From e0b9cf05fe137d271b27eed078cd26032ff4b76c Mon Sep 17 00:00:00 2001 From: Nicolas Lacasse Date: Wed, 1 Feb 2023 11:24:25 -0800 Subject: [PATCH] Move hostinet seccomp filters into their own file. The list is getting pretty long, and this is similar to how we handle all the other "extra" filters that can be installed. PiperOrigin-RevId: 506372912 --- runsc/boot/filter/BUILD | 1 + runsc/boot/filter/config.go | 416 ------------------- runsc/boot/filter/extra_filters_hostinet.go | 437 ++++++++++++++++++++ 3 files changed, 438 insertions(+), 416 deletions(-) create mode 100644 runsc/boot/filter/extra_filters_hostinet.go diff --git a/runsc/boot/filter/BUILD b/runsc/boot/filter/BUILD index d26a4de6d..d391d93e1 100644 --- a/runsc/boot/filter/BUILD +++ b/runsc/boot/filter/BUILD @@ -10,6 +10,7 @@ go_library( "config_arm64.go", "config_profile.go", "extra_filters.go", + "extra_filters_hostinet.go", "extra_filters_msan.go", "extra_filters_race.go", "extra_filters_race_amd64.go", diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go index 7ff74a317..8ff024972 100644 --- a/runsc/boot/filter/config.go +++ b/runsc/boot/filter/config.go @@ -345,422 +345,6 @@ var allowedSyscalls = seccomp.SyscallRules{ }, } -// hostInetFilters contains syscalls that are needed by sentry/socket/hostinet. -func hostInetFilters() seccomp.SyscallRules { - return seccomp.SyscallRules{ - unix.SYS_ACCEPT4: []seccomp.Rule{ - { - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), - }, - }, - unix.SYS_BIND: {}, - unix.SYS_CONNECT: {}, - unix.SYS_GETPEERNAME: {}, - unix.SYS_GETSOCKNAME: {}, - unix.SYS_GETSOCKOPT: []seccomp.Rule{ - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_TOS), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_RECVTOS), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_TTL), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_RECVTTL), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_PKTINFO), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_RECVORIGDSTADDR), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_RECVERR), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_TCLASS), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_RECVTCLASS), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_RECVPKTINFO), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_UNICAST_HOPS), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_MULTICAST_HOPS), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_RECVHOPLIMIT), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_RECVERR), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_V6ONLY), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(linux.IPV6_RECVORIGDSTADDR), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_BROADCAST), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_ERROR), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_KEEPALIVE), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_SNDBUF), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_RCVBUF), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_REUSEADDR), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_TYPE), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_LINGER), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_TIMESTAMP), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_RCVTIMEO), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_SNDTIMEO), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_TCP), - seccomp.EqualTo(unix.TCP_NODELAY), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_TCP), - seccomp.EqualTo(unix.TCP_INFO), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_TCP), - seccomp.EqualTo(linux.TCP_INQ), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_TCP), - seccomp.EqualTo(linux.TCP_MAXSEG), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_TCP), - seccomp.EqualTo(linux.TCP_CONGESTION), - }, - }, - unix.SYS_IOCTL: []seccomp.Rule{ - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.TIOCOUTQ), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.TIOCINQ), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SIOCGIFFLAGS), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SIOCGIFCONF), - }, - }, - unix.SYS_LISTEN: {}, - unix.SYS_READV: {}, - unix.SYS_RECVFROM: {}, - unix.SYS_RECVMSG: {}, - unix.SYS_SENDMSG: {}, - unix.SYS_SENDTO: {}, - unix.SYS_SETSOCKOPT: []seccomp.Rule{ - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_BROADCAST), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_SNDBUF), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_RCVBUF), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_REUSEADDR), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_SOCKET), - seccomp.EqualTo(unix.SO_TIMESTAMP), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_TCP), - seccomp.EqualTo(unix.TCP_NODELAY), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_TCP), - seccomp.EqualTo(linux.TCP_INQ), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_TCP), - seccomp.EqualTo(linux.TCP_MAXSEG), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_TCP), - seccomp.EqualTo(linux.TCP_CONGESTION), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_TOS), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_RECVTOS), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_TTL), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_RECVTTL), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_PKTINFO), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_RECVPKTINFO), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_RECVORIGDSTADDR), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IP), - seccomp.EqualTo(unix.IP_RECVERR), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_TCLASS), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_RECVTCLASS), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_UNICAST_HOPS), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_MULTICAST_HOPS), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_RECVHOPLIMIT), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(linux.IPV6_RECVORIGDSTADDR), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_RECVERR), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SOL_IPV6), - seccomp.EqualTo(unix.IPV6_V6ONLY), - seccomp.MatchAny{}, - seccomp.EqualTo(4), - }, - }, - unix.SYS_SHUTDOWN: []seccomp.Rule{ - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SHUT_RD), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SHUT_WR), - }, - { - seccomp.MatchAny{}, - seccomp.EqualTo(unix.SHUT_RDWR), - }, - }, - unix.SYS_SOCKET: []seccomp.Rule{ - { - seccomp.EqualTo(unix.AF_INET), - seccomp.EqualTo(unix.SOCK_STREAM | unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), - seccomp.EqualTo(0), - }, - { - seccomp.EqualTo(unix.AF_INET), - seccomp.EqualTo(unix.SOCK_DGRAM | unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), - seccomp.EqualTo(0), - }, - { - seccomp.EqualTo(unix.AF_INET6), - seccomp.EqualTo(unix.SOCK_STREAM | unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), - seccomp.EqualTo(0), - }, - { - seccomp.EqualTo(unix.AF_INET6), - seccomp.EqualTo(unix.SOCK_DGRAM | unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), - seccomp.EqualTo(0), - }, - }, - unix.SYS_WRITEV: {}, - } -} - func controlServerFilters(fd int) seccomp.SyscallRules { return seccomp.SyscallRules{ unix.SYS_ACCEPT4: []seccomp.Rule{ diff --git a/runsc/boot/filter/extra_filters_hostinet.go b/runsc/boot/filter/extra_filters_hostinet.go new file mode 100644 index 000000000..3b7f54f0a --- /dev/null +++ b/runsc/boot/filter/extra_filters_hostinet.go @@ -0,0 +1,437 @@ +// Copyright 2023 The gVisor Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package filter + +import ( + "golang.org/x/sys/unix" + "gvisor.dev/gvisor/pkg/abi/linux" + "gvisor.dev/gvisor/pkg/seccomp" +) + +// hostInetFilters contains syscalls that are needed by sentry/socket/hostinet. +func hostInetFilters() seccomp.SyscallRules { + return seccomp.SyscallRules{ + unix.SYS_ACCEPT4: []seccomp.Rule{ + { + seccomp.MatchAny{}, + seccomp.MatchAny{}, + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), + }, + }, + unix.SYS_BIND: {}, + unix.SYS_CONNECT: {}, + unix.SYS_GETPEERNAME: {}, + unix.SYS_GETSOCKNAME: {}, + unix.SYS_GETSOCKOPT: []seccomp.Rule{ + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_TOS), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_RECVTOS), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_TTL), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_RECVTTL), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_PKTINFO), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_RECVORIGDSTADDR), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_RECVERR), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_TCLASS), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_RECVTCLASS), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_RECVPKTINFO), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_UNICAST_HOPS), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_MULTICAST_HOPS), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_RECVHOPLIMIT), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_RECVERR), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_V6ONLY), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(linux.IPV6_RECVORIGDSTADDR), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_BROADCAST), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_ERROR), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_KEEPALIVE), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_SNDBUF), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_RCVBUF), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_REUSEADDR), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_TYPE), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_LINGER), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_TIMESTAMP), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_RCVTIMEO), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_SNDTIMEO), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_TCP), + seccomp.EqualTo(unix.TCP_NODELAY), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_TCP), + seccomp.EqualTo(unix.TCP_INFO), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_TCP), + seccomp.EqualTo(linux.TCP_INQ), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_TCP), + seccomp.EqualTo(linux.TCP_MAXSEG), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_TCP), + seccomp.EqualTo(linux.TCP_CONGESTION), + }, + }, + unix.SYS_IOCTL: []seccomp.Rule{ + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.TIOCOUTQ), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.TIOCINQ), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SIOCGIFFLAGS), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SIOCGIFCONF), + }, + }, + unix.SYS_LISTEN: {}, + unix.SYS_READV: {}, + unix.SYS_RECVFROM: {}, + unix.SYS_RECVMSG: {}, + unix.SYS_SENDMSG: {}, + unix.SYS_SENDTO: {}, + unix.SYS_SETSOCKOPT: []seccomp.Rule{ + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_BROADCAST), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_SNDBUF), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_RCVBUF), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_REUSEADDR), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_SOCKET), + seccomp.EqualTo(unix.SO_TIMESTAMP), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_TCP), + seccomp.EqualTo(unix.TCP_NODELAY), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_TCP), + seccomp.EqualTo(linux.TCP_INQ), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_TCP), + seccomp.EqualTo(linux.TCP_MAXSEG), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_TCP), + seccomp.EqualTo(linux.TCP_CONGESTION), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_TOS), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_RECVTOS), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_TTL), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_RECVTTL), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_PKTINFO), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_RECVPKTINFO), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_RECVORIGDSTADDR), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IP), + seccomp.EqualTo(unix.IP_RECVERR), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_TCLASS), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_RECVTCLASS), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_UNICAST_HOPS), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_MULTICAST_HOPS), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_RECVHOPLIMIT), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(linux.IPV6_RECVORIGDSTADDR), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_RECVERR), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SOL_IPV6), + seccomp.EqualTo(unix.IPV6_V6ONLY), + seccomp.MatchAny{}, + seccomp.EqualTo(4), + }, + }, + unix.SYS_SHUTDOWN: []seccomp.Rule{ + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SHUT_RD), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SHUT_WR), + }, + { + seccomp.MatchAny{}, + seccomp.EqualTo(unix.SHUT_RDWR), + }, + }, + unix.SYS_SOCKET: []seccomp.Rule{ + { + seccomp.EqualTo(unix.AF_INET), + seccomp.EqualTo(unix.SOCK_STREAM | unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), + seccomp.EqualTo(0), + }, + { + seccomp.EqualTo(unix.AF_INET), + seccomp.EqualTo(unix.SOCK_DGRAM | unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), + seccomp.EqualTo(0), + }, + { + seccomp.EqualTo(unix.AF_INET6), + seccomp.EqualTo(unix.SOCK_STREAM | unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), + seccomp.EqualTo(0), + }, + { + seccomp.EqualTo(unix.AF_INET6), + seccomp.EqualTo(unix.SOCK_DGRAM | unix.SOCK_NONBLOCK | unix.SOCK_CLOEXEC), + seccomp.EqualTo(0), + }, + }, + unix.SYS_WRITEV: {}, + } +}