From 45b06bbb763662579dcc35b9d70f56ce85cf3370 Mon Sep 17 00:00:00 2001 From: Shambhavi Srivastava Date: Fri, 24 Jun 2022 19:35:05 -0700 Subject: [PATCH] Add Points to some syscalls Added a raw syscall points to all syscalls. Added schematized syscall points to the following syscalls: - chroot - dup, dup2, dup3 - prlimit64 - eventfd, eventfd2 - signalfd, signalfd4 - bind - accept, accept4 - fcntl - pipe, pipe2 Updates #4805 PiperOrigin-RevId: 457139504 --- examples/seccheck/server.cc | 10 + pkg/sentry/seccheck/metadata_amd64.go | 62 ++++- pkg/sentry/seccheck/metadata_arm64.go | 48 +++- pkg/sentry/seccheck/points/common.proto | 10 + pkg/sentry/seccheck/points/syscall.proto | 97 ++++++++ pkg/sentry/syscalls/linux/linux64.go | 56 ++--- pkg/sentry/syscalls/linux/points.go | 301 +++++++++++++++++++++-- pkg/sentry/syscalls/linux/vfs2/vfs2.go | 48 ++-- 8 files changed, 563 insertions(+), 69 deletions(-) diff --git a/examples/seccheck/server.cc b/examples/seccheck/server.cc index 32e491414..5943733de 100644 --- a/examples/seccheck/server.cc +++ b/examples/seccheck/server.cc @@ -95,6 +95,16 @@ std::vector dispatchers = { unpackSyscall<::gvisor::syscall::Chdir>, unpackSyscall<::gvisor::syscall::Setid>, unpackSyscall<::gvisor::syscall::Setresid>, + unpackSyscall<::gvisor::syscall::Dup>, + unpackSyscall<::gvisor::syscall::Prlimit>, + unpackSyscall<::gvisor::syscall::Pipe>, + unpackSyscall<::gvisor::syscall::Fcntl>, + unpackSyscall<::gvisor::syscall::Signalfd>, + unpackSyscall<::gvisor::syscall::Eventfd>, + unpackSyscall<::gvisor::syscall::Chroot>, + unpackSyscall<::gvisor::syscall::Clone>, + unpackSyscall<::gvisor::syscall::Bind>, + unpackSyscall<::gvisor::syscall::Accept>, }; void unpack(absl::string_view buf) { diff --git a/pkg/sentry/seccheck/metadata_amd64.go b/pkg/sentry/seccheck/metadata_amd64.go index 1a194e40d..5f889904f 100644 --- a/pkg/sentry/seccheck/metadata_amd64.go +++ b/pkg/sentry/seccheck/metadata_amd64.go @@ -73,12 +73,72 @@ func init() { Name: "fd_path", }, }) - + addSyscallPoint(22, "pipe", nil) + addSyscallPoint(293, "pipe2", nil) + addSyscallPoint(72, "fcntl", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) addSyscallPoint(105, "setuid", nil) addSyscallPoint(106, "setgid", nil) addSyscallPoint(112, "setsid", nil) addSyscallPoint(117, "setresuid", nil) addSyscallPoint(119, "setresgid", nil) + addSyscallPoint(161, "chroot", nil) + addSyscallPoint(302, "prlimit64", nil) + addSyscallPoint(284, "eventfd", nil) + addSyscallPoint(290, "eventfd2", nil) + addSyscallPoint(282, "signalfd", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(289, "signalfd4", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(32, "dup", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(33, "dup2", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(292, "dup3", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(56, "clone", nil) + addSyscallPoint(49, "bind", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(43, "accept", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(288, "accept4", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) const lastSyscallInTable = 441 for i := 0; i <= lastSyscallInTable; i++ { diff --git a/pkg/sentry/seccheck/metadata_arm64.go b/pkg/sentry/seccheck/metadata_arm64.go index fd93761d1..c4c42e30c 100644 --- a/pkg/sentry/seccheck/metadata_arm64.go +++ b/pkg/sentry/seccheck/metadata_arm64.go @@ -71,7 +71,53 @@ func init() { addSyscallPoint(157, "setsid", nil) addSyscallPoint(147, "setresuid", nil) addSyscallPoint(149, "setresgid", nil) - + addSyscallPoint(261, "prlimit64", nil) + addSyscallPoint(51, "chroot", nil) + addSyscallPoint(23, "dup", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(24, "dup3", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(59, "pipe2", nil) + addSyscallPoint(74, "signalfd4", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(25, "fcntl", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(19, "eventfd2", nil) + addSyscallPoint(220, "clone", nil) + addSyscallPoint(200, "bind", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(202, "accept", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) + addSyscallPoint(242, "accept4", []FieldDesc{ + { + ID: FieldSyscallPath, + Name: "fd_path", + }, + }) const lastSyscallInTable = 441 for i := 0; i <= lastSyscallInTable; i++ { addRawSyscallPoint(uintptr(i)) diff --git a/pkg/sentry/seccheck/points/common.proto b/pkg/sentry/seccheck/points/common.proto index a5c2bdd2b..5bd7ace13 100644 --- a/pkg/sentry/seccheck/points/common.proto +++ b/pkg/sentry/seccheck/points/common.proto @@ -113,5 +113,15 @@ enum MessageType { MESSAGE_SYSCALL_CHDIR = 13; MESSAGE_SYSCALL_SETID = 14; MESSAGE_SYSCALL_SETRESID = 15; + MESSAGE_SYSCALL_PRLIMIT64 = 16; + MESSAGE_SYSCALL_PIPE = 17; + MESSAGE_SYSCALL_FCNTL = 18; + MESSAGE_SYSCALL_DUP = 19; + MESSAGE_SYSCALL_SIGNALFD = 20; + MESSAGE_SYSCALL_CHROOT = 21; + MESSAGE_SYSCALL_EVENTFD = 22; + MESSAGE_SYSCALL_CLONE = 23; + MESSAGE_SYSCALL_BIND = 24; + MESSAGE_SYSCALL_ACCEPT = 25; } // LINT.ThenChange(../../../../examples/seccheck/server.cc) diff --git a/pkg/sentry/seccheck/points/syscall.proto b/pkg/sentry/seccheck/points/syscall.proto