Module filter 

Builds and installs the classic-BPF seccomp filter.

Three tiers: syscalls answered by the supervisor (USER_NOTIF), syscalls that need a ptrace stop to edit the tracee in place (TRACE), and everything else (ALLOW). Namespace creation is refused with EPERM, as a default container refuses it, because a tracee in a mount namespace of its own cannot be served from the supervisor’s. The host’s 64-bit ABI and its 32-bit compat ABI each get a number table; any other audit arch (x32) is refused with ENOSYS. A compat table may be empty, which refuses that ABI too.

The guest-stub restricted mode (see guest_stub) traps its trace list into the guest’s SIGSYS handler instead, behind a prologue that lets the stub’s own syscalls through by the gate they are made from.

Structs

SockFilter

Mirror of struct sock_filter.

SockFprog

Mirror of struct sock_fprog.

Table

One ABI’s share of the filter: its audit arch and its number lists.

Enums

Sub 🔒

A table entry that needs to look at an argument before deciding.

Constants

BPF_JA 🔒

BPF_JEQ_K 🔒

BPF_JSET_K 🔒

BPF_LD_W_ABS 🔒

BPF_RET_K 🔒

SECCOMP_RET_TRAP 🔒

SECCOMP_RET_TRAP: raise SIGSYS in the calling thread instead.

Functions

arg_offset 🔒

Offset of the low 32 bits of seccomp_data.args[i].

build

Builds the filter program.

build_tiers 🔒

Builds the tiers shared by every mode.

build_trapped

Builds the filter of the guest-stub restricted mode.

from_bytes

Decodes a raw classic-BPF program as bubblewrap receives it on --seccomp FD.

install

Installs program in the calling thread and returns the listener fd.

install_plain

Installs a caller-supplied program without a listener (stacks on ours).

jump 🔒

stmt 🔒