netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Improve seccomp ruleset debug logging readability.

Browse Source 
Before (sample ruleset):

```
Hot non-trivial syscalls:
  - sysno=1: {(arg0 == 0x4) => trace (0)}
  - sysno=39[vsyscall]: {(arg0 == 0x14) => errno (0)}
  - sysno=73: {(arg0 == 0x83) => trace (0)}
  - sysno=257: {(arg0 == 0x1cf) => kill thread, (arg0 == 0x71267) => kill process}
Cold non-trivial syscalls:
  - sysno=27[vsyscall]: {(arg0 == 0x4e) => errno (0)}
  - sysno=96[vsyscall]: {(true) => errno (0)}
  - sysno=202[vsyscall]: {(true) => errno (0)}
  - sysno=263: {((arg0 high=halfEq(0x0) && (arg0 low=halfEq(0x1d8) || arg0 low=halfEq(0x73598)))) => kill process, (arg0 == 0x1c295b98) => trap (0)}
  - sysno=265: {(arg0 == 0x1d7) => kill thread, (arg0 == 0x731af) => kill process}
Trivial syscalls:
  - sysno=0: {(true) => trace (0)}
  - sysno=3: {(true) => kill thread}
  - sysno=80: {(true) => kill thread}
  - sysno=81: {(true) => kill process}
```

After (same ruleset):

```
Hot non-trivial syscalls:
  - Syscall    1: (arg[0] == 0x4) => trace
  - Vsyscall  39: (arg[0] == 0x14) => return errno=0x0
  - Syscall   73: (arg[0] == 0x83) => trace
  - Syscall  257: {(arg[0] == 0x1cf) => kill thread; (arg[0] == 0x71267) => kill process}
Cold non-trivial syscalls:
  - Vsyscall  27: (arg[0] == 0x4e) => return errno=0x0
  - Vsyscall  96: return errno=0x0
  - Vsyscall 202: return errno=0x0
  - Syscall  263: {((arg[0].high == 0 && (arg[0].low == 0x1d8 || arg[0].low == 0x73598))) => kill process; (arg[0] == 0x1c295b98) => trap}
  - Syscall  265: {(arg[0] == 0x1d7) => kill thread; (arg[0] == 0x731af) => kill process}
Trivial syscalls:
  - Syscall    0: trace
  - Syscall    3: kill thread
  - Syscall   80: kill thread
  - Syscall   81: kill process
```

PiperOrigin-RevId: 587130340
This commit is contained in:
Etienne Perot
2023-12-01 15:02:32 -08:00
committed by gVisor bot
parent 4c76c84ed0
commit 326e1681e7
3 changed files with 94 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/abi/linux/seccomp.go
+11 -3
View File
@@ -50,11 +50,19 @@ func (a BPFAction) String() string {
case SECCOMP_RET_KILL_THREAD:
return "kill thread"
case SECCOMP_RET_TRAP:
return fmt.Sprintf("trap (%d)", a.Data())
data := a.Data()
if data == 0 {
return "trap"
}
return fmt.Sprintf("trap (data=%#x)", data)
case SECCOMP_RET_ERRNO:
return fmt.Sprintf("errno (%d)", a.Data())
return fmt.Sprintf("return errno=%#x", a.Data())
case SECCOMP_RET_TRACE:
return fmt.Sprintf("trace (%d)", a.Data())
data := a.Data()
if data == 0 {
return "trace"
}
return fmt.Sprintf("trace (data=%#x)", data)
case SECCOMP_RET_ALLOW:
return "allow"
}