netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

seccomp: Rename seccomp.MatchAny to seccomp.AnyValue.

Browse Source 
This reduces the diff on an upcoming refactor which modifies all seccomp
rules.

`AnyValue` better reflects the fact that the matcher is about matching a
single syscall argument value, as opposed to e.g. a rule that allows a
syscall through regardless of its argument.

PiperOrigin-RevId: 571110444
This commit is contained in:
Etienne Perot
2023-10-05 13:19:06 -07:00
committed by gVisor bot
parent 598fbe6503
commit dcfe2d169e
24 changed files with 274 additions and 274 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/seccomp/seccomp.go
+2 -2
View File
@@ -242,9 +242,9 @@ func addSyscallArgsCheck(p *bpf.ProgramBuilder, rules []Rule, action linux.BPFAc
labelled := false
for i, arg := range rule {
if arg != nil {
// Break out early if using MatchAny since no further
// Break out early if using AnyValue since no further
// instructions are required.
if _, ok := arg.(MatchAny); ok {
if _, ok := arg.(AnyValue); ok {
continue
}
pkg/seccomp/seccomp_rules.go
+9 -9
View File
@@ -44,10 +44,10 @@ func seccompDataOffsetArgHigh(i int) uint32 {
return seccompDataOffsetArgLow(i) + 4
}
// MatchAny is marker to indicate any value will be accepted.
type MatchAny struct{}
// AnyValue is marker to indicate any value will be accepted.
type AnyValue struct{}
func (a MatchAny) String() (s string) {
func (a AnyValue) String() (s string) {
return "*"
}
@@ -147,11 +147,11 @@ func (r Rule) String() (s string) {
// rules := SyscallRules{
// syscall.SYS_FUTEX: []Rule{
// {
// MatchAny{},
// AnyValue{},
// EqualTo(linux.FUTEX_WAIT | linux.FUTEX_PRIVATE_FLAG),
// }, // OR
// {
// MatchAny{},
// AnyValue{},
// EqualTo(linux.FUTEX_WAKE | linux.FUTEX_PRIVATE_FLAG),
// },
// },
@@ -202,15 +202,15 @@ func (sr SyscallRules) Merge(rules SyscallRules) {
var DenyNewExecMappings = SyscallRules{
unix.SYS_MMAP: []Rule{
{
MatchAny{},
MatchAny{},
AnyValue{},
AnyValue{},
MaskedEqual(unix.PROT_EXEC, unix.PROT_EXEC),
},
},
unix.SYS_MPROTECT: []Rule{
{
MatchAny{},
MatchAny{},
AnyValue{},
AnyValue{},
MaskedEqual(unix.PROT_EXEC, unix.PROT_EXEC),
},
},
pkg/seccomp/seccomp_test.go
+1 -1
View File
@@ -257,7 +257,7 @@ func TestBasic(t *testing.T) {
Rules: SyscallRules{
1: []Rule{
{
MatchAny{},
AnyValue{},
EqualTo(0xf),
},
},
pkg/sentry/devices/accel/seccomp_filters.go
+7 -7
View File
@@ -32,9 +32,9 @@ func Filters() seccomp.SyscallRules {
// absolute paths) to hedge against bugs involving AT_FDCWD or
// real dirfds.
seccomp.EqualTo(^uintptr(0)),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.MaskedEqual(unix.O_CREAT|unix.O_NOFOLLOW, unix.O_NOFOLLOW),
seccomp.MatchAny{},
seccomp.AnyValue{},
},
},
unix.SYS_GETDENTS64: {},
@@ -94,21 +94,21 @@ func Filters() seccomp.SyscallRules {
},
unix.SYS_EVENTFD2: []seccomp.Rule{
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.EFD_NONBLOCK),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.EFD_NONBLOCK | linux.EFD_SEMAPHORE),
},
},
unix.SYS_MREMAP: []seccomp.Rule{
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(0), /* old_size */
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.MREMAP_MAYMOVE | linux.MREMAP_FIXED),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(0),
},
},
pkg/sentry/devices/nvproxy/seccomp_filters.go
+5 -5
View File
@@ -33,9 +33,9 @@ func Filters() seccomp.SyscallRules {
// absolute paths) to hedge against bugs involving AT_FDCWD or
// real dirfds.
seccomp.EqualTo(^uintptr(0)),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.MaskedEqual(unix.O_NOFOLLOW|unix.O_CREAT, unix.O_NOFOLLOW),
seccomp.MatchAny{},
seccomp.AnyValue{},
},
},
unix.SYS_IOCTL: []seccomp.Rule{
@@ -178,11 +178,11 @@ func Filters() seccomp.SyscallRules {
},
unix.SYS_MREMAP: []seccomp.Rule{
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(0), /* old_size */
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.MREMAP_MAYMOVE | linux.MREMAP_FIXED),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(0),
},
},
pkg/sentry/platform/kvm/filters.go
+4 -4
View File
@@ -27,19 +27,19 @@ func (k *KVM) SyscallFilters() seccomp.SyscallRules {
r.Merge(seccomp.SyscallRules{
unix.SYS_IOCTL: []seccomp.Rule{
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(KVM_RUN),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(KVM_SET_USER_MEMORY_REGION),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(KVM_GET_REGS),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(KVM_SET_REGS),
},
},
pkg/sentry/platform/kvm/filters_amd64.go
+3 -3
View File
@@ -35,15 +35,15 @@ func (k *KVM) archSyscallFilters() seccomp.SyscallRules {
},
unix.SYS_IOCTL: []seccomp.Rule{
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(KVM_INTERRUPT),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(KVM_NMI),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(KVM_GET_REGS),
},
},
pkg/sentry/platform/kvm/filters_arm64.go
+1 -1
View File
@@ -29,7 +29,7 @@ func (*KVM) archSyscallFilters() seccomp.SyscallRules {
return seccomp.SyscallRules{
unix.SYS_IOCTL: {
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(KVM_SET_VCPU_EVENTS),
},
},
pkg/sentry/platform/kvm/machine.go
+2 -2
View File
@@ -783,8 +783,8 @@ func seccompMmapRules(m *machine) {
Rules: seccomp.SyscallRules{
unix.SYS_MMAP: {
{
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.MaskedEqual(unix.PROT_EXEC, 0),
/* MAP_DENYWRITE is ignored and used only for filtering. */
seccomp.MaskedEqual(unix.MAP_DENYWRITE, 0),
pkg/sentry/platform/ptrace/subprocess_linux.go
+1 -1
View File
@@ -106,7 +106,7 @@ func attachedThread(flags uintptr, defaultAction linux.BPFAction) (*thread, erro
// For the stub to stop itself (all).
unix.SYS_GETPID: {},
unix.SYS_KILL: []seccomp.Rule{
{seccomp.MatchAny{}, seccomp.EqualTo(unix.SIGSTOP)},
{seccomp.AnyValue{}, seccomp.EqualTo(unix.SIGSTOP)},
},
// Injected to support the address space operations.
