Mirror of strace – the linux syscall tracer
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

bpf_seccomp_filter.c 1.1KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051
  1. /*
  2. * Decoder of seccomp filter programs.
  3. *
  4. * Copyright (c) 2015-2018 Dmitry V. Levin <ldv@altlinux.org>
  5. * All rights reserved.
  6. *
  7. * SPDX-License-Identifier: LGPL-2.1-or-later
  8. */
  9. #include "defs.h"
  10. #include "bpf_filter.h"
  11. #include <linux/filter.h>
  12. #ifdef HAVE_LINUX_SECCOMP_H
  13. # include <linux/seccomp.h>
  14. #endif
  15. #ifndef SECCOMP_RET_ACTION_FULL
  16. # define SECCOMP_RET_ACTION_FULL 0xffff0000U
  17. #endif
  18. #include "xlat/seccomp_ret_action.h"
  19. static bool
  20. print_seccomp_filter_k(const struct bpf_filter_block *const fp)
  21. {
  22. if (BPF_CLASS(fp->code) == BPF_RET) {
  23. unsigned int action = SECCOMP_RET_ACTION_FULL & fp->k;
  24. unsigned int data = fp->k & ~action;
  25. printxval(seccomp_ret_action, action, "SECCOMP_RET_???");
  26. if (data)
  27. tprintf("|%#x", data);
  28. return true;
  29. }
  30. return false;
  31. }
  32. void
  33. print_seccomp_fprog(struct tcb *const tcp, const kernel_ulong_t addr,
  34. const unsigned short len)
  35. {
  36. print_bpf_fprog(tcp, addr, len, print_seccomp_filter_k);
  37. }
  38. void
  39. decode_seccomp_fprog(struct tcb *const tcp, const kernel_ulong_t addr)
  40. {
  41. decode_bpf_fprog(tcp, addr, print_seccomp_filter_k);
  42. }