notified.include?(:openat) && !config.filesystem.read_denials?
       conditional << :open if notified.include?(:open) && !config.filesystem.read_denials?
+      conditional << :mmap if notified.include?(:mmap)
       Seccomp::Notify::Policy.new(deny_io_uring: !config.io_uring_allowed?) do
         notify(*(notified - conditional))
         notify_if(:openat, argument: 2, mask: Policy::Filesystem::WRITE_FLAGS) if conditional.include?(:openat)
         notify_if(:open, argument: 1, mask: Policy::Filesystem::WRITE_FLAGS) if conditional.include?(:open)
+        notify_if(:mmap, argument: 3, mask: 1) if conditional.include?(:mmap)
         deny :ptrace
       end
     end
 
     def notification_names(config)
-      names = %i[socket connect bind listen sendto sendmsg sendmmsg]
+      names = config.network.allow_all? && config.on_violation != :record ? [] : NETWORK_NOTIFY.dup
       if config.filesystem.active? || config.on_violation == :record
         names.concat(FILESYSTEM_NOTIFY)
         names.concat(LEGACY_FILESYSTEM_NOTIFY) if RUBY_PLATFORM.include?("linux") && RUBY_PLATFORM.include?("x86_64")
@@ -35,11 +40,5 @@ module Straycall
       names
     end
 
-    def validate_notified!(*names)
-      invalid = names.map(&:to_sym) & FORBIDDEN_NOTIFY
-      raise ConfigurationError, "cannot notify reporter syscall(s): #{invalid.join(", ")}" unless invalid.empty?
-
-      true
-    end
   end
 end

data/lib/straycall/recorder.rb

@@ -5,8 +5,9 @@ require "fileutils"
 
 module Straycall
   class Recorder
-    def initialize(path = ".straycall.yml")
+    def initialize(path = ".straycall.recorded.yml", force: false)
       @path = path
+      @force = force
     end
 
     def write(violations)
@@ -18,21 +19,30 @@ module Straycall
         end
       end.uniq
       unix = violations.filter_map { |item| item.target[:path] if item.target[:type] == "unix" && item.target[:path] != "?" }.uniq
+      domains = violations.filter_map { |item| item.target[:domain] if item.target[:type] == "socket" && item.target[:domain] }.uniq
+      unbound_listen = violations.any? { |item| item.target[:type] == "socket" && item.target[:operation] == "listen" }
       writes = violations.filter_map do |item|
-        File.dirname(item.target[:path]) if item.target[:type] == "file" && item.target[:path] != "?"
+        item.target[:path] if item.target[:type] == "file" && item.target[:path] != "?" && item.target[:operation] != "read"
       end.uniq
       executables = violations.filter_map do |item|
         item.target[:path] if item.target[:type] == "exec" && item.target[:path] != "?"
       end.uniq
       policy = {
-        "network" => {"default" => "deny", "allow" => network + unix.map { |path| {"unix" => path} }},
+        "network" => {
+          "default" => "deny",
+          "allow" => network + unix.map { |path| {"unix" => path} } + domains.map { |domain| {"domain" => domain} },
+          "allow_unbound_listen" => unbound_listen
+        },
         "write" => {"default" => "deny", "allow" => writes},
         "exec" => {"default" => "deny", "allow" => executables},
         "on_violation" => "fail"
       }
       FileUtils.mkdir_p(File.dirname(@path))
-      File.write(@path, YAML.dump(policy))
+      flags = File::WRONLY | File::CREAT | (@force ? File::TRUNC : File::EXCL)
+      File.open(@path, flags, 0o644) { |file| file.write(YAML.dump(policy)) }
       @path
+    rescue Errno::EEXIST
+      raise ConfigurationError, "refusing to overwrite #{@path}; pass --force to replace it"
     end
   end
 end

data/lib/straycall/rspec.rb

@@ -8,7 +8,15 @@ module Straycall
     module_function
 
     def install
-      return unless Straycall.available?
+      if RUBY_PLATFORM.include?("linux") && RUBY_ENGINE == "ruby"
+        require "seccomp/notify"
+        require_relative "target"
+        return configure_hooks if Seccomp::Notify.supervisor_alive?
+      end
+      unless Straycall.available?
+        Straycall.warn_unavailable!
+        return
+      end
 
       require "seccomp/notify"
       require_relative "in_process"

data/lib/straycall/supervisor.rb

@@ -8,6 +8,7 @@ require_relative "reporter/symbolizer"
 require_relative "prompt"
 require_relative "handlers/filesystem"
 require_relative "handlers/exec"
+require "shellwords"
 
 module Straycall
   class Supervisor
@@ -15,8 +16,10 @@ module Straycall
     include Handlers::Exec
 
