mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Etienne PerotandgVisor bot
56c21d81cd
This wraps the `map[uintptry]SyscallRule` into an unexported field of a struct so that it cannot be accessed directly. This is helpful for the `runsc` and `fsgofer` seccomp filters which are quite complex and built across multiple files and multiple functions, where it is not always clear which order they are executed in. By forcing mutations to be more explicit about their intent (especially "merge with this new rule" vs "override what happens for this syscall with this new rule"), we can crash if that intent isn't what's actually happening. PiperOrigin-RevId: 572361619
34 lines
1.1 KiB
Go
34 lines
1.1 KiB
Go
// Copyright 2018 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Test binary used to test that seccomp filters are properly constructed and
|
|
// indeed kill the process on violation.
|
|
|
|
//go:build amd64
|
|
// +build amd64
|
|
|
|
package main
|
|
|
|
import (
|
|
"golang.org/x/sys/unix"
|
|
"gvisor.dev/gvisor/pkg/seccomp"
|
|
)
|
|
|
|
func arch_syscalls(syscalls seccomp.SyscallRules) {
|
|
syscalls.Set(unix.SYS_ARCH_PRCTL, seccomp.MatchAll{})
|
|
syscalls.Set(unix.SYS_EPOLL_WAIT, seccomp.MatchAll{})
|
|
syscalls.Set(unix.SYS_NEWFSTATAT, seccomp.MatchAll{})
|
|
syscalls.Set(unix.SYS_OPEN, seccomp.MatchAll{})
|
|
}
|