From b7350faf8e466184ac665730306c99f6612eb5fd Mon Sep 17 00:00:00 2001
From: Alice Frosi <afrosi@redhat.com>
Date: Fri, 31 Mar 2023 14:15:24 +0200
Subject: filter: load argument to check
---
cooker/filter.c | 10 +++++++++-
cooker/filter.h | 1 +
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/cooker/filter.c b/cooker/filter.c
index 3f23c1f..717e525 100644
--- a/cooker/filter.c
+++ b/cooker/filter.c
@@ -184,9 +184,13 @@ static unsigned int get_total_args_instr(const struct syscall_entry table[],
for (i = 0; i < t->count; i++) {
entry = t->entry + i;
n = 0;
+ /* For every argument there are 2 instructions, one to
+ * load the value and the second to evaluate the
+ * argument
+ */
for (k = 0; k < 6; k++) {
if (entry->check_arg[k])
- n++;
+ n += 2;
}
total_instr += n;
/* If there is at least an arguments then there is an additional
@@ -287,6 +291,10 @@ unsigned int create_bfp_program(struct syscall_entry table[],
next_args_off = get_n_args_syscall_entry(entry);
for (k = 0; k < 6; k++)
if (entry->check_arg[k]) {
+ filter[size++] = (struct sock_filter)
+ LOAD((offsetof(
+ struct seccomp_data,
+ args[k])));
filter[size++] = (struct sock_filter)EQ(
(table[i].entry + j)->args[k],
0, next_args_off - n_checks);
diff --git a/cooker/filter.h b/cooker/filter.h
index ee5ab12..c8e74be 100644
--- a/cooker/filter.h
+++ b/cooker/filter.h
@@ -9,6 +9,7 @@
BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, (nr), (right), (left))
#define JUMPA(jump) BPF_JUMP(BPF_JMP | BPF_JA, (jump), 0, 0)
#define EQ(nr, a1, a2) BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, (nr), (a1), (a2))
+#define LOAD(x) BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (x))
#define MAX_FILTER 1024
--
cgit v1.2.3