Generate seccomp.bpf during build

[bbx0]

This is a proposal for a runtime independent handling of the seccomp.bpf file. This allows support for additional architectures like aarch64 or arm (see #126).

How does it work?

• A specific seccomp.bpf is generated via build.rs during compilation.
  • The generated seccomp.bpf matches the target_arch of the rua binary. It's no longer required to distinguish different versions during runtime.
  • The seccomp.bpf is embedded to the binary, just like the prebuilt ones before. During runtime it is extracted to .system/seccomp.bpf. (The prebuilt files are removed by this pull request.)
• A new build-time dependency libscmp is introduced to generate the seccomp.bpf file.
  • There are various crates available for that purpose but to me libscmp seems most appealing. It has a very low footprint and provides all required features (especially seccomp_syscall_resolve_name and seccomp_export_bpf). An alternative would be the libseccomp crate.

How can it be tested / reviewed?

• The implementation exports next to the seccomp.bpf a seccomp.pfc to OUT_DIR containing the human-readable output of the filter. (This second file is not embedded to the binary but can easily be inspected.)
• The md5sum for the seccomp.bpf file generated by this implementation is identical to the old one generated by seccomp (https://github.com/kurnevsky/dotfiles/commit/1432bf8ae2b62f16142b7c87ad2e0fd28d27e9fc).

  $ find . -name \*.bpf -exec md5sum {} \;
  de85db9cf299f131c51cecee5f84ce77  ./res/seccomp-i686.bpf
  f9cd17bc2fe18abc4f672071dd9e0c9c  ./res/seccomp-x86_64.bpf
  de85db9cf299f131c51cecee5f84ce77  ./target/i686-unknown-linux-gnu/debug/build/rua-5b88deb180f14f08/out/seccomp.bpf
  f9cd17bc2fe18abc4f672071dd9e0c9c  ./target/x86_64-unknown-linux-gnu/debug/build/rua-bdd5a199bf2717e3/out/seccomp.bpf

Remarks

• The seccomp.bpf file can contain the ruleset for all supported architecures at once. This comes with an increased file size but may reduce the logic in build.rs by a few lines. (I don't think it's worth it.)

I hope this helps. In case another solution fits better, I'm happy to revise.

[vn971]

Hey @bbx0, this is actually a super-useful MR, sorry for only starting on that now. I'm looking at the code now, thinking on how to integrate it. Some things that I need to check are:

• Do we need to update README.md to ask for libseccomp installation? (Likely yes.)
• The AUR packages need to be updated to include libseccomp as well
• To use the same style as in other places in RUA, I'll likely remove exclamation marks from the error logs (double-checked if I should use them or periods here)
• (I'm a bit drawn on whether we should alternatively support some well-known architectures without requiring libseccomp dependency. Likely not though, e.g. just always requiring libseccomp as this PR does is fine.)

No action required for now, just wanted to let know that I've started on this

[vn971]

@bbx0 Strange, I thought I commented here? Anyway, thanks a lot for the PR! I've made few changes to e.g. disable a compilation warning and some style fixes, it's on master now and released as well. Thanks!

[bbx0]

Thanks a lot for pulling this in! Glad it was helpful. Running already the new release on my rp4 (aarch64). :)