tools/bpf.h - main - githubmirror/libseccomp

tools/bpf.h
131 строка3 KB
Tom Hromatka
api: Add support for SCMP_ACT_KILL_PROCESS
19 сен 2018, 23:54
19 сен 2018, 23:54b2f15f3
/**
 * BPF Language Definitions
 *
 * Copyright (c) 2012 Red Hat <pmoore@redhat.com>
 * Author: Paul Moore <paul@paul-moore.com>
 */

/*
 * This library is free software; you can redistribute it and/or modify it
 * under the terms of version 2.1 of the GNU Lesser General Public License as
 * published by the Free Software Foundation.
 *
 * This library is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
 * for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this library; if not, see <http://www.gnu.org/licenses>.
 */

#ifndef _BPF_H
#define _BPF_H

#include <inttypes.h>
#include <stddef.h>

/* most of these structures and values are designed to match the Linux Kernel's
 * BPF interface (see /usr/include/linux/{filter,seccomp}.h), but we define our
 * own here so that we can function independent of the host OS */

/* XXX - need to verify these values */
#define BPF_SCRATCH_SIZE	6

/**
 * Syscall record data format used by seccomp
 */
#define BPF_SYS_ARG_MAX		6
struct seccomp_data {
	int32_t nr;
	uint32_t arch;
	uint64_t instruction_pointer;
	uint64_t args[BPF_SYS_ARG_MAX];
};
#define BPF_SYSCALL_MAX		(sizeof(struct seccomp_data))

/**
 * BPF instruction format
 */
struct sock_filter {
	uint16_t code;
	uint8_t jt;
	uint8_t jf;
	uint32_t k;
} __attribute__ ((packed));
typedef struct sock_filter bpf_instr_raw;

/* seccomp return masks */
#define SECCOMP_RET_ACTION_FULL 0xffff0000U
#define SECCOMP_RET_ACTION	0x7fff0000U
#define SECCOMP_RET_DATA	0x0000ffffU

/* seccomp action values */
#define SECCOMP_RET_KILL_PROCESS 0x80000000U
#define SECCOMP_RET_KILL_THREAD 0x00000000U
#define SECCOMP_RET_KILL	SECCOMP_RET_KILL_THREAD
#define SECCOMP_RET_TRAP	0x00030000U
#define SECCOMP_RET_ERRNO	0x00050000U
#define SECCOMP_RET_TRACE	0x7ff00000U
#define SECCOMP_RET_LOG		0x7ffc0000U
#define SECCOMP_RET_ALLOW	0x7fff0000U

/* bpf command classes */
#define BPF_CLASS(code)		((code) & 0x07)
#define BPF_LD			0x00
#define BPF_LDX			0x01
#define BPF_ST			0x02
#define BPF_STX			0x03
#define BPF_ALU			0x04
#define BPF_JMP			0x05
#define BPF_RET			0x06
#define BPF_MISC		0x07

/* BPF_LD and BPF_LDX */
#define BPF_SIZE(code)		((code) & 0x18)
#define BPF_W			0x00
#define BPF_H			0x08
#define BPF_B			0x10
#define BPF_MODE(code)		((code) & 0xe0)
#define BPF_IMM			0x00
#define BPF_ABS			0x20
#define BPF_IND			0x40
#define BPF_MEM			0x60
#define BPF_LEN			0x80
#define BPF_MSH			0xa0

#define BPF_OP(code)		((code) & 0xf0)
/* BPF_ALU */
#define BPF_ADD			0x00
#define BPF_SUB			0x10
#define BPF_MUL			0x20
#define BPF_DIV			0x30
#define BPF_OR			0x40
#define BPF_AND			0x50
#define BPF_LSH			0x60
#define BPF_RSH			0x70
#define BPF_NEG			0x80
#define BPF_MOD			0x90
#define BPF_XOR			0xa0

/* BPF_JMP */
#define BPF_JA			0x00
#define BPF_JEQ			0x10
#define BPF_JGT			0x20
#define BPF_JGE			0x30
#define BPF_JSET		0x40

#define BPF_SRC(code)		((code) & 0x08)
#define BPF_K			0x00
#define BPF_X			0x08

/* BPF_RET (BPF_K and BPF_X also apply) */
#define BPF_RVAL(code)		((code) & 0x18)
#define BPF_A			0x10

/* BPF_MISC */
#define BPF_MISCOP(code)	((code) & 0xf8)
#define BPF_TAX			0x00
#define BPF_TXA			0x80

#endif