index 88d2c8b22..41ff3fbc7 100644 --- a/pkg/sentry/seccheck/points/syscall.proto +++ b/pkg/sentry/seccheck/points/syscall.proto @@ -117,3 +117,100 @@ message Setid { uint64 sysno = 3; uint32 id = 4; } + +message StructRlimit { + uint64 cur = 1; + uint64 max = 2; +} + +message Prlimit { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 pid = 4; + int64 resource = 5; + StructRlimit new_limit = 6; + StructRlimit old_limit = 7; +} + +message Pipe { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + uint32 flags = 4; + int32 reader = 5; + int32 writer = 6; +} + +message Fcntl { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 fd = 4; + string fd_path = 5; + int32 cmd = 6; + int64 args = 7; +} + +message Dup { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 old_fd = 4; + int32 new_fd = 5; + string fd_path = 6; + uint32 flags = 7; +} + +message Signalfd { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 fd = 4; + string fd_path = 5; + uint64 sigset = 6; + int32 flags = 7; +} + +message Chroot { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + string pathname = 4; +} +message Eventfd { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 val = 4; + uint32 flags = 5; +} + +message Clone { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + uint64 flags = 4; + uint64 stack = 5; + uint64 new_tid = 6; + uint64 tls = 7; +} + +message Bind { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 fd = 4; + string fd_path = 5; + bytes address = 6; +} + +message Accept { + gvisor.common.ContextData context_data = 1; + Exit exit = 2; + uint64 sysno = 3; + int32 fd = 4; + string fd_path = 5; + bytes address = 6; + int32 flags = 7; +} diff --git a/pkg/sentry/syscalls/linux/linux64.go b/pkg/sentry/syscalls/linux/linux64.go index b4716bdd1..3d52498c6 100644 --- a/pkg/sentry/syscalls/linux/linux64.go +++ b/pkg/sentry/syscalls/linux/linux64.go @@ -74,7 +74,7 @@ var AMD64 = &kernel.SyscallTable{ 19: syscalls.Supported("readv", Readv), 20: syscalls.Supported("writev", Writev), 21: syscalls.Supported("access", Access), - 22: syscalls.Supported("pipe", Pipe), + 22: syscalls.SupportedPoint("pipe", Pipe, PointPipe), 23: syscalls.Supported("select", Select), 24: syscalls.Supported("sched_yield", SchedYield), 25: syscalls.Supported("mremap", Mremap), @@ -84,8 +84,8 @@ var AMD64 = &kernel.SyscallTable{ 29: syscalls.PartiallySupported("shmget", Shmget, "Option SHM_HUGETLB is not supported.", nil), 30: syscalls.PartiallySupported("shmat", Shmat, "Option SHM_RND is not supported.", nil), 31: syscalls.PartiallySupported("shmctl", Shmctl, "Options SHM_LOCK, SHM_UNLOCK are not supported.", nil), - 32: syscalls.Supported("dup", Dup), - 33: syscalls.Supported("dup2", Dup2), + 32: syscalls.SupportedPoint("dup", Dup, PointDup), + 33: syscalls.SupportedPoint("dup2", Dup2, PointDup2), 34: syscalls.Supported("pause", Pause), 35: syscalls.Supported("nanosleep", Nanosleep), 36: syscalls.Supported("getitimer", Getitimer), @@ -95,20 +95,20 @@ var AMD64 = &kernel.SyscallTable{ 40: syscalls.Supported("sendfile", Sendfile), 41: syscalls.PartiallySupported("socket", Socket, "Limited support for AF_NETLINK, NETLINK_ROUTE sockets. Limited support for SOCK_RAW.", nil), 42: syscalls.SupportedPoint("connect", Connect, PointConnect), - 43: syscalls.Supported("accept", Accept), + 43: syscalls.SupportedPoint("accept", Accept, PointAccept), 44: syscalls.Supported("sendto", SendTo), 45: syscalls.Supported("recvfrom", RecvFrom), 46: syscalls.Supported("sendmsg", SendMsg), 47: syscalls.PartiallySupported("recvmsg", RecvMsg, "Not all flags and control messages are supported.", nil), 48: syscalls.PartiallySupported("shutdown", Shutdown, "Not all flags and control messages are supported.", nil), - 49: syscalls.PartiallySupported("bind", Bind, "Autobind for abstract Unix sockets is not supported.", nil), + 49: syscalls.PartiallySupportedPoint("bind", Bind, PointBind, "Autobind for abstract Unix sockets is not supported.", nil), 50: syscalls.Supported("listen", Listen), 51: syscalls.Supported("getsockname", GetSockName), 52: syscalls.Supported("getpeername", GetPeerName), 53: syscalls.Supported("socketpair", SocketPair), 54: syscalls.PartiallySupported("setsockopt", SetSockOpt, "Not all socket options are supported.", nil), 55: syscalls.PartiallySupported("getsockopt", GetSockOpt, "Not all socket options are supported.", nil), - 56: syscalls.PartiallySupported("clone", Clone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil), + 56: syscalls.PartiallySupportedPoint("clone", Clone, PointClone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil), 57: syscalls.Supported("fork", Fork), 58: syscalls.Supported("vfork", Vfork), 59: syscalls.SupportedPoint("execve", Execve, PointExecve), @@ -124,7 +124,7 @@ var AMD64 = &kernel.SyscallTable{ 69: syscalls.Supported("msgsnd", Msgsnd), 70: syscalls.Supported("msgrcv", Msgrcv), 71: syscalls.Supported("msgctl", Msgctl), - 72: syscalls.PartiallySupported("fcntl", Fcntl, "Not all options are supported.", nil), + 72: syscalls.PartiallySupportedPoint("fcntl", Fcntl, PointFcntl, "Not all options are supported.", nil), 73: syscalls.PartiallySupported("flock", Flock, "Locks