mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
62 lines
1.3 KiB
Go
62 lines
1.3 KiB
Go
package libseccomp
|
|
|
|
import (
|
|
"syscall"
|
|
|
|
"github.com/criyle/go-sandbox/pkg/seccomp"
|
|
libseccomp "github.com/elastic/go-seccomp-bpf"
|
|
"golang.org/x/net/bpf"
|
|
)
|
|
|
|
// Builder is used to build the filter
|
|
type Builder struct {
|
|
Allow, Trace []string
|
|
Default Action
|
|
}
|
|
|
|
var actTrace = libseccomp.ActionTrace
|
|
|
|
// Build builds the filter
|
|
func (b *Builder) Build() (seccomp.Filter, error) {
|
|
policy := libseccomp.Policy{
|
|
DefaultAction: ToSeccompAction(b.Default),
|
|
Syscalls: []libseccomp.SyscallGroup{
|
|
{
|
|
Action: libseccomp.ActionAllow,
|
|
Names: b.Allow,
|
|
},
|
|
{
|
|
Action: actTrace,
|
|
Names: b.Trace,
|
|
},
|
|
},
|
|
}
|
|
program, err := policy.Assemble()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return ExportBPF(program)
|
|
}
|
|
|
|
// ExportBPF convert libseccomp filter to kernel readable BPF content
|
|
func ExportBPF(filter []bpf.Instruction) (seccomp.Filter, error) {
|
|
raw, err := bpf.Assemble(filter)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return sockFilter(raw), nil
|
|
}
|
|
|
|
func sockFilter(raw []bpf.RawInstruction) []syscall.SockFilter {
|
|
filter := make([]syscall.SockFilter, 0, len(raw))
|
|
for _, instruction := range raw {
|
|
filter = append(filter, syscall.SockFilter{
|
|
Code: instruction.Op,
|
|
Jt: instruction.Jt,
|
|
Jf: instruction.Jf,
|
|
K: instruction.K,
|
|
})
|
|
}
|
|
return filter
|
|
}
|