diff options
| author | Alice Frosi <afrosi@redhat.com> | 2023-03-31 14:15:24 +0200 |
|---|---|---|
| committer | Alice Frosi <afrosi@redhat.com> | 2023-03-31 14:22:23 +0200 |
| commit | b7350faf8e466184ac665730306c99f6612eb5fd (patch) | |
| tree | e3a8db62dde641e33a1a0ee05025c333d24466b5 | |
| parent | aeb7573732347cd0bbf0e3d7e560a53f875313cf (diff) | |
| download | seitan-b7350faf8e466184ac665730306c99f6612eb5fd.tar seitan-b7350faf8e466184ac665730306c99f6612eb5fd.tar.gz seitan-b7350faf8e466184ac665730306c99f6612eb5fd.tar.bz2 seitan-b7350faf8e466184ac665730306c99f6612eb5fd.tar.lz seitan-b7350faf8e466184ac665730306c99f6612eb5fd.tar.xz seitan-b7350faf8e466184ac665730306c99f6612eb5fd.tar.zst seitan-b7350faf8e466184ac665730306c99f6612eb5fd.zip | |
filter: load argument to check
| -rw-r--r-- | cooker/filter.c | 10 | ||||
| -rw-r--r-- | cooker/filter.h | 1 |
2 files changed, 10 insertions, 1 deletions
diff --git a/cooker/filter.c b/cooker/filter.c index 3f23c1f..717e525 100644 --- a/cooker/filter.c +++ b/cooker/filter.c @@ -184,9 +184,13 @@ static unsigned int get_total_args_instr(const struct syscall_entry table[], for (i = 0; i < t->count; i++) { entry = t->entry + i; n = 0; + /* For every argument there are 2 instructions, one to + * load the value and the second to evaluate the + * argument + */ for (k = 0; k < 6; k++) { if (entry->check_arg[k]) - n++; + n += 2; } total_instr += n; /* If there is at least an arguments then there is an additional @@ -287,6 +291,10 @@ unsigned int create_bfp_program(struct syscall_entry table[], next_args_off = get_n_args_syscall_entry(entry); for (k = 0; k < 6; k++) if (entry->check_arg[k]) { + filter[size++] = (struct sock_filter) + LOAD((offsetof( + struct seccomp_data, + args[k]))); filter[size++] = (struct sock_filter)EQ( (table[i].entry + j)->args[k], 0, next_args_off - n_checks); diff --git a/cooker/filter.h b/cooker/filter.h index ee5ab12..c8e74be 100644 --- a/cooker/filter.h +++ b/cooker/filter.h @@ -9,6 +9,7 @@ BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, (nr), (right), (left)) #define JUMPA(jump) BPF_JUMP(BPF_JMP | BPF_JA, (jump), 0, 0) #define EQ(nr, a1, a2) BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, (nr), (a1), (a2)) +#define LOAD(x) BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (x)) #define MAX_FILTER 1024 |