are held within the sandbox only.", nil), 74: syscalls.PartiallySupported("fsync", Fsync, "Full data flush is not guaranteed at this time.", nil), 75: syscalls.PartiallySupported("fdatasync", Fdatasync, "Full data flush is not guaranteed at this time.", nil), @@ -213,7 +213,7 @@ var AMD64 = &kernel.SyscallTable{ 158: syscalls.PartiallySupported("arch_prctl", ArchPrctl, "Options ARCH_GET_GS, ARCH_SET_GS not supported.", nil), 159: syscalls.CapError("adjtimex", linux.CAP_SYS_TIME, "", nil), 160: syscalls.PartiallySupported("setrlimit", Setrlimit, "Not all rlimits are enforced.", nil), - 161: syscalls.Supported("chroot", Chroot), + 161: syscalls.SupportedPoint("chroot", Chroot, PointChroot), 162: syscalls.PartiallySupported("sync", Sync, "Full data flush is not guaranteed at this time.", nil), 163: syscalls.CapError("acct", linux.CAP_SYS_PACCT, "", nil), 164: syscalls.CapError("settimeofday", linux.CAP_SYS_TIME, "", nil), @@ -334,18 +334,18 @@ var AMD64 = &kernel.SyscallTable{ 279: syscalls.CapError("move_pages", linux.CAP_SYS_NICE, "", nil), // requires cap_sys_nice (mostly) 280: syscalls.Supported("utimensat", Utimensat), 281: syscalls.Supported("epoll_pwait", EpollPwait), - 282: syscalls.PartiallySupported("signalfd", Signalfd, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}), + 282: syscalls.PartiallySupportedPoint("signalfd", Signalfd, PointSignalfd, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}), 283: syscalls.Supported("timerfd_create", TimerfdCreate), - 284: syscalls.Supported("eventfd", Eventfd), + 284: syscalls.SupportedPoint("eventfd", Eventfd, PointEventfd), 285: syscalls.PartiallySupported("fallocate", Fallocate, "Not all options are supported.", nil), 286: syscalls.Supported("timerfd_settime", TimerfdSettime), 287: syscalls.Supported("timerfd_gettime", TimerfdGettime), - 288: syscalls.Supported("accept4", Accept4), - 289: syscalls.PartiallySupported("signalfd4", Signalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}), - 290: syscalls.Supported("eventfd2", Eventfd2), + 288: syscalls.SupportedPoint("accept4", Accept4, PointAccept4), + 289: syscalls.PartiallySupportedPoint("signalfd4", Signalfd4, PointSignalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}), + 290: syscalls.SupportedPoint("eventfd2", Eventfd2, PointEventfd2), 291: syscalls.Supported("epoll_create1", EpollCreate1), - 292: syscalls.Supported("dup3", Dup3), - 293: syscalls.Supported("pipe2", Pipe2), + 292: syscalls.SupportedPoint("dup3", Dup3, PointDup3), + 293: syscalls.SupportedPoint("pipe2", Pipe2, PointPipe2), 294: syscalls.PartiallySupported("inotify_init1", InotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), 295: syscalls.Supported("preadv", Preadv), 296: syscalls.Supported("pwritev", Pwritev), @@ -354,7 +354,7 @@ var AMD64 = &kernel.SyscallTable{ 299: syscalls.PartiallySupported("recvmmsg", RecvMMsg, "Not all flags and control messages are supported.", nil), 300: syscalls.ErrorWithEvent("fanotify_init", linuxerr.ENOSYS, "Needs CONFIG_FANOTIFY", nil), 301: syscalls.ErrorWithEvent("fanotify_mark", linuxerr.ENOSYS, "Needs CONFIG_FANOTIFY", nil), - 302: syscalls.Supported("prlimit64", Prlimit64), + 302: syscalls.SupportedPoint("prlimit64", Prlimit64, PointPrlimit64), 303: syscalls.Error("name_to_handle_at", linuxerr.EOPNOTSUPP, "Not supported by gVisor filesystems", nil), 304: syscalls.Error("open_by_handle_at", linuxerr.EOPNOTSUPP, "Not supported by gVisor filesystems", nil), 305: syscalls.CapError("clock_adjtime", linux.CAP_SYS_TIME, "", nil), @@ -449,13 +449,13 @@ var ARM64 = &kernel.SyscallTable{ 16: syscalls.PartiallySupported("fremovexattr", FRemoveXattr, "Only supported for tmpfs", nil), 17: syscalls.Supported("getcwd", Getcwd), 18: syscalls.CapError("lookup_dcookie", linux.CAP_SYS_ADMIN, "", nil), - 19: syscalls.Supported("eventfd2", Eventfd2), + 19: syscalls.SupportedPoint("eventfd2", Eventfd2, PointEventfd2), 20: syscalls.Supported("epoll_create1", EpollCreate1), 21: syscalls.Supported("epoll_ctl", EpollCtl), 22: syscalls.Supported("epoll_pwait", EpollPwait), - 23: syscalls.Supported("dup", Dup), - 24: syscalls.Supported("dup3", Dup3), - 25: syscalls.PartiallySupported("fcntl", Fcntl, "Not all options are supported.", nil), + 23: syscalls.SupportedPoint("dup", Dup, PointDup), + 24: syscalls.SupportedPoint("dup3", Dup3, PointDup3), + 25: syscalls.PartiallySupportedPoint("fcntl", Fcntl, PointFcntl, "Not all options are supported.", nil), 26: syscalls.PartiallySupported("inotify_init1", InotifyInit1, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), 27: syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), 28: syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "Inotify events are only available inside the sandbox. Hard links are treated as different watch targets in gofer fs.", nil), @@ -481,7 +481,7 @@ var ARM64 = &kernel.SyscallTable{ 48: syscalls.Supported("faccessat", Faccessat), 49: syscalls.SupportedPoint("chdir", Chdir, PointChdir), 50: syscalls.SupportedPoint("fchdir", Fchdir, PointFchdir), - 51: syscalls.Supported("chroot", Chroot), + 51: syscalls.SupportedPoint("chroot", Chroot, PointChroot), 