forked from seccomp/libseccomp
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
all: add seccomp_precompute() functionality
This patch adds a seccomp_precompute() API to precompute the seccomp filter prior to calling seccomp_load() or similar functions. Not only does this improve the performance of seccomp_load(), it ensures that seccomp_load() is async-signal-safe if no additional changes have been made since the filter was precomputed. Python bindings, test, and manpage updates are included in this patch. One minor side effect of this change is that seccomp_export_bpf_mem() now always return the length of the filter in the "len" function parameter, even in cases where the passed buffer is too small. Arguably seccomp_export_bpf_mem() should have always behaved this way. Signed-off-by: Paul Moore <[email protected]>
- Loading branch information
Showing
14 changed files
with
366 additions
and
19 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -22,7 +22,12 @@ Link with \fI\-lseccomp\fP. | |
Loads the seccomp filter provided by | ||
.I ctx | ||
into the kernel; if the function | ||
succeeds the new seccomp filter will be active when the function returns. | ||
succeeds the new seccomp filter will be active when the function returns. If | ||
.BR seccomp_precompute (3) | ||
was called prior to attempting to load the seccomp filter, and no changes have | ||
been made to the filter, | ||
.BR seccomp_load () | ||
can be considered to be async-signal-safe. | ||
.P | ||
As it is possible to have multiple stacked seccomp filters for a given task | ||
(defined as either a process or a thread), it is important to remember that | ||
|
@@ -108,5 +113,5 @@ Paul Moore <[email protected]> | |
.BR seccomp_release (3), | ||
.BR seccomp_rule_add (3), | ||
.BR seccomp_rule_add_exact (3) | ||
|
||
|
||
.BR seccomp_precompute (3) | ||
.BR signal-safety (7) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,103 @@ | ||
.TH "seccomp_precompute" 3 "19 September 2022" "[email protected]" "libseccomp Documentation" | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.SH NAME | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
seccomp_precompute \- Precompute the current seccomp filter | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.SH SYNOPSIS | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.nf | ||
.B #include <seccomp.h> | ||
.sp | ||
.B typedef void * scmp_filter_ctx; | ||
.sp | ||
.BI "int seccomp_precompute(scmp_filter_ctx " ctx ");" | ||
.sp | ||
Link with \fI\-lseccomp\fP. | ||
.fi | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.SH DESCRIPTION | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.P | ||
Precomputes the seccomp filter for later use by | ||
.BR seccomp_load () | ||
and similar functions. Not only does this improve performance of | ||
.BR seccomp_load () | ||
it also ensures that the seccomp filter can be loaded in an async-signal-safe | ||
manner if no changes have been made to the filter since it was precomputed. | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.SH RETURN VALUE | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
Returns zero on success or one of the following error codes on failure: | ||
.TP | ||
.B -ECANCELED | ||
There was a system failure beyond the control of the library. | ||
.TP | ||
.B -EFAULT | ||
Internal libseccomp failure. | ||
.TP | ||
.B -EINVAL | ||
Invalid input, either the context or architecture token is invalid. | ||
.TP | ||
.B -ENOMEM | ||
The library was unable to allocate enough memory. | ||
.P | ||
If the \fISCMP_FLTATR_API_SYSRAWRC\fP filter attribute is non-zero then | ||
additional error codes may be returned to the caller; these additional error | ||
codes are the negative \fIerrno\fP values returned by the system. Unfortunately | ||
libseccomp can make no guarantees about these return values. | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.SH EXAMPLES | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.nf | ||
#include <seccomp.h> | ||
|
||
int main(int argc, char *argv[]) | ||
{ | ||
int rc = \-1; | ||
scmp_filter_ctx ctx; | ||
|
||
ctx = seccomp_init(SCMP_ACT_KILL); | ||
if (ctx == NULL) | ||
goto out; | ||
|
||
/* ... */ | ||
|
||
rc = seccomp_precompute(ctx); | ||
if (rc < 0) | ||
goto out; | ||
|
||
/* ... */ | ||
|
||
rc = seccomp_load(ctx); | ||
if (rc < 0) | ||
goto out; | ||
|
||
/* ... */ | ||
|
||
out: | ||
seccomp_release(ctx); | ||
return \-rc; | ||
} | ||
.fi | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.SH NOTES | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.P | ||
While the seccomp filter can be generated independent of the kernel, kernel | ||
support is required to load and enforce the seccomp filter generated by | ||
libseccomp. | ||
.P | ||
The libseccomp project site, with more information and the source code | ||
repository, can be found at https://github.com/seccomp/libseccomp. This tool, | ||
as well as the libseccomp library, is currently under development, please | ||
report any bugs at the project site or directly to the author. | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.SH AUTHOR | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
Paul Moore <[email protected]> | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.SH SEE ALSO | ||
.\" ////////////////////////////////////////////////////////////////////////// | ||
.BR seccomp_load (3) | ||
.BR signal-safety (7) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -2,6 +2,7 @@ | |
* Seccomp Library API | ||
* | ||
* Copyright (c) 2012,2013 Red Hat <[email protected]> | ||
* Copyright (c) 2022 Microsoft Corporation <[email protected]> | ||
* Author: Paul Moore <[email protected]> | ||
*/ | ||
|
||
|
@@ -723,11 +724,11 @@ API int seccomp_export_bpf(const scmp_filter_ctx ctx, int fd) | |
return _rc_filter(-EINVAL); | ||
col = (struct db_filter_col *)ctx; | ||
|
||
rc = gen_bpf_generate(col, &program); | ||
rc = db_col_precompute(col); | ||
if (rc < 0) | ||
return _rc_filter(rc); | ||
program = col->prgm_bpf; | ||
rc = write(fd, program->blks, BPF_PGM_SIZE(program)); | ||
gen_bpf_release(program); | ||
if (rc < 0) | ||
return _rc_filter_sys(col, -errno); | ||
|
||
|
@@ -739,29 +740,38 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf, | |
size_t *len) | ||
{ | ||
int rc; | ||
size_t buf_len; | ||
struct db_filter_col *col; | ||
struct bpf_program *program; | ||
|
||
if (_ctx_valid(ctx) || !len) | ||
return _rc_filter(-EINVAL); | ||
col = (struct db_filter_col *)ctx; | ||
|
||
rc = gen_bpf_generate(col, &program); | ||
rc = db_col_precompute(col); | ||
if (rc < 0) | ||
return _rc_filter(rc); | ||
buf_len = *len; | ||
*len = BPF_PGM_SIZE(program); | ||
program = col->prgm_bpf; | ||
|
||
rc = 0; | ||
if (buf) { | ||
/* If we have a big enough buffer, write the program. */ | ||
if (*len > buf_len) | ||
if (BPF_PGM_SIZE(program) > *len) | ||
rc = _rc_filter(-ERANGE); | ||
else | ||
memcpy(buf, program->blks, *len); | ||
} | ||
gen_bpf_release(program); | ||
*len = BPF_PGM_SIZE(program); | ||
|
||
return rc; | ||
} | ||
|
||
/* NOTE - function header comment in include/seccomp.h */ | ||
API int seccomp_precompute(const scmp_filter_ctx ctx) | ||
{ | ||
struct db_filter_col *col; | ||
|
||
if (_ctx_valid(ctx)) | ||
return _rc_filter(-EINVAL); | ||
col = (struct db_filter_col *)ctx; | ||
|
||
return _rc_filter(db_col_precompute(col)); | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -3,6 +3,7 @@ | |
* | ||
* Copyright (c) 2012,2016,2018 Red Hat <[email protected]> | ||
* Copyright (c) 2019 Cisco Systems, Inc. <[email protected]> | ||
* Copyright (c) 2022 Microsoft Corporation <[email protected]> | ||
* Author: Paul Moore <[email protected]> | ||
*/ | ||
|
||
|
