go-judge/env/seccomp_linux.go
2022-03-20 23:40:21 -07:00

50 lines
955 B
Go

//go:build seccomp
package env
import (
"os"
"syscall"
"github.com/elastic/go-seccomp-bpf"
"github.com/elastic/go-ucfg/yaml"
"golang.org/x/net/bpf"
)
func readSeccompConf(name string) ([]syscall.SockFilter, error) {
conf, err := yaml.NewConfigWithFile(name)
if err != nil {
if os.IsNotExist(err) {
return nil, nil
}
return nil, err
}
var policy seccomp.Policy
if err := conf.Unpack(&policy); err != nil {
return nil, err
}
inst, err := policy.Assemble()
if err != nil {
return nil, err
}
rawInst, err := bpf.Assemble(inst)
if err != nil {
return nil, err
}
return toSockFilter(rawInst), nil
}
func toSockFilter(raw []bpf.RawInstruction) []syscall.SockFilter {
filter := make([]syscall.SockFilter, 0, len(raw))
for _, instruction := range raw {
filter = append(filter, syscall.SockFilter{
Code: instruction.Op,
Jt: instruction.Jt,
Jf: instruction.Jf,
K: instruction.K,
})
}
return filter
}