52: syscalls.PartiallySupported("fchmod", Fchmod, "Options S_ISUID and S_ISGID not supported.", nil), 53: syscalls.Supported("fchmodat", Fchmodat), 54: syscalls.Supported("fchownat", Fchownat), @@ -489,7 +489,7 @@ var ARM64 = &kernel.SyscallTable{ 56: syscalls.SupportedPoint("openat", Openat, PointOpenat), 57: syscalls.Supported("close", Close), 58: syscalls.CapError("vhangup", linux.CAP_SYS_TTY_CONFIG, "", nil), - 59: syscalls.Supported("pipe2", Pipe2), + 59: syscalls.SupportedPoint("pipe2", Pipe2, PointPipe2), 60: syscalls.CapError("quotactl", linux.CAP_SYS_ADMIN, "", nil), // requires cap_sys_admin for most operations 61: syscalls.Supported("getdents64", Getdents64), 62: syscalls.Supported("lseek", Lseek), @@ -504,7 +504,7 @@ var ARM64 = &kernel.SyscallTable{ 71: syscalls.Supported("sendfile", Sendfile), 72: syscalls.Supported("pselect", Pselect), 73: syscalls.Supported("ppoll", Ppoll), - 74: syscalls.PartiallySupported("signalfd4", Signalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}), + 74: syscalls.PartiallySupportedPoint("signalfd4", Signalfd4, PointSignalfd4, "Semantics are slightly different.", []string{"gvisor.dev/issue/139"}), 75: syscalls.ErrorWithEvent("vmsplice", linuxerr.ENOSYS, "", []string{"gvisor.dev/issue/138"}), // TODO(b/29354098) 76: syscalls.Supported("splice", Splice), 77: syscalls.Supported("tee", Tee), @@ -630,9 +630,9 @@ var ARM64 = &kernel.SyscallTable{ 197: syscalls.Supported("shmdt", Shmdt), 198: syscalls.PartiallySupported("socket", Socket, "Limited support for AF_NETLINK, NETLINK_ROUTE sockets. Limited support for SOCK_RAW.", nil), 199: syscalls.Supported("socketpair", SocketPair), - 200: syscalls.PartiallySupported("bind", Bind, "Autobind for abstract Unix sockets is not supported.", nil), + 200: syscalls.PartiallySupportedPoint("bind", Bind, PointBind, "Autobind for abstract Unix sockets is not supported.", nil), 201: syscalls.Supported("listen", Listen), - 202: syscalls.Supported("accept", Accept), + 202: syscalls.SupportedPoint("accept", Accept, PointAccept), 203: syscalls.SupportedPoint("connect", Connect, PointConnect), 204: syscalls.Supported("getsockname", GetSockName), 205: syscalls.Supported("getpeername", GetPeerName), @@ -650,7 +650,7 @@ var ARM64 = &kernel.SyscallTable{ 217: syscalls.Error("add_key", linuxerr.EACCES, "Not available to user.", nil), 218: syscalls.Error("request_key", linuxerr.EACCES, "Not available to user.", nil), 219: syscalls.Error("keyctl", linuxerr.EACCES, "Not available to user.", nil), - 220: syscalls.PartiallySupported("clone", Clone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil), + 220: syscalls.PartiallySupportedPoint("clone", Clone, PointClone, "Mount namespace (CLONE_NEWNS) not supported. Options CLONE_PARENT, CLONE_SYSVSEM not supported.", nil), 221: syscalls.SupportedPoint("execve", Execve, PointExecve), 222: syscalls.PartiallySupported("mmap", Mmap, "Generally supported with exceptions. Options MAP_FIXED_NOREPLACE, MAP_SHARED_VALIDATE, MAP_SYNC MAP_GROWSDOWN, MAP_HUGETLB are not supported.", nil), 223: syscalls.PartiallySupported("fadvise64", Fadvise64, "Not all options are supported.", nil), @@ -672,10 +672,10 @@ var ARM64 = &kernel.SyscallTable{ 239: syscalls.CapError("move_pages", linux.CAP_SYS_NICE, "", nil), // requires cap_sys_nice (mostly) 240: syscalls.Supported("rt_tgsigqueueinfo", RtTgsigqueueinfo), 241: syscalls.ErrorWithEvent("perf_event_open", linuxerr.ENODEV, "No support for perf counters", nil), - 242: syscalls.Supported("accept4", Accept4), + 242: syscalls.SupportedPoint("accept4", Accept4, PointAccept4), 243: syscalls.PartiallySupported("recvmmsg", RecvMMsg, "Not all flags and control messages are supported.", nil), 260: syscalls.Supported("wait4", Wait4), - 261: syscalls.Supported("prlimit64", Prlimit64), + 261: syscalls.SupportedPoint("prlimit64", Prlimit64, PointPrlimit64), 262: syscalls.ErrorWithEvent("fanotify_init", linuxerr.ENOSYS, "Needs CONFIG_FANOTIFY", nil), 263: syscalls.ErrorWithEvent("fanotify_mark", linuxerr.ENOSYS, "Needs CONFIG_FANOTIFY", nil), 264: syscalls.Error("name_to_handle_at", linuxerr.EOPNOTSUPP, "Not supported by gVisor filesystems", nil), diff --git a/pkg/sentry/syscalls/linux/points.go b/pkg/sentry/syscalls/linux/points.go index 6b7a3956c..e7c4414c5 100644 --- a/pkg/sentry/syscalls/linux/points.go +++ b/pkg/sentry/syscalls/linux/points.go @@ -20,6 +20,7 @@ import ( "google.golang.org/protobuf/proto" "gvisor.dev/gvisor/pkg/abi/linux" "gvisor.dev/gvisor/pkg/hostarch" + "gvisor.dev/gvisor/pkg/marshal/primitive" "gvisor.dev/gvisor/pkg/sentry/kernel" "gvisor.dev/gvisor/pkg/sentry/seccheck" pb "gvisor.dev/gvisor/pkg/sentry/seccheck/points/points_go_proto" @@ -69,7 +70,7 @@ func PointOpen(t *kernel.Task, _ seccheck.FieldSet, cxtData *pb.ContextData, inf addr := info.Args[0].Pointer() if addr > 0 { path, err := t.CopyInString(addr, linux.PATH_MAX) - if err == nil { + if err == nil { // if NO error p.Pathname = path } } @@ -89,7 +90,7 @@ func PointOpenat(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextDa addr := info.Args[1].Pointer() if addr > 0 { path, err := t.CopyInString(addr, linux.PATH_MAX) - if err == nil { + if err == nil { // if NO error p.Pathname = path } } @@ -119,7 +120,7 @@ func PointCreat(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextDat addr := info.Args[0].Pointer() if addr > 0 { path, err := t.CopyInString(addr, linux.PATH_MAX) - if err == nil { + if err == nil { // if NO error p.Pathname = path } } @@ -208,18 +209,18 @@ func PointExecve(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextDa ContextData: cxtData, Sysno: uint64(info.Sysno), } - if pathname, err := t.CopyInString(info.Args[0].Pointer(), linux.PATH_MAX); err == nil { + if pathname, err := t.CopyInString(info.Args[0].Pointer(), linux.PATH_MAX); err == nil { // if NO error p.Pathname = pathname } if argvAddr := info.Args[1].Pointer(); argvAddr != 0 { - if argv, err := t.CopyInVector(argvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { + if argv, err := t.CopyInVector(argvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { // if NO error p.Argv = argv } } if fields.Local.Contains(seccheck.FieldSyscallExecveEnvv) { if envvAddr := info.Args[2].Pointer(); envvAddr != 0 { - if envv, err := t.CopyInVector(envvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { + if envv, err := t.CopyInVector(envvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { // if NO error p.Envv = envv } } @@ -238,18 +239,18 @@ func PointExecveat(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.Context Fd: int64(info.Args[0].Int()), Flags: info.Args[4].Uint(), } - if pathname, err := t.CopyInString(info.Args[1].Pointer(), linux.PATH_MAX); err == nil { + if pathname, err := t.CopyInString(info.Args[1].Pointer(), linux.PATH_MAX); err == nil { // if NO error p.Pathname = pathname } if argvAddr := info.Args[2].Pointer(); argvAddr != 0 { - if argv, err := t.CopyInVector(argvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { + if argv, err := t.CopyInVector(argvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { // if NO error p.Argv = argv } } if fields.Local.Contains(seccheck.FieldSyscallExecveEnvv) { if envvAddr := info.Args[3].Pointer(); envvAddr != 0 { - if envv, err := t.CopyInVector(envvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { + if envv, err := t.CopyInVector(envvAddr, ExecMaxElemSize, ExecMaxTotalSize); err == nil { // if NO error p.Envv = envv } } @@ -273,7 +274,7 @@ func pointChdirHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.Cont if path > 0 { pathname, err := t.CopyInString(path, linux.PATH_MAX) - if err == nil { + if err == nil { // if NO error p.Pathname = pathname } } @@ -315,13 +316,13 @@ func pointSetidHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.Cont // PointSetuid calls pointSetidHelper to convert setuid(2) syscall to proto. func PointSetuid(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { - id := uint32(info.Args[0].Uint()) + id := info.Args[0].Uint() return pointSetidHelper(t, fields, cxtData, info, id) } // PointSetgid calls pointSetidHelper to convert setgid(2) syscall to proto. func PointSetgid(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { - id := uint32(info.Args[0].Uint()) + id := info.Args[0].Uint() return pointSetidHelper(t, fields, cxtData, info, id) } @@ -335,9 +336,9 @@ func pointSetresidHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.C p := &pb.Setresid{ ContextData: cxtData, Sysno: uint64(info.Sysno), - Rgid: uint32(info.Args[0].Uint()), - Egid: uint32(info.Args[1].Uint()), - Sgid: uint32(info.Args[2].Uint()), + Rgid: info.Args[0].Uint(), + Egid: info.Args[1].Uint(), + Sgid: info.Args[2].Uint(), } p.Exit = newExitMaybe(info) @@ -354,3 +355,273 @@ func PointSetresuid(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.Contex func PointSetresgid(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { return pointSetresidHelper(t, fields, cxtData, info) } + +func rlimits(rlimit rlimit64) *pb.StructRlimit { + limit := rlimit.toLimit() + return &pb.StructRlimit{ + Cur: limit.Cur, + Max: limit.Max, + } +} + +// PointPrlimit64 call converts prlimit64(2) syscall to proto. +func PointPrlimit64(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.Prlimit{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Pid: int32(info.Args[0].Int()), + Resource: info.Args[1].Int64(), + } + + if newRlimitAddr := info.Args[2].Pointer(); newRlimitAddr != 0 { + var nrl rlimit64 + if err := nrl.copyIn(t, newRlimitAddr); err == nil { // if NO error + p.NewLimit = rlimits(nrl) + } + } + + if oldRlimitAddr := info.Args[3].Pointer(); oldRlimitAddr != 0 { + var orl rlimit64 + if err := orl.copyIn(t, oldRlimitAddr); err == nil { // if NO error + p.OldLimit = rlimits(orl) + } + } + + p.Exit = newExitMaybe(info) + + return p, pb.MessageType_MESSAGE_SYSCALL_PRLIMIT64 +} + +// pipeHelper converts pipe(2) and pipe2(2) syscall to proto. +func pipeHelper(t *kernel.Task, cxtData *pb.ContextData, info kernel.SyscallInfo, flags uint32) (proto.Message, pb.MessageType) { + p := &pb.Pipe{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Flags: flags, + } + if info.Exit { + if pipeFDAddr := info.Args[0].Pointer(); pipeFDAddr != 0 { + var pipeFDs [2]int32 + if _, err := primitive.CopyInt32SliceOut(t, pipeFDAddr, pipeFDs[2:2]); err == nil { // if NO error + p.Reader = pipeFDs[0] + p.Writer = pipeFDs[1] + } + } + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_PIPE +} + +// PointPipe calls pipeHelper to convert pipe(2) syscall to proto. +func PointPipe(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + return pipeHelper(t, cxtData, info, 0) +} + +// PointPipe2 calls pipeHelper to convert pipe2(2) syscall to proto. +func PointPipe2(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + flags := info.Args[1].Uint() + return pipeHelper(t, cxtData, info, flags) +} + +// eventfdHelper converts eventfd(2) and eventfd2(2) syscall to proto. +func eventfdHelper(cxtData *pb.ContextData, info kernel.SyscallInfo, flags uint32) (proto.Message, pb.MessageType) { + p := &pb.Eventfd{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Val: int32(info.Args[0].Int()), + Flags: flags, + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_EVENTFD +} + +// PointEventfd calls pipeHelper to convert eventfd(2) syscall to proto. +func PointEventfd(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + return eventfdHelper(cxtData, info, 0) +} + +// PointEventfd2 calls pipeHelper to convert eventfd2(2) syscall to proto. +func PointEventfd2(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + flags := info.Args[1].Uint() + return eventfdHelper(cxtData, info, flags) +} + +// PointFcntl converts fcntl(2) syscall to proto. +func PointFcntl(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.Fcntl{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Fd: info.Args[0].Int(), + Cmd: info.Args[1].Int(), + Args: info.Args[2].Int64(), + } + + if fields.Local.Contains(seccheck.FieldSyscallPath) { + p.FdPath = getFilePath(t, int32(p.Fd)) + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_FCNTL +} + +// pointDupHelper converts dup(2), dup2(2), and dup3(2) syscall to proto. +func pointDupHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo, oldFD, newFD int32, flags uint32) (proto.Message, pb.MessageType) { + p := &pb.Dup{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + OldFd: oldFD, + NewFd: newFD, + Flags: flags, + } + + if fields.Local.Contains(seccheck.FieldSyscallPath) { + p.FdPath = getFilePath(t, int32(p.OldFd)) + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_DUP +} + +// PointDup calls pointDupHelper to convert dup(2) syscall to proto. +func PointDup(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + oldFD := info.Args[0].Int() + return pointDupHelper(t, fields, cxtData, info, oldFD, 0, 0) +} + +// PointDup2 calls pointDupHelper to convert dup2(2) syscall to proto. +func PointDup2(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + oldFD := info.Args[0].Int() + newFD := info.Args[1].Int() + return pointDupHelper(t, fields, cxtData, info, oldFD, newFD, 0) +} + +// PointDup3 calls pointDupHelper to convert dup3(2) syscall to proto. +func PointDup3(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + oldFD := info.Args[0].Int() + newFD := info.Args[1].Int() + flags := info.Args[2].Uint() + return pointDupHelper(t, fields, cxtData, info, oldFD, newFD, flags) +} + +// signalfdHelper converts signalfd(2) and signalfd4(2) syscall to proto. +func signalfdHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo, flags int32) (proto.Message, pb.MessageType) { + p := &pb.Signalfd{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Fd: info.Args[0].Int(), + Flags: flags, + } + sigset := info.Args[1].Pointer() + sigsetsize := info.Args[2].SizeT() + mask, err := CopyInSigSet(t, sigset, sigsetsize) + if err == nil { // if NO error + p.Sigset = uint64(mask) + p.Sigset = uint64(mask) + } + + if fields.Local.Contains(seccheck.FieldSyscallPath) { + p.FdPath = getFilePath(t, int32(p.Fd)) + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_SIGNALFD +} + +// PointSignalfd calls signalfdHelper to convert signalfd(2) syscall to proto. +func PointSignalfd(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + return signalfdHelper(t, fields, cxtData, info, 0) +} + +// PointSignalfd4 calls signalfdHelper to convert signalfd4(2) syscall to proto. +func PointSignalfd4(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + flags := info.Args[3].Int() + return signalfdHelper(t, fields, cxtData, info, flags) +} + +// PointChroot converts chroot(2) syscall to proto. +func PointChroot(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.Chroot{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + } + if pathname, err := t.CopyInString(info.Args[0].Pointer(), linux.PATH_MAX); err == nil { // if NO error + p.Pathname = pathname + } + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_CHROOT +} + +// PointClone converts clone(2) syscall to proto. +func PointClone(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.Clone{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Flags: info.Args[0].Uint64(), + Stack: uint64(info.Args[1].Pointer()), + Tls: uint64(info.Args[4].Pointer()), + } + var parTid kernel.ThreadID + + parentTidAddr := info.Args[2].Pointer() + if _, err := parTid.CopyIn(t, parentTidAddr); err == nil { // if NO error + p.NewTid = uint64(parTid) + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_CLONE +} + +// PointBind converts bind(2) syscall to proto. +func PointBind(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + p := &pb.Bind{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Fd: info.Args[0].Int(), + } + addr := info.Args[1].Pointer() + addrLen := info.Args[2].Uint() + if address, err := CaptureAddress(t, addr, addrLen); err == nil { // if NO error + p.Address = address + } + + if fields.Local.Contains(seccheck.FieldSyscallPath) { + p.FdPath = getFilePath(t, int32(p.Fd)) + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_BIND +} + +func acceptHelper(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo, flags int32) (proto.Message, pb.MessageType) { + p := &pb.Accept{ + ContextData: cxtData, + Sysno: uint64(info.Sysno), + Fd: info.Args[0].Int(), + Flags: flags, + } + addr := info.Args[1].Pointer() + addrLen := info.Args[2].Uint() + if address, err := CaptureAddress(t, addr, addrLen); err == nil { // if NO error + p.Address = address + } + + if fields.Local.Contains(seccheck.FieldSyscallPath) { + p.FdPath = getFilePath(t, int32(p.Fd)) + } + + p.Exit = newExitMaybe(info) + return p, pb.MessageType_MESSAGE_SYSCALL_ACCEPT +} + +// PointAccept converts accept(2) syscall to proto. +func PointAccept(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + return acceptHelper(t, fields, cxtData, info, 0) +} + +// PointAccept4 converts accept4(2) syscall to proto. +func PointAccept4(t *kernel.Task, fields seccheck.FieldSet, cxtData *pb.ContextData, info kernel.SyscallInfo) (proto.Message, pb.MessageType) { + flags := info.Args[3].Int() + return acceptHelper(t, fields, cxtData, info, flags) +} diff --git a/pkg/sentry/syscalls/linux/vfs2/vfs2.go b/pkg/sentry/syscalls/linux/vfs2/vfs2.go index 122bf87be..fe4d98312 100644 --- a/pkg/sentry/syscalls/linux/vfs2/vfs2.go +++ b/pkg/sentry/syscalls/linux/vfs2/vfs2.go @@ -40,20 +40,20 @@ func Override() { s.Table[19] = syscalls.Supported("readv", Readv) s.Table[20] = syscalls.Supported("writev", Writev) s.Table[21] = syscalls.Supported("access", Access) - s.Table[22] = syscalls.Supported("pipe", Pipe) + s.Table[22] = syscalls.SupportedPoint("pipe", Pipe, linux.PointPipe) s.Table[23] = syscalls.Supported("select", Select) - s.Table[32] = syscalls.Supported("dup", Dup) - s.Table[33] = syscalls.Supported("dup2", Dup2) + s.Table[32] = syscalls.SupportedPoint("dup", Dup, linux.PointDup) + s.Table[33] = syscalls.SupportedPoint("dup2", Dup2, linux.PointDup2) s.Table[40] = syscalls.Supported("sendfile", Sendfile) s.Table[41] = syscalls.SupportedPoint("socket", Socket, linux.PointSocket) s.Table[42] = syscalls.SupportedPoint("connect", Connect, linux.PointConnect) - s.Table[43] = syscalls.Supported("accept", Accept) + s.Table[43] = syscalls.SupportedPoint("accept", Accept, linux.PointAccept) s.Table[44] = syscalls.Supported("sendto", SendTo) s.Table[45] = syscalls.Supported("recvfrom", RecvFrom) s.Table[46] = syscalls.Supported("sendmsg", SendMsg) s.Table[47] = syscalls.Supported("recvmsg", RecvMsg) s.Table[48] = syscalls.Supported("shutdown", Shutdown) - s.Table[49] = syscalls.Supported("bind", Bind) + s.Table[49] = syscalls.SupportedPoint("bind", Bind, linux.PointBind) s.Table[50] = syscalls.Supported("listen", Listen) s.Table[51] = syscalls.Supported("getsockname", GetSockName) s.Table[52] = syscalls.Supported("getpeername", GetPeerName) @@ -61,7 +61,7 @@ func Override() { s.Table[54] = syscalls.Supported("setsockopt", SetSockOpt) s.Table[55] = syscalls.Supported("getsockopt", GetSockOpt) s.Table[59] = syscalls.SupportedPoint("execve", Execve, linux.PointExecve) - s.Table[72] = syscalls.Supported("fcntl", Fcntl) + s.Table[72] = syscalls.SupportedPoint("fcntl", Fcntl, linux.PointFcntl) s.Table[73] = syscalls.Supported("flock", Flock) s.Table[74] = syscalls.Supported("fsync", Fsync) s.Table[75] = syscalls.Supported("fdatasync", Fdatasync) @@ -89,7 +89,7 @@ func Override() { s.Table[137] = syscalls.Supported("statfs", Statfs) s.Table[138] = syscalls.Supported("fstatfs", Fstatfs) s.Table[155] = syscalls.Supported("pivot_root", PivotRoot) - s.Table[161] = syscalls.Supported("chroot", Chroot) + s.Table[161] = syscalls.SupportedPoint("chroot", Chroot, linux.PointChroot) s.Table[162] = syscalls.Supported("sync", Sync) s.Table[165] = syscalls.Supported("mount", Mount) s.Table[166] = syscalls.Supported("umount2", Umount2) @@ -138,18 +138,18 @@ func Override() { s.Table[277] = syscalls.Supported("sync_file_range", SyncFileRange) s.Table[280] = syscalls.Supported("utimensat", Utimensat) s.Table[281] = syscalls.Supported("epoll_pwait", EpollPwait) - s.Table[282] = syscalls.Supported("signalfd", Signalfd) + s.Table[282] = syscalls.SupportedPoint("signalfd", Signalfd, linux.PointSignalfd) s.Table[283] = syscalls.Supported("timerfd_create", TimerfdCreate) - s.Table[284] = syscalls.Supported("eventfd", Eventfd) + s.Table[284] = syscalls.SupportedPoint("eventfd", Eventfd, linux.PointEventfd) s.Table[285] = syscalls.PartiallySupported("fallocate", Fallocate, "Not all options are