@@ -1098,6 +1099,9 @@ int db_col_reset(struct db_filter_col *col, uint32_t def_action) | |
free(snap); | ||
} | ||
|
||
/* reset the precomputed programs */ | ||
db_col_precompute_reset(col); | ||
|
||
return 0; | ||
} | ||
|
||
|
@@ -1162,6 +1166,9 @@ void db_col_release(struct db_filter_col *col) | |
free(col->filters); | ||
col->filters = NULL; | ||
|
||
/* free any precompute */ | ||
db_col_precompute_reset(col); | ||
|
||
/* free the collection */ | ||
free(col); | ||
} | ||
|
@@ -1250,6 +1257,9 @@ int db_col_merge(struct db_filter_col *col_dst, struct db_filter_col *col_src) | |
col_dst->filter_cnt++; | ||
} | ||
|
||
/* reset the precompute */ | ||
db_col_precompute_reset(col_dst); | ||
|
||
/* free the source */ | ||
col_src->filter_cnt = 0; | ||
db_col_release(col_src); | ||
|
@@ -1373,6 +1383,7 @@ int db_col_attr_set(struct db_filter_col *col, | |
col->attr.act_badarch = value; | ||
else | ||
return -EINVAL; | ||
db_col_precompute_reset(col); | ||
break; | ||
case SCMP_FLTATR_CTL_NNP: | ||
col->attr.nnp_enable = (value ? 1 : 0); | ||
|
@@ -1394,6 +1405,7 @@ int db_col_attr_set(struct db_filter_col *col, | |
break; | ||
case SCMP_FLTATR_API_TSKIP: | ||
col->attr.api_tskip = (value ? 1 : 0); | ||
db_col_precompute_reset(col); | ||
break; | ||
case SCMP_FLTATR_CTL_LOG: | ||
rc = sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_LOG); | ||
|
@@ -1427,6 +1439,7 @@ int db_col_attr_set(struct db_filter_col *col, | |
rc = -EOPNOTSUPP; | ||
break; | ||
} | ||
db_col_precompute_reset(col); | ||
break; | ||
case SCMP_FLTATR_API_SYSRAWRC: | ||
col->attr.api_sysrawrc = (value ? 1 : 0); | ||
|
@@ -1460,6 +1473,8 @@ int db_col_db_new(struct db_filter_col *col, const struct arch_def *arch) | |
rc = db_col_db_add(col, db); | ||
if (rc < 0) | ||
_db_release(db); | ||
else | ||
db_col_precompute_reset(col); | ||
|
||
return rc; | ||
} | ||
|
@@ -1540,6 +1555,8 @@ int db_col_db_remove(struct db_filter_col *col, uint32_t arch_token) | |
col->endian = 0; | ||
} | ||
|
||
db_col_precompute_reset(col); | ||
|
||
return 0; | ||
} | ||
|
||
|
@@ -2233,6 +2250,9 @@ int db_col_syscall_priority(struct db_filter_col *col, | |
rc = rc_tmp; | ||
} | ||
|
||
if (rc == 0) | ||
db_col_precompute_reset(col); | ||
|
||
return rc; | ||
} | ||
|
||
|
@@ -2377,8 +2397,11 @@ int db_col_rule_add(struct db_filter_col *col, | |
|
||
add_return: | ||
/* update the misc state */ | ||
if (rc == 0 && action == SCMP_ACT_NOTIFY) | ||
col->notify_used = true; | ||
if (rc == 0) { | ||
if (action == SCMP_ACT_NOTIFY) | ||
col->notify_used = true; | ||
db_col_precompute_reset(col); | ||
} | ||
if (chain != NULL) | ||
free(chain); | ||
return rc; | ||
|
@@ -2501,6 +2524,9 @@ void db_col_transaction_abort(struct db_filter_col *col) | |
for (iter = 0; iter < filter_cnt; iter++) | ||
_db_release(filters[iter]); | ||
free(filters); | ||
|
||
/* free any precompute */ | ||
db_col_precompute_reset(col); | ||
} | ||
|
||
/** | ||
|
@@ -2618,3 +2644,33 @@ void db_col_transaction_commit(struct db_filter_col *col) | |
_db_snap_release(snap); | ||
return; | ||
} | ||
|
||
/** | ||
* Precompute the seccomp filters | ||
* @param col the filter collection | ||
* | ||
* This function precomputes the seccomp filters before they are needed, | ||
* returns zero on success, negative values on error. | ||
* | ||
*/ | ||
int db_col_precompute(struct db_filter_col *col) | ||
{ | ||
if (!col->prgm_bpf) | ||
return gen_bpf_generate(col, &col->prgm_bpf); | ||
return 0; | ||
} | ||
|
||
/** | ||
* Free any precomputed filter programs | ||
* @param col the filter collection | ||
* | ||
* This function releases any precomputed filter programs. | ||
*/ | ||
void db_col_precompute_reset(struct db_filter_col *col) | ||
{ | ||
if (!col->prgm_bpf) | ||
return; | ||
|
||
gen_bpf_release(col->prgm_bpf); | ||
col->prgm_bpf = NULL; | ||
} |
Oops, something went wrong.