aboutgitcodelistschat:MatrixIRC
Commit message (Collapse)AuthorAgeFilesLines
* cooker: Pass arguments to filterStefano Brivio2023-06-097-11/+76
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* demo: with mknod and podmanAlice Frosi2023-06-094-105/+160
| | | | | | Splited common functions in web/common.sh and created new script for mknod demo. The demo uses the mount namespace of the caller. Additionally, this removes extra commented lines in demo/mknod.hjson.
* seitan,cooker: add wd to change work directory and mknodAlice Frosi2023-06-099-102/+132
| | | | | | | | | | | | | | | | | ./seitan-cooker demo/mknod.hjson demo/mknod.gluten demo/mknod.bpf Start seitan with the socket option: ./seitan -s /tmp/seitan.sock -i demo/mknod.gluten Start the container: sudo rm -f /dev/lol sudo chown $USER:$USER /tmp/seitan.sock podman run -ti --runtime /usr/bin/crun \ --security-opt label=disable \ -v $(pwd)/test:/test \ --annotation run.oci.seccomp_bpf_data="$(base64 -w0 demo/mknod.bpf)" \ --annotation run.oci.seccomp.receiver=/tmp/seitan.sock fedora \ sh -c 'mknod /dev/lol c 1 7 && ls -l /dev/lol'
* cooker: Full support for flags and masks, assorted fixesStefano Brivio2023-06-0812-52/+193
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* mknod/mknodat values, initial support for MASK flag, OP_BITWISEStefano Brivio2023-06-0711-87/+225
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* seitan, cooker: refactor op_returnAlice Frosi2023-06-078-89/+76
| | | | | | | Refactor OP_RETURN: - merged OP_BLOCK and OP_CONT into OP_RETURN - add desc field for op_return - updated the demo files
* seitan,cooker: op_resolvefdAlice Frosi2023-06-078-18/+88
| | | | | | | | | ops: - update resolvefd with the description - add debug prints cooker: - add emit_resolvefd when match has type FDPATH
* web: generating connect demo with asciinemaAlice Frosi2023-06-071-0/+189
|
* seitan, main: Più umano più vero (more human more true)Stefano Brivio2023-06-071-20/+25
| | | | | | ...and terminate on EPOLLHUP. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* demo: Add mknod.hjsonStefano Brivio2023-06-061-0/+42
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* cooker: Draft quality: mknod/mknodat, sets of values with "in"Stefano Brivio2023-06-0612-42/+293
| | | | | | | | While at it: - directly assign 'fd' in eater from install_filter() - turn op_cmp into a description-style thing Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* seitan-run: Drop -x, refine cleanupStefano Brivio2023-06-051-2/+3
| | | | | | If DIR already exists, just remove our entries. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* seitan-run: restore old behaviorAlice Frosi2023-06-051-2/+1
| | | | Clean-up the entire DIR.
* seitan: add debug message for op_load/op_cmpAlice Frosi2023-06-051-4/+9
|
* cooker: use unsigned short for family with connectAlice Frosi2023-06-056-3/+9
|
* cooker: missing size set for op_loadAlice Frosi2023-06-051-0/+1
|
* seitan: fix jmp in op_nrAlice Frosi2023-06-051-6/+2
|
* seitan: use jmp.offset as absolute valueAlice Frosi2023-06-051-4/+2
|
* seitan: operationsAlice Frosi2023-06-052-23/+28
| | | | | | | | Added: - fix offset for jumping to the next block (use absolute jump and not relative. - fix op_cmp, jump if the comparison is true. - added a couple of debug print
* demo: extend demo with additional matchesAlice Frosi2023-06-052-2/+15
| | | | | Add matches for injecting error and faking the connect syscall. Fix seitan-run clean-up: delete only *.bpf and *.gluten files
* cooker: add emit_endAlice Frosi2023-06-053-1/+18
|
* cooker: Generic attributes and ATTR_SIZEStefano Brivio2023-06-048-31/+89
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* demo: Start with a connect() exampleStefano Brivio2023-06-042-0/+15
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* treewide: Change to GPLv2, add LICENSES, missing headersStefano Brivio2023-06-0465-204/+418
| | | | | | As discussed with Alice -- 'reuse lint' passes now. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* seitan-run: Assorted cleanupsStefano Brivio2023-06-031-14/+18
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* Introduce seitan-runStefano Brivio2023-06-021-0/+37
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* seitan: Minor header cleanupStefano Brivio2023-06-021-2/+3
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* cooker: json_object_get_boolean() can return true for missing keyStefano Brivio2023-06-021-2/+2
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* gluten: What's const is constStefano Brivio2023-06-022-2/+2
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* seitan: whoopsStefano Brivio2023-06-022-8/+5
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* cooker, seitan: OP_FDStefano Brivio2023-06-027-37/+107
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* cooker, seitan: fix some bugs for op callAlice Frosi2023-06-024-21/+34
| | | | | | | | | | | | | | cooker: - added missing OP_CALL type - local copy of the offset for the type STRUCT - fix return offset - added type LONG in emit_data seitan: - check context if NULL - fix ptr dereference - added a couple of debug print - added error message in seitan for eval
* cooker, seitan: OP_CALL arguments and contextStefano Brivio2023-06-0210-198/+314
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* cooker: OP_CALL and OP_COPY stuffStefano Brivio2023-06-0119-357/+1025
| | | | | | ...mostly. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* ops: adjust op_callAlice Frosi2023-06-014-55/+102
|
* filter: fix filter build and adjust testsAlice Frosi2023-05-222-282/+261
| | | | | | | Changes: - fix initialization of size - addedfew comments - finish to fix the test_filter_build tests
* filter: adjust filter buildAlice Frosi2023-05-196-320/+327
| | | | | | | Add filter_flush_args() to flush the arguments when finish to add the syscall arguments. Fixed test compilation after refactoring.