pkg/sentry/platform/systrap/filters.go
+7 -7
View File
@@ -29,7 +29,7 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules {
},
{
seccomp.EqualTo(unix.PTRACE_CONT),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(0),
seccomp.EqualTo(0),
},
@@ -38,7 +38,7 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules {
},
{
seccomp.EqualTo(unix.PTRACE_GETREGSET),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.NT_PRSTATUS),
},
{
@@ -46,23 +46,23 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules {
},
{
seccomp.EqualTo(unix.PTRACE_SETOPTIONS),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(0),
seccomp.EqualTo(unix.PTRACE_O_TRACESYSGOOD | unix.PTRACE_O_TRACEEXIT | unix.PTRACE_O_EXITKILL),
},
{
seccomp.EqualTo(unix.PTRACE_SETREGSET),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.NT_PRSTATUS),
},
{
seccomp.EqualTo(linux.PTRACE_SETSIGMASK),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(8),
},
{
seccomp.EqualTo(unix.PTRACE_SYSEMU),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(0),
seccomp.EqualTo(0),
},
@@ -75,7 +75,7 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules {
unix.SYS_SETPRIORITY: {
{
seccomp.EqualTo(unix.PRIO_PROCESS),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(sysmsgThreadPriority),
},
},
pkg/sentry/platform/systrap/filters_arm64.go
+2 -2
View File
@@ -29,12 +29,12 @@ func (*Systrap) archSyscallFilters() seccomp.SyscallRules {
unix.SYS_PTRACE: {
{
seccomp.EqualTo(unix.PTRACE_GETREGSET),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.NT_ARM_TLS),
},
{
seccomp.EqualTo(unix.PTRACE_SETREGSET),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.NT_ARM_TLS),
},
},
pkg/sentry/platform/systrap/subprocess_linux.go
+9 -9
View File
@@ -88,7 +88,7 @@ func attachedThread(flags uintptr, defaultAction linux.BPFAction) (*thread, erro
// For the stub to stop itself (all).
unix.SYS_GETPID: {},
unix.SYS_KILL: []seccomp.Rule{
{seccomp.MatchAny{}, seccomp.EqualTo(unix.SIGSTOP)},
{seccomp.AnyValue{}, seccomp.EqualTo(unix.SIGSTOP)},
},
// Injected to support the address space operations.
@@ -100,25 +100,25 @@ func attachedThread(flags uintptr, defaultAction linux.BPFAction) (*thread, erro
unix.SYS_SCHED_YIELD: {},
unix.SYS_FUTEX: {
seccomp.Rule{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.FUTEX_WAIT),
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.AnyValue{},
},
seccomp.Rule{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(linux.FUTEX_WAKE),
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.AnyValue{},
},
},
unix.SYS_SIGALTSTACK: {},
unix.SYS_TKILL: {
{seccomp.MatchAny{}, seccomp.EqualTo(unix.SIGSTOP)},
{seccomp.AnyValue{}, seccomp.EqualTo(unix.SIGSTOP)},
},
unix.SYS_GETTID: {},
seccomp.SYS_SECCOMP: {
{seccomp.EqualTo(linux.SECCOMP_SET_MODE_FILTER), seccomp.EqualTo(0), seccomp.MatchAny{}},
{seccomp.EqualTo(linux.SECCOMP_SET_MODE_FILTER), seccomp.EqualTo(0), seccomp.AnyValue{}},
},
},
Action: linux.SECCOMP_RET_ALLOW,
pkg/sentry/platform/systrap/sysmsg_thread.go
+13 -13
View File
@@ -117,7 +117,7 @@ func sysmsgThreadRules(stubStart uintptr) []bpf.Instruction {
{
seccomp.GreaterThan(stubStart),
seccomp.EqualTo(linux.FUTEX_WAIT),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(0),
seccomp.EqualTo(0),
seccomp.EqualTo(0),
@@ -126,23 +126,23 @@ func sysmsgThreadRules(stubStart uintptr) []bpf.Instruction {
},
unix.SYS_RT_SIGRETURN: {
{
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.GreaterThan(stubStart), // rip
},
},
unix.SYS_SCHED_YIELD: {
{
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.GreaterThan(stubStart), // rip
},
},
pkg/sentry/platform/systrap/sysmsg_thread_amd64.go
+10 -10
View File
@@ -37,20 +37,20 @@ func appendSysThreadArchSeccompRules(rules []seccomp.RuleSet) []seccomp.RuleSet
unix.SYS_ARCH_PRCTL: {
{
seccomp.EqualTo(linux.ARCH_SET_FS),
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.GreaterThan(stubStart), // rip
},
{
seccomp.EqualTo(linux.ARCH_GET_FS),
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.GreaterThan(stubStart), // rip
},
},
runsc/boot/filter/config.go
+117 -117
View File
File diff suppressed because it is too large Load Diff
runsc/boot/filter/config_amd64.go
+2 -2
View File
@@ -35,10 +35,10 @@ func init() {
unix.CLONE_SIGHAND |
unix.CLONE_SYSVSEM |
unix.CLONE_THREAD),
seccomp.MatchAny{}, // newsp
seccomp.AnyValue{}, // newsp
seccomp.EqualTo(0), // parent_tidptr
seccomp.EqualTo(0), // child_tidptr
seccomp.MatchAny{}, // tls
seccomp.AnyValue{}, // tls
},
}
}
runsc/boot/filter/config_arm64.go
+4 -4
View File
@@ -32,13 +32,13 @@ func init() {
unix.CLONE_SIGHAND |
unix.CLONE_SYSVSEM |
unix.CLONE_THREAD),
seccomp.MatchAny{}, // newsp
seccomp.AnyValue{}, // newsp
// These arguments are left uninitialized by the Go
// runtime, so they may be anything (and are unused by
// the host).
