Merge release-20191104.0-34-gca9cba6 (automated)
This commit is contained in:
commit
6de4dfdd28
|
@ -199,6 +199,10 @@ func ruleViolationLabel(ruleSetIdx int, sysno uintptr, idx int) string {
|
||||||
return fmt.Sprintf("ruleViolation_%v_%v_%v", ruleSetIdx, sysno, idx)
|
return fmt.Sprintf("ruleViolation_%v_%v_%v", ruleSetIdx, sysno, idx)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func ruleLabel(ruleSetIdx int, sysno uintptr, idx int, name string) string {
|
||||||
|
return fmt.Sprintf("rule_%v_%v_%v_%v", ruleSetIdx, sysno, idx, name)
|
||||||
|
}
|
||||||
|
|
||||||
func checkArgsLabel(sysno uintptr) string {
|
func checkArgsLabel(sysno uintptr) string {
|
||||||
return fmt.Sprintf("checkArgs_%v", sysno)
|
return fmt.Sprintf("checkArgs_%v", sysno)
|
||||||
}
|
}
|
||||||
|
@ -223,6 +227,19 @@ func addSyscallArgsCheck(p *bpf.ProgramBuilder, rules []Rule, action linux.BPFAc
|
||||||
p.AddStmt(bpf.Ld|bpf.Abs|bpf.W, seccompDataOffsetArgHigh(i))
|
p.AddStmt(bpf.Ld|bpf.Abs|bpf.W, seccompDataOffsetArgHigh(i))
|
||||||
p.AddJumpFalseLabel(bpf.Jmp|bpf.Jeq|bpf.K, high, 0, ruleViolationLabel(ruleSetIdx, sysno, ruleidx))
|
p.AddJumpFalseLabel(bpf.Jmp|bpf.Jeq|bpf.K, high, 0, ruleViolationLabel(ruleSetIdx, sysno, ruleidx))
|
||||||
labelled = true
|
labelled = true
|
||||||
|
case GreaterThan:
|
||||||
|
labelGood := fmt.Sprintf("gt%v", i)
|
||||||
|
high, low := uint32(a>>32), uint32(a)
|
||||||
|
// assert arg_high < high
|
||||||
|
p.AddStmt(bpf.Ld|bpf.Abs|bpf.W, seccompDataOffsetArgHigh(i))
|
||||||
|
p.AddJumpFalseLabel(bpf.Jmp|bpf.Jge|bpf.K, high, 0, ruleViolationLabel(ruleSetIdx, sysno, ruleidx))
|
||||||
|
// arg_high > high
|
||||||
|
p.AddJumpFalseLabel(bpf.Jmp|bpf.Jeq|bpf.K, high, 0, ruleLabel(ruleSetIdx, sysno, ruleidx, labelGood))
|
||||||
|
// arg_low < low
|
||||||
|
p.AddStmt(bpf.Ld|bpf.Abs|bpf.W, seccompDataOffsetArgLow(i))
|
||||||
|
p.AddJumpFalseLabel(bpf.Jmp|bpf.Jgt|bpf.K, low, 0, ruleViolationLabel(ruleSetIdx, sysno, ruleidx))
|
||||||
|
p.AddLabel(ruleLabel(ruleSetIdx, sysno, ruleidx, labelGood))
|
||||||
|
labelled = true
|
||||||
default:
|
default:
|
||||||
return fmt.Errorf("unknown syscall rule type: %v", reflect.TypeOf(a))
|
return fmt.Errorf("unknown syscall rule type: %v", reflect.TypeOf(a))
|
||||||
}
|
}
|
||||||
|
|
|
@ -49,6 +49,9 @@ func (a AllowAny) String() (s string) {
|
||||||
// AllowValue specifies a value that needs to be strictly matched.
|
// AllowValue specifies a value that needs to be strictly matched.
|
||||||
type AllowValue uintptr
|
type AllowValue uintptr
|
||||||
|
|
||||||
|
// GreaterThan specifies a value that needs to be strictly smaller.
|
||||||
|
type GreaterThan uintptr
|
||||||
|
|
||||||
func (a AllowValue) String() (s string) {
|
func (a AllowValue) String() (s string) {
|
||||||
return fmt.Sprintf("%#x ", uintptr(a))
|
return fmt.Sprintf("%#x ", uintptr(a))
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue