diff --git a/pkg/seccomp/seccomp.go b/pkg/seccomp/seccomp.go index c0879e6f9..24f07dfc0 100644 --- a/pkg/seccomp/seccomp.go +++ b/pkg/seccomp/seccomp.go @@ -242,9 +242,9 @@ func addSyscallArgsCheck(p *bpf.ProgramBuilder, rules []Rule, action linux.BPFAc labelled := false for i, arg := range rule { if arg != nil { - // Break out early if using MatchAny since no further + // Break out early if using AnyValue since no further // instructions are required. - if _, ok := arg.(MatchAny); ok { + if _, ok := arg.(AnyValue); ok { continue } diff --git a/pkg/seccomp/seccomp_rules.go b/pkg/seccomp/seccomp_rules.go index 02ab30741..99c494e0c 100644 --- a/pkg/seccomp/seccomp_rules.go +++ b/pkg/seccomp/seccomp_rules.go @@ -44,10 +44,10 @@ func seccompDataOffsetArgHigh(i int) uint32 { return seccompDataOffsetArgLow(i) + 4 } -// MatchAny is marker to indicate any value will be accepted. -type MatchAny struct{} +// AnyValue is marker to indicate any value will be accepted. +type AnyValue struct{} -func (a MatchAny) String() (s string) { +func (a AnyValue) String() (s string) { return "*" } @@ -147,11 +147,11 @@ func (r Rule) String() (s string) { // rules := SyscallRules{ // syscall.SYS_FUTEX: []Rule{ // { -// MatchAny{}, +// AnyValue{}, // EqualTo(linux.FUTEX_WAIT | linux.FUTEX_PRIVATE_FLAG), // }, // OR // { -// MatchAny{}, +// AnyValue{}, // EqualTo(linux.FUTEX_WAKE | linux.FUTEX_PRIVATE_FLAG), // }, // }, @@ -202,15 +202,15 @@ func (sr SyscallRules) Merge(rules SyscallRules) { var DenyNewExecMappings = SyscallRules{ unix.SYS_MMAP: []Rule{ { - MatchAny{}, - MatchAny{}, + AnyValue{}, + AnyValue{}, MaskedEqual(unix.PROT_EXEC, unix.PROT_EXEC), }, }, unix.SYS_MPROTECT: []Rule{ { - MatchAny{}, - MatchAny{}, + AnyValue{}, + AnyValue{}, MaskedEqual(unix.PROT_EXEC, unix.PROT_EXEC), }, }, diff --git a/pkg/seccomp/seccomp_test.go b/pkg/seccomp/seccomp_test.go index c547e5ccf..169077cc6 100644 --- a/pkg/seccomp/seccomp_test.go +++ b/pkg/seccomp/seccomp_test.go @@ -257,7 +257,7 @@ func TestBasic(t *testing.T) { Rules: SyscallRules{ 1: []Rule{ { - MatchAny{}, + AnyValue{}, EqualTo(0xf), }, }, diff --git a/pkg/sentry/devices/accel/seccomp_filters.go b/pkg/sentry/devices/accel/seccomp_filters.go index 8d4470c7e..488778fd7 100644 --- a/pkg/sentry/devices/accel/seccomp_filters.go +++ b/pkg/sentry/devices/accel/seccomp_filters.go @@ -32,9 +32,9 @@ func Filters() seccomp.SyscallRules { // absolute paths) to hedge against bugs involving AT_FDCWD or // real dirfds. seccomp.EqualTo(^uintptr(0)), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.MaskedEqual(unix.O_CREAT|unix.O_NOFOLLOW, unix.O_NOFOLLOW), - seccomp.MatchAny{}, + seccomp.AnyValue{}, }, }, unix.SYS_GETDENTS64: {}, @@ -94,21 +94,21 @@ func Filters() seccomp.SyscallRules { }, unix.SYS_EVENTFD2: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.EFD_NONBLOCK), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.EFD_NONBLOCK | linux.EFD_SEMAPHORE), }, }, unix.SYS_MREMAP: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), /* old_size */ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.MREMAP_MAYMOVE | linux.MREMAP_FIXED), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), }, }, diff --git a/pkg/sentry/devices/nvproxy/seccomp_filters.go b/pkg/sentry/devices/nvproxy/seccomp_filters.go index 6988dab54..fcf1fc1c8 100644 --- a/pkg/sentry/devices/nvproxy/seccomp_filters.go +++ b/pkg/sentry/devices/nvproxy/seccomp_filters.go @@ -33,9 +33,9 @@ func Filters() seccomp.SyscallRules { // absolute paths) to hedge against bugs involving AT_FDCWD or // real dirfds. seccomp.EqualTo(^uintptr(0)), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.MaskedEqual(unix.O_NOFOLLOW|unix.O_CREAT, unix.O_NOFOLLOW), - seccomp.MatchAny{}, + seccomp.AnyValue{}, }, }, unix.SYS_IOCTL: []seccomp.Rule{ @@ -178,11 +178,11 @@ func Filters() seccomp.SyscallRules { }, unix.SYS_MREMAP: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), /* old_size */ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.MREMAP_MAYMOVE | linux.MREMAP_FIXED), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), }, }, diff --git a/pkg/sentry/platform/kvm/filters.go b/pkg/sentry/platform/kvm/filters.go index 6dd917958..7fe56cf73 100644 --- a/pkg/sentry/platform/kvm/filters.go +++ b/pkg/sentry/platform/kvm/filters.go @@ -27,19 +27,19 @@ func (k *KVM) SyscallFilters() seccomp.SyscallRules { r.Merge(seccomp.SyscallRules{ unix.SYS_IOCTL: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(KVM_RUN), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(KVM_SET_USER_MEMORY_REGION), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(KVM_GET_REGS), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(KVM_SET_REGS), }, }, diff --git a/pkg/sentry/platform/kvm/filters_amd64.go b/pkg/sentry/platform/kvm/filters_amd64.go index 1f9e60bfe..506ba981c 100644 --- a/pkg/sentry/platform/kvm/filters_amd64.go +++ b/pkg/sentry/platform/kvm/filters_amd64.go @@ -35,15 +35,15 @@ func (k *KVM) archSyscallFilters() seccomp.SyscallRules { }, unix.SYS_IOCTL: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(KVM_INTERRUPT), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(KVM_NMI), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(KVM_GET_REGS), }, }, diff --git a/pkg/sentry/platform/kvm/filters_arm64.go b/pkg/sentry/platform/kvm/filters_arm64.go index df7c5dd8c..77c651fb2 100644 --- a/pkg/sentry/platform/kvm/filters_arm64.go +++ b/pkg/sentry/platform/kvm/filters_arm64.go @@ -29,7 +29,7 @@ func (*KVM) archSyscallFilters() seccomp.SyscallRules { return seccomp.SyscallRules{ unix.SYS_IOCTL: { { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(KVM_SET_VCPU_EVENTS), }, }, diff --git a/pkg/sentry/platform/kvm/machine.go b/pkg/sentry/platform/kvm/machine.go index b675bc496..d1163b23b 100644 --- a/pkg/sentry/platform/kvm/machine.go +++ b/pkg/sentry/platform/kvm/machine.go @@ -783,8 +783,8 @@ func seccompMmapRules(m *machine) { Rules: seccomp.SyscallRules{ unix.SYS_MMAP: { { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.MaskedEqual(unix.PROT_EXEC, 0), /* MAP_DENYWRITE is ignored and used only for filtering. */ seccomp.MaskedEqual(unix.MAP_DENYWRITE, 0), diff --git a/pkg/sentry/platform/ptrace/subprocess_linux.go b/pkg/sentry/platform/ptrace/subprocess_linux.go index 80ce18d81..a73a3d143 100644 --- a/pkg/sentry/platform/ptrace/subprocess_linux.go +++ b/pkg/sentry/platform/ptrace/subprocess_linux.go @@ -106,7 +106,7 @@ func attachedThread(flags uintptr, defaultAction linux.BPFAction) (*thread, erro // For the stub to stop itself (all). unix.SYS_GETPID: {}, unix.SYS_KILL: []seccomp.Rule{ - {seccomp.MatchAny{}, seccomp.EqualTo(unix.SIGSTOP)}, + {seccomp.AnyValue{}, seccomp.EqualTo(unix.SIGSTOP)}, }, // Injected to support the address space operations. diff --git a/pkg/sentry/platform/systrap/filters.go b/pkg/sentry/platform/systrap/filters.go index fc8222cfb..fb33d7181 100644 --- a/pkg/sentry/platform/systrap/filters.go +++ b/pkg/sentry/platform/systrap/filters.go @@ -29,7 +29,7 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules { }, { seccomp.EqualTo(unix.PTRACE_CONT), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), seccomp.EqualTo(0), }, @@ -38,7 +38,7 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules { }, { seccomp.EqualTo(unix.PTRACE_GETREGSET), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.NT_PRSTATUS), }, { @@ -46,23 +46,23 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules { }, { seccomp.EqualTo(unix.PTRACE_SETOPTIONS), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), seccomp.EqualTo(unix.PTRACE_O_TRACESYSGOOD | unix.PTRACE_O_TRACEEXIT | unix.PTRACE_O_EXITKILL), }, { seccomp.EqualTo(unix.PTRACE_SETREGSET), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.NT_PRSTATUS), }, { seccomp.EqualTo(linux.PTRACE_SETSIGMASK), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(8), }, { seccomp.EqualTo(unix.PTRACE_SYSEMU), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), seccomp.EqualTo(0), }, @@ -75,7 +75,7 @@ func (p *Systrap) SyscallFilters() seccomp.SyscallRules { unix.SYS_SETPRIORITY: { { seccomp.EqualTo(unix.PRIO_PROCESS), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(sysmsgThreadPriority), }, }, diff --git a/pkg/sentry/platform/systrap/filters_arm64.go b/pkg/sentry/platform/systrap/filters_arm64.go index a292958c5..b14698d82 100644 --- a/pkg/sentry/platform/systrap/filters_arm64.go +++ b/pkg/sentry/platform/systrap/filters_arm64.go @@ -29,12 +29,12 @@ func (*Systrap) archSyscallFilters() seccomp.SyscallRules { unix.SYS_PTRACE: { { seccomp.EqualTo(unix.PTRACE_GETREGSET), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.NT_ARM_TLS), }, { seccomp.EqualTo(unix.PTRACE_SETREGSET), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.NT_ARM_TLS), }, }, diff --git a/pkg/sentry/platform/systrap/subprocess_linux.go b/pkg/sentry/platform/systrap/subprocess_linux.go index dda3d8281..bb112ec40 100644 --- a/pkg/sentry/platform/systrap/subprocess_linux.go +++ b/pkg/sentry/platform/systrap/subprocess_linux.go @@ -88,7 +88,7 @@ func attachedThread(flags uintptr, defaultAction linux.BPFAction) (*thread, erro // For the stub to stop itself (all). unix.SYS_GETPID: {}, unix.SYS_KILL: []seccomp.Rule{ - {seccomp.MatchAny{}, seccomp.EqualTo(unix.SIGSTOP)}, + {seccomp.AnyValue{}, seccomp.EqualTo(unix.SIGSTOP)}, }, // Injected to support the address space operations. @@ -100,25 +100,25 @@ func attachedThread(flags uintptr, defaultAction linux.BPFAction) (*thread, erro unix.SYS_SCHED_YIELD: {}, unix.SYS_FUTEX: { seccomp.Rule{ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAIT), - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, seccomp.Rule{ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAKE), - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, unix.SYS_SIGALTSTACK: {}, unix.SYS_TKILL: { - {seccomp.MatchAny{}, seccomp.EqualTo(unix.SIGSTOP)}, + {seccomp.AnyValue{}, seccomp.EqualTo(unix.SIGSTOP)}, }, unix.SYS_GETTID: {}, seccomp.SYS_SECCOMP: { - {seccomp.EqualTo(linux.SECCOMP_SET_MODE_FILTER), seccomp.EqualTo(0), seccomp.MatchAny{}}, + {seccomp.EqualTo(linux.SECCOMP_SET_MODE_FILTER), seccomp.EqualTo(0), seccomp.AnyValue{}}, }, }, Action: linux.SECCOMP_RET_ALLOW, diff --git a/pkg/sentry/platform/systrap/sysmsg_thread.go b/pkg/sentry/platform/systrap/sysmsg_thread.go index 4472a5d69..3642d5aca 100644 --- a/pkg/sentry/platform/systrap/sysmsg_thread.go +++ b/pkg/sentry/platform/systrap/sysmsg_thread.go @@ -117,7 +117,7 @@ func sysmsgThreadRules(stubStart uintptr) []bpf.Instruction { { seccomp.GreaterThan(stubStart), seccomp.EqualTo(linux.FUTEX_WAIT), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), seccomp.EqualTo(0), seccomp.EqualTo(0), @@ -126,23 +126,23 @@ func sysmsgThreadRules(stubStart uintptr) []bpf.Instruction { }, unix.SYS_RT_SIGRETURN: { { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.GreaterThan(stubStart), // rip }, }, unix.SYS_SCHED_YIELD: { { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.GreaterThan(stubStart), // rip }, }, diff --git a/pkg/sentry/platform/systrap/sysmsg_thread_amd64.go b/pkg/sentry/platform/systrap/sysmsg_thread_amd64.go index 13aa17201..3af671e6a 100644 --- a/pkg/sentry/platform/systrap/sysmsg_thread_amd64.go +++ b/pkg/sentry/platform/systrap/sysmsg_thread_amd64.go @@ -37,20 +37,20 @@ func appendSysThreadArchSeccompRules(rules []seccomp.RuleSet) []seccomp.RuleSet unix.SYS_ARCH_PRCTL: { { seccomp.EqualTo(linux.ARCH_SET_FS), - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.GreaterThan(stubStart), // rip }, { seccomp.EqualTo(linux.ARCH_GET_FS), - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.GreaterThan(stubStart), // rip }, }, diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go index 9fb0f11d7..b63098f81 100644 --- a/runsc/boot/filter/config.go +++ b/runsc/boot/filter/config.go @@ -30,8 +30,8 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_DUP: {}, unix.SYS_DUP3: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.O_CLOEXEC), }, }, @@ -39,10 +39,10 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_EPOLL_CTL: {}, unix.SYS_EPOLL_PWAIT: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), }, }, @@ -58,15 +58,15 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_FCHMOD: {}, unix.SYS_FCNTL: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.F_GETFL), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.F_SETFL), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.F_GETFD), }, }, @@ -75,35 +75,35 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_FTRUNCATE: {}, unix.SYS_FUTEX: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAIT | linux.FUTEX_PRIVATE_FLAG), - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAKE | linux.FUTEX_PRIVATE_FLAG), - seccomp.MatchAny{}, + seccomp.AnyValue{}, }, // Non-private variants are included for flipcall support. They are otherwise // unncessary, as the sentry will use only private futexes internally. { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAIT), - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAKE), - seccomp.MatchAny{}, + seccomp.AnyValue{}, }, }, // getcpu is used by some versions of the Go runtime and by the hostcpu // package on arm64. unix.SYS_GETCPU: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), seccomp.EqualTo(0), }, @@ -112,22 +112,22 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_GETRANDOM: {}, unix.SYS_GETSOCKOPT: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SOL_SOCKET), seccomp.EqualTo(unix.SO_DOMAIN), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SOL_SOCKET), seccomp.EqualTo(unix.SO_TYPE), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SOL_SOCKET), seccomp.EqualTo(unix.SO_ERROR), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SOL_SOCKET), seccomp.EqualTo(unix.SO_SNDBUF), }, @@ -137,46 +137,46 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_IOCTL: []seccomp.Rule{ // These commands are needed for host FD. { - seccomp.MatchAny{}, /* fd */ + seccomp.AnyValue{}, /* fd */ seccomp.EqualTo(linux.FIONREAD), - seccomp.MatchAny{}, /* int* */ + seccomp.AnyValue{}, /* int* */ }, // These commands are needed for terminal support, but we only allow // setting/getting termios and winsize. { - seccomp.MatchAny{}, /* fd */ + seccomp.AnyValue{}, /* fd */ seccomp.EqualTo(linux.TCGETS), - seccomp.MatchAny{}, /* termios struct */ + seccomp.AnyValue{}, /* termios struct */ }, { - seccomp.MatchAny{}, /* fd */ + seccomp.AnyValue{}, /* fd */ seccomp.EqualTo(linux.TCSETS), - seccomp.MatchAny{}, /* termios struct */ + seccomp.AnyValue{}, /* termios struct */ }, { - seccomp.MatchAny{}, /* fd */ + seccomp.AnyValue{}, /* fd */ seccomp.EqualTo(linux.TCSETSF), - seccomp.MatchAny{}, /* termios struct */ + seccomp.AnyValue{}, /* termios struct */ }, { - seccomp.MatchAny{}, /* fd */ + seccomp.AnyValue{}, /* fd */ seccomp.EqualTo(linux.TCSETSW), - seccomp.MatchAny{}, /* termios struct */ + seccomp.AnyValue{}, /* termios struct */ }, { - seccomp.MatchAny{}, /* fd */ + seccomp.AnyValue{}, /* fd */ seccomp.EqualTo(linux.TIOCSWINSZ), - seccomp.MatchAny{}, /* winsize struct */ + seccomp.AnyValue{}, /* winsize struct */ }, { - seccomp.MatchAny{}, /* fd */ + seccomp.AnyValue{}, /* fd */ seccomp.EqualTo(linux.TIOCGWINSZ), - seccomp.MatchAny{}, /* winsize struct */ + seccomp.AnyValue{}, /* winsize struct */ }, { - seccomp.MatchAny{}, /* fd */ + seccomp.AnyValue{}, /* fd */ seccomp.EqualTo(linux.SIOCGIFTXQLEN), - seccomp.MatchAny{}, /* ifreq struct */ + seccomp.AnyValue{}, /* ifreq struct */ }, }, unix.SYS_LSEEK: {}, @@ -191,44 +191,44 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_MLOCK: {}, unix.SYS_MMAP: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MAP_SHARED), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MAP_SHARED | unix.MAP_FIXED), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MAP_PRIVATE), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MAP_PRIVATE | unix.MAP_ANONYMOUS), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MAP_PRIVATE | unix.MAP_ANONYMOUS | unix.MAP_STACK), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MAP_PRIVATE | unix.MAP_ANONYMOUS | unix.MAP_NORESERVE), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.PROT_WRITE | unix.PROT_READ), seccomp.EqualTo(unix.MAP_PRIVATE | unix.MAP_ANONYMOUS | unix.MAP_FIXED), }, @@ -247,20 +247,20 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_READ: {}, unix.SYS_RECVMSG: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MSG_DONTWAIT | unix.MSG_TRUNC), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MSG_DONTWAIT | unix.MSG_TRUNC | unix.MSG_PEEK), }, }, unix.SYS_RECVMMSG: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(fdbased.MaxMsgsPerRecv), seccomp.EqualTo(unix.MSG_DONTWAIT), seccomp.EqualTo(0), @@ -268,9 +268,9 @@ var allowedSyscalls = seccomp.SyscallRules{ }, unix.SYS_SENDMMSG: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MSG_DONTWAIT), }, }, @@ -281,26 +281,26 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_SCHED_YIELD: {}, unix.SYS_SENDMSG: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MSG_DONTWAIT | unix.MSG_NOSIGNAL), }, }, unix.SYS_SETITIMER: {}, unix.SYS_SHUTDOWN: []seccomp.Rule{ // Used by fs/host to shutdown host sockets. - {seccomp.MatchAny{}, seccomp.EqualTo(unix.SHUT_RD)}, - {seccomp.MatchAny{}, seccomp.EqualTo(unix.SHUT_WR)}, + {seccomp.AnyValue{}, seccomp.EqualTo(unix.SHUT_RD)}, + {seccomp.AnyValue{}, seccomp.EqualTo(unix.SHUT_WR)}, // Used by unet to shutdown connections. - {seccomp.MatchAny{}, seccomp.EqualTo(unix.SHUT_RDWR)}, + {seccomp.AnyValue{}, seccomp.EqualTo(unix.SHUT_RDWR)}, }, unix.SYS_SIGALTSTACK: {}, unix.SYS_STATX: {}, unix.SYS_SYNC_FILE_RANGE: {}, unix.SYS_TEE: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(1), /* len */ seccomp.EqualTo(unix.SPLICE_F_NONBLOCK), /* flags */ }, @@ -308,16 +308,16 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_TIMER_CREATE: []seccomp.Rule{ { seccomp.EqualTo(unix.CLOCK_THREAD_CPUTIME_ID), /* which */ - seccomp.MatchAny{}, /* sevp */ - seccomp.MatchAny{}, /* timerid */ + seccomp.AnyValue{}, /* sevp */ + seccomp.AnyValue{}, /* timerid */ }, }, unix.SYS_TIMER_DELETE: []seccomp.Rule{}, unix.SYS_TIMER_SETTIME: []seccomp.Rule{ { - seccomp.MatchAny{}, /* timerid */ + seccomp.AnyValue{}, /* timerid */ seccomp.EqualTo(0), /* flags */ - seccomp.MatchAny{}, /* new_value */ + seccomp.AnyValue{}, /* new_value */ seccomp.EqualTo(0), /* old_value */ }, }, @@ -328,9 +328,9 @@ var allowedSyscalls = seccomp.SyscallRules{ }, unix.SYS_UTIMENSAT: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), /* null pathname */ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), /* flags */ }, }, @@ -338,8 +338,8 @@ var allowedSyscalls = seccomp.SyscallRules{ // For rawfile.NonBlockingWriteIovec. unix.SYS_WRITEV: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.GreaterThan(0), }, }, @@ -360,7 +360,7 @@ func controlServerFilters(fd int) seccomp.SyscallRules { }, unix.SYS_GETSOCKOPT: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SOL_SOCKET), seccomp.EqualTo(unix.SO_PEERCRED), }, @@ -379,108 +379,108 @@ func hostFilesystemFilters() seccomp.SyscallRules { unix.SYS_FCHOWNAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.AT_EMPTY_PATH | unix.AT_SYMLINK_NOFOLLOW), }, }, unix.SYS_FCHMODAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, unix.SYS_UNLINKAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, unix.SYS_GETDENTS64: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, unix.SYS_OPENAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.MaskedEqual(unix.O_NOFOLLOW, unix.O_NOFOLLOW), - seccomp.MatchAny{}, + seccomp.AnyValue{}, }, }, unix.SYS_LINKAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, + seccomp.AnyValue{}, validFDCheck, - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), }, }, unix.SYS_MKDIRAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, unix.SYS_MKNODAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, unix.SYS_SYMLINKAT: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, validFDCheck, - seccomp.MatchAny{}, + seccomp.AnyValue{}, }, }, unix.SYS_FSTATFS: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, + seccomp.AnyValue{}, }, }, unix.SYS_READLINKAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, unix.SYS_UTIMENSAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, unix.SYS_RENAMEAT: []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, + seccomp.AnyValue{}, validFDCheck, - seccomp.MatchAny{}, + seccomp.AnyValue{}, }, }, archFstatAtSysNo(): []seccomp.Rule{ { validFDCheck, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, } diff --git a/runsc/boot/filter/config_amd64.go b/runsc/boot/filter/config_amd64.go index f8417a1fa..16cb690ab 100644 --- a/runsc/boot/filter/config_amd64.go +++ b/runsc/boot/filter/config_amd64.go @@ -35,10 +35,10 @@ func init() { unix.CLONE_SIGHAND | unix.CLONE_SYSVSEM | unix.CLONE_THREAD), - seccomp.MatchAny{}, // newsp + seccomp.AnyValue{}, // newsp seccomp.EqualTo(0), // parent_tidptr seccomp.EqualTo(0), // child_tidptr - seccomp.MatchAny{}, // tls + seccomp.AnyValue{}, // tls }, } } diff --git a/runsc/boot/filter/config_arm64.go b/runsc/boot/filter/config_arm64.go index 1e8473e3a..4f9a50dda 100644 --- a/runsc/boot/filter/config_arm64.go +++ b/runsc/boot/filter/config_arm64.go @@ -32,13 +32,13 @@ func init() { unix.CLONE_SIGHAND | unix.CLONE_SYSVSEM | unix.CLONE_THREAD), - seccomp.MatchAny{}, // newsp + seccomp.AnyValue{}, // newsp // These arguments are left uninitialized by the Go // runtime, so they may be anything (and are unused by // the host). - seccomp.MatchAny{}, // parent_tidptr - seccomp.MatchAny{}, // tls - seccomp.MatchAny{}, // child_tidptr + seccomp.AnyValue{}, // parent_tidptr + seccomp.AnyValue{}, // tls + seccomp.AnyValue{}, // child_tidptr }, } } diff --git a/runsc/boot/filter/config_profile.go b/runsc/boot/filter/config_profile.go index 214bf8b1d..9b4b6c4bc 100644 --- a/runsc/boot/filter/config_profile.go +++ b/runsc/boot/filter/config_profile.go @@ -27,8 +27,8 @@ func profileFilters() seccomp.SyscallRules { return seccomp.SyscallRules{ unix.SYS_OPENAT: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.O_RDONLY | unix.O_LARGEFILE | unix.O_CLOEXEC), }, }, diff --git a/runsc/boot/filter/extra_filters_hostinet.go b/runsc/boot/filter/extra_filters_hostinet.go index 19cb542e0..0c48da16d 100644 --- a/runsc/boot/filter/extra_filters_hostinet.go +++ b/runsc/boot/filter/extra_filters_hostinet.go @@ -26,9 +26,9 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules { rules := seccomp.SyscallRules{ unix.SYS_ACCEPT4: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), }, }, @@ -38,43 +38,43 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules { unix.SYS_GETSOCKNAME: {}, unix.SYS_IOCTL: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SIOCGIFCONF), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SIOCETHTOOL), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SIOCGIFFLAGS), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SIOCGIFHWADDR), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SIOCGIFINDEX), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SIOCGIFMTU), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SIOCGIFNAME), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SIOCGIFNETMASK), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.TIOCOUTQ), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.TIOCINQ), }, }, @@ -86,15 +86,15 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules { unix.SYS_SENDTO: {}, unix.SYS_SHUTDOWN: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SHUT_RD), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SHUT_WR), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.SHUT_RDWR), }, }, @@ -137,7 +137,7 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules { } if sock.Protocol == hostinet.AllowAllProtocols { // Change protocol filter to MatchAny. - rule[2] = seccomp.MatchAny{} + rule[2] = seccomp.AnyValue{} } socketRules = append(socketRules, rule) } @@ -151,7 +151,7 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules { for _, opt := range hostinet.SockOpts { if opt.AllowGet { getSockOptRules = append(getSockOptRules, seccomp.Rule{ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(opt.Level), seccomp.EqualTo(opt.Name), }) @@ -159,15 +159,15 @@ func hostInetFilters(allowRawSockets bool) seccomp.SyscallRules { if opt.AllowSet { if opt.Size > 0 { setSockOptRules = append(setSockOptRules, seccomp.Rule{ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(opt.Level), seccomp.EqualTo(opt.Name), - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(opt.Size), }) } else { setSockOptRules = append(setSockOptRules, seccomp.Rule{ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(opt.Level), seccomp.EqualTo(opt.Name), }) diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go index 9e3db2703..379cfdcc3 100644 --- a/runsc/fsgofer/filter/config.go +++ b/runsc/fsgofer/filter/config.go @@ -31,10 +31,10 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_EPOLL_CTL: {}, unix.SYS_EPOLL_PWAIT: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), }, }, @@ -48,7 +48,7 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_EXIT_GROUP: {}, unix.SYS_FALLOCATE: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), }, }, @@ -57,20 +57,20 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_FCHOWNAT: {}, unix.SYS_FCNTL: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.F_GETFL), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.F_SETFL), }, { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.F_GETFD), }, // Used by flipcall.PacketWindowAllocator.Init(). { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.F_ADD_SEALS), }, }, @@ -80,38 +80,38 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_FTRUNCATE: {}, unix.SYS_FUTEX: { seccomp.Rule{ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAIT | linux.FUTEX_PRIVATE_FLAG), - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), }, seccomp.Rule{ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAKE | linux.FUTEX_PRIVATE_FLAG), - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), }, // Non-private futex used for flipcall. seccomp.Rule{ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAIT), - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, seccomp.Rule{ - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(linux.FUTEX_WAKE), - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, }, }, // getcpu is used by some versions of the Go runtime and by the hostcpu // package on arm64. unix.SYS_GETCPU: []seccomp.Rule{ { - seccomp.MatchAny{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), seccomp.EqualTo(0), }, @@ -129,21 +129,21 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_MKNODAT: {}, unix.SYS_MMAP: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MAP_SHARED), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MAP_PRIVATE | unix.MAP_ANONYMOUS), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MAP_PRIVATE | unix.MAP_ANONYMOUS | unix.MAP_FIXED), }, }, @@ -158,13 +158,13 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_READLINKAT: {}, unix.SYS_RECVMSG: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MSG_DONTWAIT | unix.MSG_TRUNC), }, { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MSG_DONTWAIT | unix.MSG_TRUNC | unix.MSG_PEEK), }, }, @@ -178,19 +178,19 @@ var allowedSyscalls = seccomp.SyscallRules{ unix.SYS_SENDMSG: []seccomp.Rule{ // Used by fdchannel.Endpoint.SendFD(). { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(0), }, // Used by unet.SocketWriter.WriteVec(). { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.MSG_DONTWAIT | unix.MSG_NOSIGNAL), }, }, unix.SYS_SHUTDOWN: []seccomp.Rule{ - {seccomp.MatchAny{}, seccomp.EqualTo(unix.SHUT_RDWR)}, + {seccomp.AnyValue{}, seccomp.EqualTo(unix.SHUT_RDWR)}, }, unix.SYS_SIGALTSTACK: {}, // Used by fdchannel.NewConnectedSockets(). diff --git a/runsc/fsgofer/filter/config_amd64.go b/runsc/fsgofer/filter/config_amd64.go index e0bb95a4d..37daf58d8 100644 --- a/runsc/fsgofer/filter/config_amd64.go +++ b/runsc/fsgofer/filter/config_amd64.go @@ -35,10 +35,10 @@ func init() { unix.CLONE_SIGHAND | unix.CLONE_SYSVSEM | unix.CLONE_THREAD), - seccomp.MatchAny{}, // newsp + seccomp.AnyValue{}, // newsp seccomp.EqualTo(0), // parent_tidptr seccomp.EqualTo(0), // child_tidptr - seccomp.MatchAny{}, // tls + seccomp.AnyValue{}, // tls }, } diff --git a/runsc/fsgofer/filter/config_arm64.go b/runsc/fsgofer/filter/config_arm64.go index ab750c3be..3a7b668cf 100644 --- a/runsc/fsgofer/filter/config_arm64.go +++ b/runsc/fsgofer/filter/config_arm64.go @@ -34,13 +34,13 @@ func init() { unix.CLONE_SIGHAND | unix.CLONE_SYSVSEM | unix.CLONE_THREAD), - seccomp.MatchAny{}, // newsp + seccomp.AnyValue{}, // newsp // These arguments are left uninitialized by the Go // runtime, so they may be anything (and are unused by // the host). - seccomp.MatchAny{}, // parent_tidptr - seccomp.MatchAny{}, // tls - seccomp.MatchAny{}, // child_tidptr + seccomp.AnyValue{}, // parent_tidptr + seccomp.AnyValue{}, // tls + seccomp.AnyValue{}, // child_tidptr }, } diff --git a/runsc/fsgofer/filter/config_profile.go b/runsc/fsgofer/filter/config_profile.go index 358448243..49a416e89 100644 --- a/runsc/fsgofer/filter/config_profile.go +++ b/runsc/fsgofer/filter/config_profile.go @@ -22,8 +22,8 @@ import ( var profileFilters = seccomp.SyscallRules{ unix.SYS_OPENAT: []seccomp.Rule{ { - seccomp.MatchAny{}, - seccomp.MatchAny{}, + seccomp.AnyValue{}, + seccomp.AnyValue{}, seccomp.EqualTo(unix.O_RDONLY | unix.O_LARGEFILE | unix.O_CLOEXEC), }, }, @@ -31,16 +31,16 @@ var profileFilters = seccomp.SyscallRules{ unix.SYS_TIMER_CREATE: []seccomp.Rule{ { seccomp.EqualTo(unix.CLOCK_THREAD_CPUTIME_ID), /* which */ - seccomp.MatchAny{}, /* sevp */ - seccomp.MatchAny{}, /* timerid */ + seccomp.AnyValue{}, /* sevp */ + seccomp.AnyValue{}, /* timerid */ }, }, unix.SYS_TIMER_DELETE: []seccomp.Rule{}, unix.SYS_TIMER_SETTIME: []seccomp.Rule{ { - seccomp.MatchAny{}, /* timerid */ + seccomp.AnyValue{}, /* timerid */ seccomp.EqualTo(0), /* flags */ - seccomp.MatchAny{}, /* new_value */ + seccomp.AnyValue{}, /* new_value */ seccomp.EqualTo(0), /* old_value */ }, },