aboutgitcodelistschat:MatrixIRC
Commit message (Collapse)AuthorAgeFilesLines
* call, emit, match: Add support for vectorised operations, nfnetlinkHEADmasterStefano Brivio2024-08-139-90/+832
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We want to add and delete rules with iptables(8), and manipulate set elements with nft(8). These are the first users we encounter sending multiple netlink messages in one sendmsg(). To support matching on those, we need to iterate over several messages, looking for a matching one, or a mismatching one (depending on quantifiers and match type), but we don't want to implement program loops because of security design reasons. We can't implement a generalised instruction that vectorises existing ones, either, because we need to support universal and existential quantifiers in fields that are repeated multiple times, once per each netlink message, with bitwise operations and non-exact matching types. Add vectorisation support to OP_CMP and OP_BITWISE instead, with a generic description for a vector (only sequences of netlink messages with length in nlmsghdr are supported at the moment) so that, depending on the quantifiers, we'll repeat those operations as many times as needed. This way, we don't risk any O(n^2) explosion, and we are bound by O(m * n) instead, with m compare/bitwise operations for a given expression, and n number of netlink messages. Add demos for nft and iptables using the new concepts. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* util: Fix system call name resolution in syscall_name() debug functionStefano Brivio2024-07-021-2/+4
| | | | | | | | | | | | Fix the starting index, otherwise we miss the first call in sets (say, mknod in filesystem calls). And if we don't find a matching name for the system call, actually return it, instead of trying to fetch it from the current (invalid) call. Fixes: bdbec30a8498 ("seitan: Add netlink, sendto()/sendmsg(), iovec handling, demo with routes") Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* Add fsetxattr(), fremovexattr(), open_by_handle_at(), and "virtiofsd demo"Stefano Brivio2024-05-1518-31/+524
| | | | | | | | Mostly assorted fixes, a new FDGET operation (get a copy of the target file descriptor via pidfd_getfd()) and a new "FD" flag that means we have to do that on direct tag reference. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* seitan: Add netlink, sendto()/sendmsg(), iovec handling, demo with routesStefano Brivio2023-12-2116-24/+597
| | | | | | | A bit rough at the moment, but it does the trick. Bonus: setsockopt() (with magic values only, not used in any demo yet). Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* seitan: try to improve print of the arguments to checkAlice Frosi2023-09-081-5/+53
|
* gluten: throw an error if the offset is seccomp but the request is emptyAlice Frosi2023-09-081-1/+3
|
* cooker: set base_offset for structAlice Frosi2023-09-081-0/+2
|
* cooker: Don't mix up JSON objects when checking temporary storage needsStefano Brivio2023-09-051-1/+1
| | | | | | | | ...including the check on whether the given object is a top-level (corresponding to a full argument) metadata tag. Fixes: d3917582873d ("cooker: simplify tag and add caller metadata") Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* cooker/calls: Add support for bind()Stefano Brivio2023-09-041-0/+1
| | | | | | | ...no examples yet, but it's trivial as the prototype is exactly the same as connect(). Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* cooker: fix tag check with the new formatAlice Frosi2023-09-041-7/+31
|
* demo: update connect example with new tag formatAlice Frosi2023-09-041-3/+3
|
* cooker: fix priority name for sched_setschedulerAlice Frosi2023-09-012-6/+9
|
* cooker: fix wrong checkAlice Frosi2023-09-011-5/+8
|
* cooker, seitan: add sched_setschedulerAlice Frosi2023-09-019-19/+122
| | | | | | | | | | The sched_setscheduler requires to set the pid of the process we want to change the priority, this adds a new metadata for getting the target pid at runtime. Add a couple of syscalls for the scheduler in the string parsing. Signed-off-by: Alice Frosi <afrosi@redhat.com>
* cooker: print syscall name instead of numberAlice Frosi2023-09-012-3/+3
|
* seitan: small fixesAlice Frosi2023-08-312-9/+18
| | | | | | Fixes: - return an error message in do_clone instead of exit - check if the type of context is out-of-bound
* cooker: remove debug printAlice Frosi2023-08-301-3/+1
|
* cooker: simplify tag and add caller metadataAlice Frosi2023-08-307-78/+179
| | | | | | | | | | | | Group the metadata information: - simplify the json by removing the 'tag' and only using 'get' and 'set' keys - get uid and gid at runtime for the target ('caller'). This can be useful when the the UID and GID of the target are only known at runtime and they need to be used for setting the permissions of files - updated example demo/mknod.hjson Signed-off-by: Alice Frosi <afrosi@redhat.com>