* test: fix compilation and adjust changesAlice Frosi2023-05-192-24/+31
|
* ops: fix op_cmp and testAlice Frosi2023-05-192-93/+72
|
* ops: fix op_call and testsAlice Frosi2023-05-197-151/+234
|
* cooker, seitan: simple working exampleAlice Frosi2023-05-176-7/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | parser: - add OP_BLOCK and OP_RETURN to the parser seitan: - fix op_cmp in seitan, it was jmp when comparison was true Working example: demo.json: [ { "match": [ /* qemu-pr-helper and similar */ { "connect": { "addr": { "family": "unix", "path": "/tmp/test.sock" } } } ], "return": 0 } ] Create gluten and the bpf filter: $ seitan-cooker demo.hjson demo.gluten demo.bpf Launch the seitan eater with the target program: $ seitan-eater -i demo.bpf -- strace -e connect tests-utils/test-syscalls connect Start seitan with gluten: $ seitan -i demo.gluten -p $(pgrep seitan-eater) Seitan mocks the connect syscall and `connect` returns successfully: $ seitan-eater -i demo.bpf -- strace -e connect tests-utils/test-syscalls connect Test syscall: connect connect(4, {sa_family=AF_UNIX, sun_path="/tmp/test.sock"}, 108) = 0
* Minor fixes for the filter and the eaterAlice Frosi2023-05-174-6/+14
| | | | | | Add: - ignore_args field for the filter. - use MAX_FILTER to define the filter size in the eater
* ops: add op_nr and op_copyAlice Frosi2023-05-174-13/+112
| | | | | | | Add: - missing implementation for op_nr - op_copy to copy data - tests for op_nr and op_data
* filter: refactoring filterAlice Frosi2023-05-174-474/+419
| | | | | | | | | | | Attempt to simplify the filter build: - storing all the bpf_args in a common array and saving the index of each entry in filter_input - added new flag to filter_add_arg for append an argument to an entry - split large loop in filter_build in multiple functions - adjust and refactor tests/units/test_filter The tests in test_filter_build.c still need to be fixed
* filter: increment countAlice Frosi2023-05-161-1/+2
|
* cooker, seitan: Now with 100% more glutenStefano Brivio2023-05-1627-520/+1311
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pseudorandom changes and progress around cooker and seitan: - cooker: - rename matching functions, split match.c - fix up SELECT semantics - add some form of handling for all syscalls in the example (some stubs) - OP_CMP for all basic and compound types except for flags - link jumps to next block and next match - completed implementation of tags - gluten write - filter clean-ups, write filters (probably not working) - seitan: - load gluten and source instructions and data from there $ ./seitan-cooker cooker/example.hjson example.gluten example.bpf Parsing block 0 Parsing match 0: connect Found description for connect 0: OP_NR: if syscall number is not 0, jump to next block Parsing match argument fd setting tag reference 'fd' tag 'fd' now refers to seccomp data at 0 Parsing match argument addr allocating 128 at offset 0 1: OP_LOAD: #0 < args[1] (size: 128) C#0: (INT) 1 2: OP_CMP: if temporary data: #0 NE (size: 4) read-only data: #0, jump to next block C#4: (STRING:24) /var/run/pr-helper.sock 3: OP_CMP: if temporary data: #0 NE (size: 24) read-only data: #4, jump to next block Linking match... Linking block... linked jump of instruction #0 to #4 linked jump of instruction #2 to #4 linked jump of instruction #3 to #4 Parsing block 1 Parsing match 0: ioctl Found description for ioctl 4: OP_NR: if syscall number is not 112, jump to next block Parsing match argument path Parsing match argument request C#28: (INT) 1074025674 5: OP_CMP: if seccomp data: #1 NE (size: 4) read-only data: #28, jump to next block Parsing match argument ifr allocating 40 at offset 128 6: OP_LOAD: #128 < args[2] (size: 40) C#32: (STRING:5) tap0 7: OP_CMP: if temporary data: #128 NE (size: 5) read-only data: #32, jump to next block C#37: (INT) 1 8: OP_CMP: if temporary data: #128 NE (size: 4) read-only data: #37, jump to next block Linking match... Linking block... linked jump of instruction #4 to #9 linked jump of instruction #5 to #9 linked jump of instruction #7 to #9 linked jump of instruction #8 to #9 Parsing block 2 Parsing match 0: unshare Found description for unshare 9: OP_NR: if syscall number is not 164, jump to next block Parsing match argument flags Linking match... Linking block... linked jump of instruction #9 to #10 Parsing block 3 Parsing match 0: unshare Found description for unshare 10: OP_NR: if syscall number is not 164, jump to next block Parsing match argument flags Linking match... Linking block... linked jump of instruction #10 to #11 Parsing block 4 Parsing match 0: mknod Found description for mknod 11: OP_NR: if syscall number is not 164, jump to next block Parsing match argument path allocating 1 at offset 168 12: OP_LOAD: #168 < args[0] (size: 1) setting tag reference 'path' tag 'path' now refers to temporary data at 168 Parsing match argument mode Parsing match argument major Parsing match argument minor setting tag reference 'minor' tag 'minor' now refers to seccomp data at 2 Linking match... Linking block... linked jump of instruction #11 to #13 Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* ops: copy call args from glutenAlice Frosi2023-05-151-0/+5
|
* Adjust op_call with gluten_offsetAlice Frosi2023-05-115-70/+92
|
* gluten: remove unused enum value_typeAlice Frosi2023-05-111-5/+0
|
* Add missing license header to tests/unit/test_errors.cAlice Frosi2023-05-111-0/+5
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-05 19:55:31 +0000