seccomp.MatchAny{}, // parent_tidptr
seccomp.MatchAny{}, // tls
seccomp.MatchAny{}, // child_tidptr
seccomp.AnyValue{}, // parent_tidptr
seccomp.AnyValue{}, // tls
seccomp.AnyValue{}, // child_tidptr
},
}
}
runsc/boot/filter/config_profile.go
+2 -2
View File
@@ -27,8 +27,8 @@ func profileFilters() seccomp.SyscallRules {
return seccomp.SyscallRules{
unix.SYS_OPENAT: []seccomp.Rule{
{
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.O_RDONLY | unix.O_LARGEFILE | unix.O_CLOEXEC),
},
},
runsc/boot/filter/extra_filters_hostinet.go
+21 -21
View File
@@ -26,9 +26,9 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules {
rules := seccomp.SyscallRules{
unix.SYS_ACCEPT4: []seccomp.Rule{
{
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC),
},
},
@@ -38,43 +38,43 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules {
unix.SYS_GETSOCKNAME: {},
unix.SYS_IOCTL: []seccomp.Rule{
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SIOCGIFCONF),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SIOCETHTOOL),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SIOCGIFFLAGS),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SIOCGIFHWADDR),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SIOCGIFINDEX),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SIOCGIFMTU),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SIOCGIFNAME),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SIOCGIFNETMASK),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.TIOCOUTQ),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.TIOCINQ),
},
},
@@ -86,15 +86,15 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules {
unix.SYS_SENDTO: {},
unix.SYS_SHUTDOWN: []seccomp.Rule{
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SHUT_RD),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SHUT_WR),
},
{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(unix.SHUT_RDWR),
},
},
@@ -137,7 +137,7 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules {
}
if sock.Protocol == hostinet.AllowAllProtocols {
// Change protocol filter to MatchAny.
rule[2] = seccomp.MatchAny{}
rule[2] = seccomp.AnyValue{}
}
socketRules = append(socketRules, rule)
}
@@ -151,7 +151,7 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules {
for _, opt := range hostinet.SockOpts {
if opt.AllowGet {
getSockOptRules = append(getSockOptRules, seccomp.Rule{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(opt.Level),
seccomp.EqualTo(opt.Name),
})
@@ -159,15 +159,15 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules {
if opt.AllowSet {
if opt.Size > 0 {
setSockOptRules = append(setSockOptRules, seccomp.Rule{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(opt.Level),
seccomp.EqualTo(opt.Name),
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(opt.Size),
})
} else {
setSockOptRules = append(setSockOptRules, seccomp.Rule{
seccomp.MatchAny{},
seccomp.AnyValue{},
seccomp.EqualTo(opt.Level),
seccomp.EqualTo(opt.Name),
})

Some files were not shown because too many files have changed in this diff Show More