Closed bbx0 closed 2 years ago
Hey @bbx0, this is actually a super-useful MR, sorry for only starting on that now. I'm looking at the code now, thinking on how to integrate it. Some things that I need to check are:
libseccomp
installation? (Likely yes.)No action required for now, just wanted to let know that I've started on this
@bbx0 Strange, I thought I commented here? Anyway, thanks a lot for the PR! I've made few changes to e.g. disable a compilation warning and some style fixes, it's on master
now and released as well.
Thanks!
Thanks a lot for pulling this in! Glad it was helpful. Running already the new release on my rp4 (aarch64). :)
This is a proposal for a runtime independent handling of the
seccomp.bpf
file. This allows support for additional architectures likeaarch64
orarm
(see #126).How does it work?
seccomp.bpf
is generated viabuild.rs
during compilation.seccomp.bpf
matches thetarget_arch
of therua
binary. It's no longer required to distinguish different versions during runtime.seccomp.bpf
is embedded to the binary, just like the prebuilt ones before. During runtime it is extracted to.system/seccomp.bpf
. (The prebuilt files are removed by this pull request.)libscmp
is introduced to generate theseccomp.bpf
file.libscmp
seems most appealing. It has a very low footprint and provides all required features (especiallyseccomp_syscall_resolve_name
andseccomp_export_bpf
). An alternative would be thelibseccomp
crate.How can it be tested / reviewed?
seccomp.bpf
aseccomp.pfc
toOUT_DIR
containing the human-readable output of the filter. (This second file is not embedded to the binary but can easily be inspected.)md5sum
for theseccomp.bpf
file generated by this implementation is identical to the old one generated by seccomp (https://github.com/kurnevsky/dotfiles/commit/1432bf8ae2b62f16142b7c87ad2e0fd28d27e9fc).Remarks
seccomp.bpf
file can contain the ruleset for all supported architecures at once. This comes with an increased file size but may reduce the logic inbuild.rs
by a few lines. (I don't think it's worth it.)I hope this helps. In case another solution fits better, I'm happy to revise.