Skip to content

Commit 460967f

Browse files
kolyshkinpcmoore
authored andcommitted
Add support for SCMP_FLTATR_API_SYSRAWRC
Introduce (*ScmpFilter).GetRawRC and (*ScmpFilter).SetRawRC methods, together with the documentation and trivial tests. Signed-off-by: Kir Kolyshkin <[email protected]> Acked-by: Tom Hromatka <[email protected]> Signed-off-by: Paul Moore <[email protected]>
1 parent b190863 commit 460967f

File tree

3 files changed

+56
-0
lines changed

3 files changed

+56
-0
lines changed

seccomp.go

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -918,6 +918,26 @@ func (f *ScmpFilter) GetOptimize() (int, error) {
918918
return int(level), nil
919919
}
920920

921+
// GetRawRC returns the current state of RawRC flag, or an error
922+
// if an issue was encountered retrieving the value.
923+
// See SetRawRC for more details.
924+
func (f *ScmpFilter) GetRawRC() (bool, error) {
925+
rawrc, err := f.getFilterAttr(filterAttrRawRC)
926+
if err != nil {
927+
if e := checkAPI("GetRawRC", 4, 2, 5, 0); e != nil {
928+
err = e
929+
}
930+
931+
return false, err
932+
}
933+
934+
if rawrc == 0 {
935+
return false, nil
936+
}
937+
938+
return true, nil
939+
}
940+
921941
// SetBadArchAction sets the default action taken on a syscall for an
922942
// architecture not in the filter, or an error if an issue was encountered
923943
// setting the value.
@@ -1011,6 +1031,25 @@ func (f *ScmpFilter) SetOptimize(level int) error {
10111031
return err
10121032
}
10131033

1034+
// SetRawRC sets whether libseccomp should pass system error codes back to the
1035+
// caller, instead of the default ECANCELED. Defaults to false.
1036+
func (f *ScmpFilter) SetRawRC(state bool) error {
1037+
var toSet C.uint32_t = 0x0
1038+
1039+
if state {
1040+
toSet = 0x1
1041+
}
1042+
1043+
err := f.setFilterAttr(filterAttrRawRC, toSet)
1044+
if err != nil {
1045+
if e := checkAPI("SetRawRC", 4, 2, 5, 0); e != nil {
1046+
err = e
1047+
}
1048+
}
1049+
1050+
return err
1051+
}
1052+
10141053
// SetSyscallPriority sets a syscall's priority.
10151054
// This provides a hint to the filter generator in libseccomp about the
10161055
// importance of this syscall. High-priority syscalls are placed

seccomp_internal.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ const uint32_t C_ACT_NOTIFY = SCMP_ACT_NOTIFY;
125125
#if SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR < 5
126126
#define SCMP_FLTATR_CTL_SSB _SCMP_FLTATR_MIN
127127
#define SCMP_FLTATR_CTL_OPTIMIZE _SCMP_FLTATR_MIN
128+
#define SCMP_FLTATR_API_SYSRAWRC _SCMP_FLTATR_MIN
128129
#endif
129130
130131
const uint32_t C_ATTRIBUTE_DEFAULT = (uint32_t)SCMP_FLTATR_ACT_DEFAULT;
@@ -134,6 +135,7 @@ const uint32_t C_ATTRIBUTE_TSYNC = (uint32_t)SCMP_FLTATR_CTL_TSYNC;
134135
const uint32_t C_ATTRIBUTE_LOG = (uint32_t)SCMP_FLTATR_CTL_LOG;
135136
const uint32_t C_ATTRIBUTE_SSB = (uint32_t)SCMP_FLTATR_CTL_SSB;
136137
const uint32_t C_ATTRIBUTE_OPTIMIZE = (uint32_t)SCMP_FLTATR_CTL_OPTIMIZE;
138+
const uint32_t C_ATTRIBUTE_SYSRAWRC = (uint32_t)SCMP_FLTATR_API_SYSRAWRC;
137139
138140
const int C_CMP_NE = (int)SCMP_CMP_NE;
139141
const int C_CMP_LT = (int)SCMP_CMP_LT;
@@ -281,6 +283,7 @@ const (
281283
filterAttrLog
282284
filterAttrSSB
283285
filterAttrOptimize
286+
filterAttrRawRC
284287
)
285288

286289
const (
@@ -692,6 +695,8 @@ func (a scmpFilterAttr) toNative() uint32 {
692695
return uint32(C.C_ATTRIBUTE_SSB)
693696
case filterAttrOptimize:
694697
return uint32(C.C_ATTRIBUTE_OPTIMIZE)
698+
case filterAttrRawRC:
699+
return uint32(C.C_ATTRIBUTE_SYSRAWRC)
695700
default:
696701
return 0x0
697702
}

seccomp_test.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -491,6 +491,18 @@ func TestFilterAttributeGettersAndSetters(t *testing.T) {
491491
} else if level != 2 {
492492
t.Error("Optimize level was not set correctly")
493493
}
494+
495+
err = filter.SetRawRC(true)
496+
if err != nil {
497+
t.Errorf("Error setting RawRC flag: %v", err)
498+
}
499+
500+
rawrc, err := filter.GetRawRC()
501+
if err != nil {
502+
t.Errorf("Error getting RawRC flag: %v", err)
503+
} else if rawrc != true {
504+
t.Error("RawRC flag was not set correctly")
505+
}
494506
}
495507

496508
func TestMergeFilters(t *testing.T) {

0 commit comments

Comments
 (0)