#include "rules.h" #include "../err.h" #include "../sandbox.h" #include "../utils/log.h" #include #include LIST_HEAD(seccomp_rules); void register_rule(struct rule *rule) { list_add(&rule->list, &seccomp_rules); } void setup_self(scmp_filter_ctx ctx, const char *exe_path) { // allow to execute self add_syscall_nr_arg(SCMP_SYS(execve), ctx, SCMP_ACT_ALLOW, 1, &SCMP_A0(SCMP_CMP_EQ, (scmp_datum_t)exe_path)); } void setup_rule(const char *name, scmp_filter_ctx ctx, const char *exe_path) { struct list_head *current; struct rule *rule; setup_self(ctx, exe_path); list_for_each(current, &seccomp_rules) { rule = list_entry(current, struct rule, list); if (strcmp(rule->name, name) == 0) { rule->setup(ctx); return; } } LOG_ERR("No rule found for %s", name); dump_rules(); exit(ERR_NO_RULE_FOUND); } void dump_rules(void) { struct list_head *current; struct rule *rule; LOG_INFO("Available Rules:"); list_for_each(current, &seccomp_rules) { rule = list_entry(current, struct rule, list); LOG_INFO("> %s", rule->name); } }