1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

package bpf

// AUDIT_ARCH_* values, computed from EM_* machine IDs and the convention bits
// (see linux/uapi/audit.h).  seccomp_data.arch carries one of these; the filter
// dispatches on it so that each ABI's syscall-number namespace is matched
// against that ABI's own table.
const (
	emFlag64  = 0x80000000 // __AUDIT_ARCH_64BIT
	emFlagLE  = 0x40000000 // __AUDIT_ARCH_LE
	emFlagN32 = 0x20000000 // __AUDIT_ARCH_CONVENTION_MIPS64_N32

	emi386    = 3
	emMIPS    = 8
	emARM     = 40
	emX86_64  = 62
	emAARCH64 = 183
)

const (
	auditArchX86_64 uint32 = emX86_64 | emFlag64 | emFlagLE
	auditArchI386   uint32 = emi386 | emFlagLE
	// NB: x32 has no distinct audit arch.  The kernel reports x32 tasks as
	// AUDIT_ARCH_X86_64 (see arch/x86/include/asm/syscall.h: "x32 tasks should
	// be considered AUDIT_ARCH_X86_64").  x32 syscalls are distinguished only by
	// __X32_SYSCALL_BIT (0x40000000) set in seccomp_data.nr, which the table
	// generator bakes into the x32 numbers.  Thus x32 is merged into the x86_64
	// arch block via archProfile.extraTables rather than a separate arch.
	auditArchAARCH64     uint32 = emAARCH64 | emFlag64 | emFlagLE
	auditArchARM         uint32 = emARM | emFlagLE
	auditArchMIPS        uint32 = emMIPS
	auditArchMIPSEL      uint32 = emMIPS | emFlagLE
	auditArchMIPS64      uint32 = emMIPS | emFlag64
	auditArchMIPS64N32   uint32 = emMIPS | emFlag64 | emFlagN32
	auditArchMIPSEL64    uint32 = emMIPS | emFlag64 | emFlagLE
	auditArchMIPSEL64N32 uint32 = emMIPS | emFlag64 | emFlagLE | emFlagN32
)

// errno and mode-bit constants used by the chmod/xattr rules.  Values are the
// Linux generic ABI numbers (asm-generic/errno*.h), which are identical across
// the architectures Lix targets.
const (
	errEPERM   uint16 = 1
	errENOSYS  uint16 = 38
	errENOTSUP uint16 = 95 // == EOPNOTSUPP on Linux

	sISUID uint32 = 0o4000
	sISGID uint32 = 0o2000
)

// archProfile describes one arch block in the filter: the value the kernel
// reports in seccomp_data.arch, the primary syscall table, and any extra tables
// whose numbers share the same seccomp_data.arch namespace (e.g. x32, whose
// numbers carry __X32_SYSCALL_BIT and are matched under AUDIT_ARCH_X86_64).
type archProfile struct {
	name        string   // primary table name, e.g. "x86_64"
	auditArch   uint32   // the seccomp_data.arch value selecting this block
	extraTables []string // additional table names merged into this block's number space
}

// tableNames returns the primary table name followed by any extra tables.
func (p archProfile) tableNames() []string {
	return append([]string{p.name}, p.extraTables...)
}

// targetArches lists, per host nativeSystem, the set of ABIs whose syscall
// tables are compiled into the multi-arch filter.  This mirrors the
// seccomp_arch_add calls in compileSyscallFilter (linux.cc:468-494): each host
// includes its primary ABI plus the compat ABIs reachable from it.
var targetArches = map[string][]archProfile{
	"x86_64-linux": {
		// x32 numbers (with __X32_SYSCALL_BIT) share the X86_64 arch namespace.
		{name: "x86_64", auditArch: auditArchX86_64, extraTables: []string{"x32"}},
		{name: "x86", auditArch: auditArchI386},
	},
	"aarch64-linux": {
		{name: "aarch64", auditArch: auditArchAARCH64},
		{name: "arm", auditArch: auditArchARM},
	},
	"mips64-linux": {
		// n32 has a distinct audit arch (CONVENTION bit), so it is its own block.
		{name: "mips64", auditArch: auditArchMIPS64},
		{name: "mips", auditArch: auditArchMIPS},
		{name: "mips64n32", auditArch: auditArchMIPS64N32},
	},
	"mips64el-linux": {
		{name: "mips64el", auditArch: auditArchMIPSEL64},
		{name: "mipsel", auditArch: auditArchMIPSEL},
		{name: "mips64el-n32", auditArch: auditArchMIPSEL64N32},
	},
	"i686-linux": {
		{name: "x86", auditArch: auditArchI386},
	},
	"armv7l-linux": {
		{name: "arm", auditArch: auditArchARM},
	},
}