* common: print syscall name based on the numberAlice Frosi2023-08-302-1/+18
|
* cooker: add chown and lchownAlice Frosi2023-08-252-1/+31
|
* demo: clean-up leftover filesAlice Frosi2023-08-242-1/+0
|
* gitignore: ignore .swp filesAlice Frosi2023-08-241-0/+1
|
* demo: clean-up the directoryAlice Frosi2023-08-249-133/+0
|
* cooker: generate OCI seccomp profileAlice Frosi2023-08-248-21/+560
| | | | | | | | | | | | | | | | | | Generate the OCI seccomp profile instead of directly the BPF filter. The seccomp profile will be used consquently by the container runtime as input in order to generate the BPF filter. Example with mknod: $ seitan-cooker -g /tmp/gluten -p /tmp/scmp_prof.json -s seccomp.json -i demo/mknod.hjson $ seitan -s /tmp/seitan.sock -i /tmp/gluten $ podman run --cap-drop ALL --security-opt=seccomp=/tmp/scmp_prof.json \ --annotation run.oci.seccomp.receiver=/tmp/seitan.sock \ -ti fedora \ sh -c 'mknod /dev/lol c 1 7 && ls /dev/lol' /dev/lol Signed-off-by: Alice Frosi <afrosi@redhat.com>
* cooker: add flags with getoptsAlice Frosi2023-08-242-6/+88
|
* seitan: configure uid and gid for the socketAlice Frosi2023-08-241-4/+22
| | | | | | | Allow setting a different uid and gid for the socket, otherwise seitan uses its own uid and gid. Signed-off-by: Alice Frosi <afrosi@redhat.com>
* test: fix test-error-checkAlice Frosi2023-07-144-109/+97
| | | | The error-check tests recompile and pass.
* common, ops: add error print and return if desc is emptyAlice Frosi2023-07-142-4/+11
|
* seitan: Zero out the request structure before SECCOMP_IOCTL_NOTIF_RECVStefano Brivio2023-07-051-0/+1
| | | | | | | Otherwise we'll get EINVAL (as expected) -- reproducibly, at least, when we handle more than one call. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* seitan: If setfd is not set, don't add SECCOMP_ADDFD_FLAG_SETFDStefano Brivio2023-07-051-1/+1
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* test: fix filter testsAlice Frosi2023-07-042-45/+56
| | | | The filter tests recompile and pass.
* demo: clean-upAlice Frosi2023-07-0412-0/+2
| | | | Remove all the *.gluten and *.bpf files and added the files to gitignore
* Fix makefile for debug targetAlice Frosi2023-07-042-6/+4
|
* test: fix filter-build test and bugsAlice Frosi2023-07-039-124/+125
| | | | | | | | | | | | The tests for checking the filter build recompile and are successfull. Changes: - spotted a couple of bugs for adding the arguments in the filter - readded function `filter_flush_args` to flush_args; this is needed to distinguish when the arguments belong to the same block or are different entries to the same syscall - build the filter in a way that CMP_EQ corresponds to BPF_JEQ and we don't need to awkwardly negate the operations (still TODO for AND_EQ)
* README: Variable size for diagramStefano Brivio2023-07-031-1/+1
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* vm-images: add connection to qemu:///systemAlice Frosi2023-06-291-2/+5
| | | | | Use system mode as suggested by the documentation. Added a note for directory permissions
* cooker, seitan: Add support for GID/UID in contextStefano Brivio2023-06-286-21/+93
| | | | | | | | | | Similarly to namespace specifications, the special value "caller", as well as login/group names and numeric UID/GIDs are supported. Example of usage in demo/mknod.hjson. Light on checks and with some TODOs left behind at the moment. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* vm-images: create script to setut fcos test VMAlice Frosi2023-06-282-0/+75
|
* common: move cmp_type_str in utilAlice Frosi2023-06-283-5/+6
|
* Update demosAlice Frosi2023-06-2818-5/+113
|
* cooker/match: Fix mask calculation for GNU_DEV_MINORStefano Brivio2023-06-271-2/+2
| | | | | | | | Starting from Linux 2.6 series, we have 20 bits of minor (not 32) and the gap between low and high bits is 12 bits, meaning the high ones are shifted by 20 (not 12). Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* READMEStefano Brivio2023-06-211-39/+64
|
* READMEStefano Brivio2023-06-151-1/+1
|
* demo: Add read.hjson exampleStefano Brivio2023-06-151-0/+13
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* demo: script to download demoAlice Frosi2023-06-151-0/+9
|
* seitan: Fix typo in prepare_arg_clone()Stefano Brivio2023-06-141-1/+1
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* demo: missing demo partAlice Frosi2023-06-142-0/+3
| | | | | Add echo abcd for connect demo. Pull and make before running the demo.
* demo: simplify and adjust scriptsAlice Frosi2023-06-144-29/+14
|
* Merge branch 'devel'Alice Frosi2023-06-144-10/+14
|\
| * cooker: fix initialization and variable typeAlice Frosi2023-06-142-7/+5
| |
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-09 21:44:01 +0000