seitan/demo, branch master

call, emit, match: Add support for vectorised operations, nfnetlink

2024-08-13T17:00:35+00:00

We want to add and delete rules with iptables(8), and manipulate set
elements with nft(8).

These are the first users we encounter sending multiple netlink
messages in one sendmsg().

To support matching on those, we need to iterate over several
messages, looking for a matching one, or a mismatching one (depending
on quantifiers and match type), but we don't want to implement program
loops because of security design reasons.

We can't implement a generalised instruction that vectorises existing
ones, either, because we need to support universal and existential
quantifiers in fields that are repeated multiple times, once per each
netlink message, with bitwise operations and non-exact matching types.

Add vectorisation support to OP_CMP and OP_BITWISE instead, with a
generic description for a vector (only sequences of netlink messages
with length in nlmsghdr are supported at the moment) so that,
depending on the quantifiers, we'll repeat those operations as many
times as needed. This way, we don't risk any O(n^2) explosion, and we
are bound by O(m * n) instead, with m compare/bitwise operations for
a given expression, and n number of netlink messages.

Add demos for nft and iptables using the new concepts.

Signed-off-by: Stefano Brivio

Add fsetxattr(), fremovexattr(), open_by_handle_at(), and "virtiofsd demo"

2024-05-15T06:49:56+00:00

Mostly assorted fixes, a new FDGET operation (get a copy of the
target file descriptor via pidfd_getfd()) and a new "FD" flag that
means we have to do that on direct tag reference.

Signed-off-by: Stefano Brivio

seitan: Add netlink, sendto()/sendmsg(), iovec handling, demo with routes

2023-12-21T11:45:36+00:00

A bit rough at the moment, but it does the trick. Bonus: setsockopt()
(with magic values only, not used in any demo yet).

Signed-off-by: Stefano Brivio

demo: update connect example with new tag format

2023-09-04T07:18:13+00:00

cooker, seitan: add sched_setscheduler

2023-09-01T08:37:04+00:00

The sched_setscheduler requires to set the pid of the process we want to
change the priority, this adds a new metadata for getting the target pid
at runtime.

Add a couple of syscalls for the scheduler in the string parsing.

Signed-off-by: Alice Frosi

cooker: simplify tag and add caller metadata

2023-08-30T08:48:59+00:00

Group the metadata information:
  - simplify the json by removing the 'tag' and only using 'get' and 'set'
    keys
  - get uid and gid at runtime for the target ('caller'). This can be useful when
    the the UID and GID of the target are only known at runtime and they
    need to be used for setting the permissions of files
  - updated example demo/mknod.hjson

Signed-off-by: Alice Frosi

demo: clean-up leftover files

2023-08-24T13:41:40+00:00

demo: clean-up the directory

2023-08-24T13:36:01+00:00

demo: clean-up

2023-07-04T10:40:49+00:00

Remove all the *.gluten and *.bpf files and added the files to gitignore

cooker, seitan: Add support for GID/UID in context

2023-06-28T15:47:35+00:00

Similarly to namespace specifications, the special value "caller", as
well as login/group names and numeric UID/GIDs are supported.

Example of usage in demo/mknod.hjson. Light on checks and with some
TODOs left behind at the moment.

Signed-off-by: Stefano Brivio