     ENDPOINT_SOCKET_DOMAINS = [Socket::AF_UNIX, Socket::AF_INET, Socket::AF_INET6].freeze
+    LOCAL_SOCKET_DOMAINS = Socket.const_defined?(:AF_NETLINK, false) ? [Socket.const_get(:AF_NETLINK, false)].freeze : [].freeze
     MMSGHDR_SIZE = 64
     MAX_MMSG = 1024
+    REPORT_INTERVAL = 0.1
 
     attr_reader :violations
 
@@ -40,14 +43,15 @@ module Straycall
         reporter = File.expand_path("target", __dir__)
         inherited_rubyopt = environment.key?("RUBYOPT") ? environment["RUBYOPT"] : ENV["RUBYOPT"]
         environment["STRAYCALL_REPORT_FD"] = target_socket.fileno.to_s
-        environment["RUBYOPT"] = ["-r#{reporter}", inherited_rubyopt].compact.join(" ")
+        environment["STRAYCALL_REPORT_PID"] = Process.pid.to_s
+        environment["RUBYOPT"] = [Shellwords.escape("-r#{reporter}"), inherited_rubyopt].compact.join(" ")
         exec(environment, *argv)
       end
       target_socket.close
       @reporter = Reporter::Client.new(supervisor_socket)
       register(supervisor)
       status = supervisor.run
-      write_report
+      flush_report
       [status, violations]
     ensure
       target_socket&.close unless target_socket&.closed?
@@ -63,13 +67,23 @@ module Straycall
       supervisor.on(:sendmsg) { |request| handle_sendmsg(request) }
       supervisor.on(:sendmmsg) { |request| handle_sendmmsg(request) }
       names = Policy.notification_names(@config)
+      cwd = Policy::Filesystem::AT_FDCWD
       supervisor.on(:openat) { |request| handle_openat(request) } if names.include?(:openat)
       supervisor.on(:openat2) { |request| handle_openat2(request) } if names.include?(:openat2)
       supervisor.on(:unlinkat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:unlinkat)
       supervisor.on(:mkdirat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:mkdirat)
+      supervisor.on(:symlinkat) { |request| handle_path_mutation(request, request.args[1], request.args[2]) } if names.include?(:symlinkat)
       supervisor.on(:renameat) { |request| handle_rename(request, *request.args.values_at(0, 1, 2, 3)) } if names.include?(:renameat)
       supervisor.on(:renameat2) { |request| handle_rename(request, *request.args.values_at(0, 1, 2, 3)) } if names.include?(:renameat2)
-      cwd = Policy::Filesystem::AT_FDCWD
+      supervisor.on(:linkat) { |request| handle_rename(request, *request.args.values_at(0, 1, 2, 3)) } if names.include?(:linkat)
+      supervisor.on(:truncate) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(:truncate)
+      supervisor.on(:ftruncate) { |request| handle_fd_mutation(request, request.args[0]) } if names.include?(:ftruncate)
+      supervisor.on(:fchmodat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:fchmodat)
+      supervisor.on(:fchmodat2) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:fchmodat2)
+      supervisor.on(:fchownat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:fchownat)
+      supervisor.on(:utimensat) { |request| handle_path_mutation(request, request.args[0], request.args[1]) } if names.include?(:utimensat)
+      supervisor.on(:copy_file_range) { |request| handle_fd_mutation(request, request.args[2]) } if names.include?(:copy_file_range)
+      supervisor.on(:mmap) { |request| handle_mmap(request) } if names.include?(:mmap)
       supervisor.on(:open) { |request| handle_open(request, cwd, request.args[0], request.args[1]) } if names.include?(:open)
       if names.include?(:creat)
         supervisor.on(:creat) do |request|
@@ -79,17 +93,32 @@ module Straycall
       end
       supervisor.on(:unlink) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(:unlink)
       supervisor.on(:mkdir) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(:mkdir)
+      supervisor.on(:rmdir) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(:rmdir)
+      supervisor.on(:symlink) { |request| handle_path_mutation(request, cwd, request.args[1]) } if names.include?(:symlink)
+      %i[chmod chown lchown].each do |name|
+        supervisor.on(name) { |request| handle_path_mutation(request, cwd, request.args[0]) } if names.include?(name)
+      end
+      %i[fchmod fchown].each do |name|
+        supervisor.on(name) { |request| handle_fd_mutation(request, request.args[0]) } if names.include?(name)
+      end
       supervisor.on(:rename) { |request| handle_rename(request, cwd, request.args[0], cwd, request.args[1]) } if names.include?(:rename)
+      supervisor.on(:link) { |request| handle_rename(request, cwd, request.args[0], cwd, request.args[1]) } if names.include?(:link)
       supervisor.on(:execve) { |request| handle_exec(request, nil, 0) } if names.include?(:execve)
       supervisor.on(:execveat) { |request| handle_exec(request, 0, 1) } if names.include?(:execveat)
       supervisor
     end
 
