Merge release-20191104.0-34-gca9cba6 (automated)
This commit is contained in:
commit
6de4dfdd28
|
@ -199,6 +199,10 @@ func ruleViolationLabel(ruleSetIdx int, sysno uintptr, idx int) string {
|
|||
return fmt.Sprintf("ruleViolation_%v_%v_%v", ruleSetIdx, sysno, idx)
|
||||
}
|
||||
|
||||
func ruleLabel(ruleSetIdx int, sysno uintptr, idx int, name string) string {
|
||||
return fmt.Sprintf("rule_%v_%v_%v_%v", ruleSetIdx, sysno, idx, name)
|
||||
}
|
||||
|
||||
func checkArgsLabel(sysno uintptr) string {
|
||||
return fmt.Sprintf("checkArgs_%v", sysno)
|
||||
}
|
||||
|
@ -223,6 +227,19 @@ func addSyscallArgsCheck(p *bpf.ProgramBuilder, rules []Rule, action linux.BPFAc
|
|||
p.AddStmt(bpf.Ld|bpf.Abs|bpf.W, seccompDataOffsetArgHigh(i))
|
||||
p.AddJumpFalseLabel(bpf.Jmp|bpf.Jeq|bpf.K, high, 0, ruleViolationLabel(ruleSetIdx, sysno, ruleidx))
|
||||
labelled = true
|
||||
case GreaterThan:
|
||||
labelGood := fmt.Sprintf("gt%v", i)
|
||||
high, low := uint32(a>>32), uint32(a)
|
||||
// assert arg_high < high
|
||||
p.AddStmt(bpf.Ld|bpf.Abs|bpf.W, seccompDataOffsetArgHigh(i))
|
||||
p.AddJumpFalseLabel(bpf.Jmp|bpf.Jge|bpf.K, high, 0, ruleViolationLabel(ruleSetIdx, sysno, ruleidx))
|
||||
// arg_high > high
|
||||
p.AddJumpFalseLabel(bpf.Jmp|bpf.Jeq|bpf.K, high, 0, ruleLabel(ruleSetIdx, sysno, ruleidx, labelGood))
|
||||
// arg_low < low
|
||||
p.AddStmt(bpf.Ld|bpf.Abs|bpf.W, seccompDataOffsetArgLow(i))
|
||||
p.AddJumpFalseLabel(bpf.Jmp|bpf.Jgt|bpf.K, low, 0, ruleViolationLabel(ruleSetIdx, sysno, ruleidx))
|
||||
p.AddLabel(ruleLabel(ruleSetIdx, sysno, ruleidx, labelGood))
|
||||
labelled = true
|
||||
default:
|
||||
return fmt.Errorf("unknown syscall rule type: %v", reflect.TypeOf(a))
|
||||
}
|
||||
|
|
|
@ -49,6 +49,9 @@ func (a AllowAny) String() (s string) {
|
|||
// AllowValue specifies a value that needs to be strictly matched.
|
||||
type AllowValue uintptr
|
||||
|
||||
// GreaterThan specifies a value that needs to be strictly smaller.
|
||||
type GreaterThan uintptr
|
||||
|
||||
func (a AllowValue) String() (s string) {
|
||||
return fmt.Sprintf("%#x ", uintptr(a))
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue