Function build_trapped 

pub fn build_trapped(t64: &Table<'_>, t32: &Table<'_>) -> Vec<SockFilter>

Builds the filter of the guest-stub restricted mode.

A syscall made from one of the stub’s gates is decided by the gate: the allow gate’s are allowed, the notify gate’s go to the listener. Each ABI has its gate page at its own address. Every other clone3 (435 on both ABIs) is refused with ENOSYS, which makes a C library fall back to clone, whose flags are in a register. The rest follows build, with the trace lists trapped into the stub (SECCOMP_RET_TRAP with layout::TAG) instead of stopping for a tracer.

0   ld arch
1   jeq arch64 -> 3
2   jeq arch32 -> 8, else -> 15
3   ld instruction_pointer (high word)
4   jeq 64-bit gate page -> 5, else -> 15
5   ld instruction_pointer (low word)
6   jeq 64-bit allow gate -> 13
7   jeq 64-bit notify gate -> 14, else -> 15
8   ld instruction_pointer (high word)
9   jeq 0 -> 10, else -> 15
10  ld instruction_pointer (low word)
11  jeq 32-bit allow gate -> 13
12  jeq 32-bit notify gate -> 14, else -> 15
13  ret ALLOW
14  ret USER_NOTIF
15  ld nr
16  jeq clone3 -> 17, else -> T
17  ret ERRNO(ENOSYS)
T   the tiers of [`build`]

Arguments

• t64 - The 64-bit ABI: notify answered directly, trace trapped.
• t32 - The compat ABI, likewise.

Returns

The instruction list, ready for seccomp(2).