+    def flush_report
+      write_report(force: true)
+    end
+
     private
 
     def handle_socket(request)
       domain = request.args[0]
-      return request.continue! if @config.network.allow_all? || ENDPOINT_SOCKET_DOMAINS.include?(domain)
+      allowed = ENDPOINT_SOCKET_DOMAINS.include?(domain) || LOCAL_SOCKET_DOMAINS.include?(domain)
+      allowed ||= @config.network.allowed_domain?(domain) && @config.on_violation != :record
+      return request.continue! if allowed
 
       record_violation(request, {type: "socket", domain:, operation: "socket"}, nil)
     end
@@ -99,6 +128,7 @@ module Straycall
 
       address = request.read_sockaddr(request.args[1], request.args[2])
       return request.error!(Errno::EPERM) unless request.valid?
+      return request.continue!(unsafe: true) unless @config.network.endpoint?(address)
       if @config.network.allowed?(address) && @config.on_violation != :record
         remember_bound_socket(request, address)
         return request.continue!(unsafe: true)
@@ -111,10 +141,11 @@ module Straycall
     end
 
     def handle_listen(request)
-      return request.continue! if @config.network.allow_all?
+      return request.continue! if @config.network.allow_all? && @config.on_violation != :record
 
       identity = socket_identity(request.tid, request.args[0])
       address = @mutex.synchronize { @bound_sockets[identity] }
+      return request.continue! if !address && @config.network.unbound_listen_allowed? && @config.on_violation != :record
       if address && @config.network.allowed?(address) && @config.on_violation != :record
         return request.continue!
       end
@@ -134,6 +165,7 @@ module Straycall
 
       address = request.read_sockaddr(request.args[address_arg], request.args[length_arg])
       return request.error!(Errno::EPERM) unless request.valid?
+      return request.continue!(unsafe: true) unless @config.network.endpoint?(address)
       if @config.network.allowed?(address) && @config.on_violation != :record
         return request.continue!(unsafe: true)
       end
@@ -151,6 +183,7 @@ module Straycall
 
       address = request.read_sockaddr(name, length)
       return request.error!(Errno::EPERM) unless request.valid?
+      return request.continue!(unsafe: true) unless @config.network.endpoint?(address)
       if @config.network.allowed?(address) && @config.on_violation != :record
         return request.continue!(unsafe: true)
       end
@@ -171,6 +204,7 @@ module Straycall
         request.read_sockaddr(name, length) unless name.zero? || length.zero?
       end
       return request.error!(Errno::EPERM) unless request.valid?
+      destinations.select! { |address| @config.network.endpoint?(address) }
       observed = if @config.on_violation == :record
         destinations
       else
@@ -219,8 +253,14 @@ module Straycall
       %(allow_host #{address.ip_address.inspect}, ports: [#{address.ip_port}])
     end
 
-    def write_report
-      Report::JSON.new(@config.report_path).write(violations) if @config.report_path
+    def write_report(force: false)
+      return unless @config.report_path
+
+      now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      return if !force && @last_report_at && now - @last_report_at < REPORT_INTERVAL
+
+      Report::JSON.new(@config.report_path).write(violations)
+      @last_report_at = now
     end
 
     def report_target(target)

data/lib/straycall/target.rb

@@ -25,7 +25,19 @@ module Straycall
       @reporter&.stop
       @reporter = nil
     end
+
+    def start_from_environment
+      return unless ENV["STRAYCALL_REPORT_FD"]
+      if ENV["STRAYCALL_REPORT_PID"] && Integer(ENV["STRAYCALL_REPORT_PID"]) != Process.pid
+        IO.for_fd(Integer(ENV["STRAYCALL_REPORT_FD"]), autoclose: true).close
+        return
+      end
+
+      start
+    rescue ArgumentError, SystemCallError
+      nil
+    end
   end
 end
 
-Straycall::Target.start if ENV["STRAYCALL_REPORT_FD"]
+Straycall::Target.start_from_environment

data/lib/straycall/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Straycall
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/straycall.rb

@@ -34,6 +34,14 @@ module Straycall
 
     def reset!
       @config = Config.new
+      @warned_unavailable = false
+    end
+
+    def warn_unavailable!
+      return if ENV["STRAYCALL"] == "0" || !RUBY_PLATFORM.include?("linux") || @warned_unavailable
+
+      @warned_unavailable = true
+      warn "straycall: seccomp user notifications are unavailable; running unmonitored"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: straycall
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Yudai Takada
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.2'
+        version: '0.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.2'
+        version: '0.3'
 description: A Linux seccomp-notify sandbox that reports network, filesystem, and
   process violations.
 email: