netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

dumpfilter: Add flag to turn seccomp-bpf optimizations on or off.

Browse Source 
PiperOrigin-RevId: 603809406
This commit is contained in:
Etienne Perot
2024-02-02 15:58:59 -08:00
committed by gVisor bot
parent f4795a1c8f
commit f63e3b2796
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/boot/filter/dumpfilter/dumpfilter.go
+2
View File
@@ -32,6 +32,7 @@ import (
var (
output = flag.String("output", "fancy", "Output type: 'fancy' (human-readable with line numbers resolved), 'plain' (diffable but still human-readable output), 'bytecode' (dump raw bytecode)")
nvproxy = flag.Bool("nvproxy", false, "Enable nvproxy in filter configuration")
optimize = flag.Bool("optimize", true, "Enable seccomp optimizations")
denyAction = flag.String("deny-action", "default", "What to do if the syscall matches the 'deny' ruleset (one of: errno, kill_process, kill_thread)")
defaultAction = flag.String("default-action", "default", "What to do if all the syscall rules fail to match (one of: errno, kill_process, kill_thread)")
badArchAction = flag.String("bad-arch-action", "default", "What to do if all the architecture field mismatches (one of: errno, kill_process, kill_thread)")
@@ -69,6 +70,7 @@ func main() {
rules, denyRules := config.Rules(opt)
seccompOpts := config.SeccompOptions(opt)
seccompOpts.Optimize = *optimize
seccompOpts.DefaultAction = action(*defaultAction)
seccompOpts.BadArchAction = action(*badArchAction)
insns, stats, err := seccomp.BuildProgram([]seccomp.RuleSet{