diff options
author | Alice Frosi <afrosi@redhat.com> | 2023-03-24 10:07:48 +0100 |
---|---|---|
committer | Alice Frosi <afrosi@redhat.com> | 2023-03-24 15:38:07 +0100 |
commit | 069009f8e39238ec1a67fba6cfb287b9a0cac83e (patch) | |
tree | 77f817eb7b96178b71f3d573a83cec19f7fba09c /src/cooker/example.hjson | |
parent | 06b0f6d323c396ca1df000af96fdd07cc69b06e0 (diff) | |
download | seitan-069009f8e39238ec1a67fba6cfb287b9a0cac83e.tar seitan-069009f8e39238ec1a67fba6cfb287b9a0cac83e.tar.gz seitan-069009f8e39238ec1a67fba6cfb287b9a0cac83e.tar.bz2 seitan-069009f8e39238ec1a67fba6cfb287b9a0cac83e.tar.lz seitan-069009f8e39238ec1a67fba6cfb287b9a0cac83e.tar.xz seitan-069009f8e39238ec1a67fba6cfb287b9a0cac83e.tar.zst seitan-069009f8e39238ec1a67fba6cfb287b9a0cac83e.zip |
Re-organize project and add license header
Diffstat (limited to 'src/cooker/example.hjson')
-rw-r--r-- | src/cooker/example.hjson | 67 |
1 files changed, 67 insertions, 0 deletions
diff --git a/src/cooker/example.hjson b/src/cooker/example.hjson new file mode 100644 index 0000000..45ed339 --- /dev/null +++ b/src/cooker/example.hjson @@ -0,0 +1,67 @@ +[ + { + "match": [ /* qemu-pr-helper and similar */ + { "connect": { "addr": { "family": "unix", "path": "/var/run/pr-helper.sock" }, "fd": { "ref": "fd" } } } + ], + "call": { "connect": { "addr": { "family": "unix", "path": "/var/run/pr-helper.sock" }, "ret": "y" } }, + "inject": { "what": "fd", "new": { "ref": "y" }, "old": { "ref": "fd" }, "return": 0 } + }, + { + "match": [ /* qemu creates a tap interface */ + { "ioctl": { "path": "/dev/net/tun", "request": "TUNSETIFF", "ifr": { "name": "tap0", "flags": "IFF_TUN" } } } + ], + "limit": { "scope": "process", "count": 1 }, + "call": { "ioctl": { "request": "TUNSETIFF", "path": "/dev/net/tun", "ifr": { "name": "tap0", "flags": "IFF_TUN", "ret": "x" } } }, + "return": { "ref": "x" } + }, + { + "match": [ /* CVE-2022-0185-style */ + { "unshare": { "flags": { "has": { "newuser": true, "newnet": false } } } } + ], + "block": { } + }, + { + "match": [ /* passt */ + { "unshare": { "flags": { "has": [ "ipc", "mount", "uts", "pid" ] } } } + ], + "block": { } + }, + { + "match": [ /* Giuseppe's example */ + { "mknod": { "path": { "ref": "path" }, "mode": "c", "major": 1, "minor": { "in": [ 3, 5, 7, 8, 9 ], "ref": "minor" } } } + ], + "context": { "userns": "init", "mountns": "caller" }, + "call": { "mknod": { "path": { "ref": "path" }, "mode": "c", "major": 1, "minor": { "ref": "minor" }, "ret": "x" } }, + "inject": { "what": "fd", "new": { "ref": "x" } }, + "return": { "ref": "x" } + } +] + +/* + * INTFLAGS, LONGFLAGS, U32FLAGS + * + * "field": { "in": [ "ipc", "mount", "uts" ] } + * flags & set + * !!(flags & (ipc | mount | ns)) + * + * "field": { "all": [ "ipc", "mount", "uts" ] } + * flags & set == set + * flags & (ipc | mount | ns) == (ipc | mount | ns) + * + * "field": { "not": [ "ipc", "mount", "uts" ] } + * !(flags & set) + * + * "field": { "ipc": false, "mount": true, "uts": false } + * flags & set == set + * !(flags & ipc) && (flags & mount) && !(flags & utc) + * + * "field": { "ipc" } + * flags == ipc + * + * INTMASK + * value = (target value & known values) + * + * INT, LONG, U32 + * "arg": { "in": [ 0, 1 ] } + * arg == 0 || arg == 1 + */ |