supported.", nil) s.Table[286] = syscalls.Supported("timerfd_settime", TimerfdSettime) s.Table[287] = syscalls.Supported("timerfd_gettime", TimerfdGettime) - s.Table[288] = syscalls.Supported("accept4", Accept4) - s.Table[289] = syscalls.Supported("signalfd4", Signalfd4) - s.Table[290] = syscalls.Supported("eventfd2", Eventfd2) + s.Table[288] = syscalls.SupportedPoint("accept4", Accept4, linux.PointAccept4) + s.Table[289] = syscalls.SupportedPoint("signalfd4", Signalfd4, linux.PointSignalfd4) + s.Table[290] = syscalls.SupportedPoint("eventfd2", Eventfd2, linux.PointEventfd2) s.Table[291] = syscalls.Supported("epoll_create1", EpollCreate1) - s.Table[292] = syscalls.Supported("dup3", Dup3) - s.Table[293] = syscalls.Supported("pipe2", Pipe2) + s.Table[292] = syscalls.SupportedPoint("dup3", Dup3, linux.PointDup3) + s.Table[293] = syscalls.SupportedPoint("pipe2", Pipe2, linux.PointPipe2) s.Table[294] = syscalls.PartiallySupported("inotify_init1", InotifyInit1, "inotify events are only available inside the sandbox.", nil) s.Table[295] = syscalls.Supported("preadv", Preadv) s.Table[296] = syscalls.Supported("pwritev", Pwritev) @@ -183,13 +183,13 @@ func Override() { s.Table[15] = syscalls.Supported("lremovexattr", Lremovexattr) s.Table[16] = syscalls.Supported("fremovexattr", Fremovexattr) s.Table[17] = syscalls.Supported("getcwd", Getcwd) - s.Table[19] = syscalls.Supported("eventfd2", Eventfd2) + s.Table[19] = syscalls.SupportedPoint("eventfd2", Eventfd2, linux.PointEventfd2) s.Table[20] = syscalls.Supported("epoll_create1", EpollCreate1) s.Table[21] = syscalls.Supported("epoll_ctl", EpollCtl) s.Table[22] = syscalls.Supported("epoll_pwait", EpollPwait) - s.Table[23] = syscalls.Supported("dup", Dup) - s.Table[24] = syscalls.Supported("dup3", Dup3) - s.Table[25] = syscalls.Supported("fcntl", Fcntl) + s.Table[23] = syscalls.SupportedPoint("dup", Dup, linux.PointDup) + s.Table[24] = syscalls.SupportedPoint("dup3", Dup3, linux.PointDup3) + s.Table[25] = syscalls.SupportedPoint("fcntl", Fcntl, linux.PointFcntl) s.Table[26] = syscalls.PartiallySupported("inotify_init1", InotifyInit1, "inotify events are only available inside the sandbox.", nil) s.Table[27] = syscalls.PartiallySupported("inotify_add_watch", InotifyAddWatch, "inotify events are only available inside the sandbox.", nil) s.Table[28] = syscalls.PartiallySupported("inotify_rm_watch", InotifyRmWatch, "inotify events are only available inside the sandbox.", nil) @@ -212,14 +212,14 @@ func Override() { s.Table[48] = syscalls.Supported("faccessat", Faccessat) s.Table[49] = syscalls.SupportedPoint("chdir", Chdir, linux.PointChdir) s.Table[50] = syscalls.SupportedPoint("fchdir", Fchdir, linux.PointFchdir) - s.Table[51] = syscalls.Supported("chroot", Chroot) + s.Table[51] = syscalls.SupportedPoint("chroot", Chroot, linux.PointChroot) s.Table[52] = syscalls.Supported("fchmod", Fchmod) s.Table[53] = syscalls.Supported("fchmodat", Fchmodat) s.Table[54] = syscalls.Supported("fchownat", Fchownat) s.Table[55] = syscalls.Supported("fchown", Fchown) s.Table[56] = syscalls.SupportedPoint("openat", Openat, linux.PointOpenat) s.Table[57] = syscalls.SupportedPoint("close", Close, linux.PointClose) - s.Table[59] = syscalls.Supported("pipe2", Pipe2) + s.Table[59] = syscalls.SupportedPoint("pipe2", Pipe2, linux.PointPipe2) s.Table[61] = syscalls.Supported("getdents64", Getdents64) s.Table[62] = syscalls.Supported("lseek", Lseek) s.Table[63] = syscalls.SupportedPoint("read", Read, linux.PointRead) @@ -233,7 +233,7 @@ func Override() { s.Table[71] = syscalls.Supported("sendfile", Sendfile) s.Table[72] = syscalls.Supported("pselect", Pselect) s.Table[73] = syscalls.Supported("ppoll", Ppoll) - s.Table[74] = syscalls.Supported("signalfd4", Signalfd4) + s.Table[74] = syscalls.SupportedPoint("signalfd4", Signalfd4, linux.PointSignalfd4) s.Table[76] = syscalls.Supported("splice", Splice) s.Table[77] = syscalls.Supported("tee", Tee) s.Table[78] = syscalls.Supported("readlinkat", Readlinkat) @@ -251,9 +251,9 @@ func Override() { s.Table[181] = syscalls.Supported("mq_unlink", MqUnlink) s.Table[198] = syscalls.SupportedPoint("socket", Socket, linux.PointSocket) s.Table[199] = syscalls.Supported("socketpair", SocketPair) - s.Table[200] = syscalls.Supported("bind", Bind) + s.Table[200] = syscalls.SupportedPoint("bind", Bind, linux.PointBind) s.Table[201] = syscalls.Supported("listen", Listen) - s.Table[202] = syscalls.Supported("accept", Accept) + s.Table[202] = syscalls.SupportedPoint("accept", Accept, linux.PointAccept) s.Table[203] = syscalls.SupportedPoint("connect", Connect, linux.PointConnect) s.Table[204] = syscalls.Supported("getsockname", GetSockName) s.Table[205] = syscalls.Supported("getpeername", GetPeerName) @@ -268,7 +268,7 @@ func Override() { s.Table[221] = syscalls.SupportedPoint("execve", Execve, linux.PointExecve) s.Table[222] = syscalls.Supported("mmap", Mmap) s.Table[223] = syscalls.PartiallySupported("fadvise64", Fadvise64, "Not all options are supported.", nil) - s.Table[242] = syscalls.Supported("accept4", Accept4) + s.Table[242] = syscalls.SupportedPoint("accept4", Accept4, linux.PointAccept4) s.Table[243] = syscalls.Supported("recvmmsg", RecvMMsg) s.Table[267] = syscalls.Supported("syncfs", Syncfs) s.Table[269] = syscalls.Supported("sendmmsg", SendMMsg)