hakoniwa 1.6.0

Process isolation for Linux using namespaces, resource limits, cgroups, landlock and seccomp.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

/// Represents a comparison operator which can be used in an ArgCmp.
#[derive(Hash, Eq, PartialEq, Clone, Copy, Debug)]
pub enum ArgCmpOp {
    Ne,
    Lt,
    Le,
    Eq,
    Gt,
    Ge,
    MaskedEq,
}

/// Represents an argument comparison rule.
#[derive(Hash, Eq, PartialEq, Clone, Copy, Debug)]
pub struct ArgCmp {
    pub(crate) arg: u32,
    pub(crate) op: ArgCmpOp,
    pub(crate) datum_a: u64,
    pub(crate) datum_b: u64,
}

impl ArgCmp {
    /// Creates and returns a new condition to attach to a filter rule.
    ///
    /// You can use the [scmp_argcmp!] macro instead of this to create ArgCmp
    /// in a more elegant way.
    ///
    /// [scmp_argcmp!]: crate::scmp_argcmp
    pub fn new(arg: u32, op: ArgCmpOp, datum_a: u64, datum_b: u64) -> Self {
        Self {
            arg,
            op,
            datum_a,
            datum_b,
        }
    }
}

impl std::fmt::Display for ArgCmp {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self.op {
            ArgCmpOp::Ne => write!(f, "${} != {}", self.arg, self.datum_a),
            ArgCmpOp::Lt => write!(f, "${} < {}", self.arg, self.datum_a),
            ArgCmpOp::Le => write!(f, "${} <= {}", self.arg, self.datum_a),
            ArgCmpOp::Eq => write!(f, "${} == {}", self.arg, self.datum_a),
            ArgCmpOp::Gt => write!(f, "${} > {}", self.arg, self.datum_a),
            ArgCmpOp::Ge => write!(f, "${} >= {}", self.arg, self.datum_a),
            ArgCmpOp::MaskedEq => write!(f, "${} & {} = {}", self.arg, self.datum_a, self.datum_b),
        }
    }
}

#[rustfmt::skip]
#[doc(hidden)]
#[macro_export]
macro_rules! scmp_argcmp_arg {
    (arg0) => { 0 };
    (arg1) => { 1 };
    (arg2) => { 2 };
    (arg3) => { 3 };
    (arg4) => { 4 };
    (arg5) => { 5 };
}

/// A macro to create [ArgCmp] in a more elegant way.
///
/// ```
/// use hakoniwa::{scmp_argcmp, seccomp::*};
///
/// assert_eq!(
///     scmp_argcmp!(arg0 != 123),
///     ArgCmp::new(0, ArgCmpOp::Ne, 123, 0),
/// );
/// assert_eq!(
///     scmp_argcmp!(arg1 < 123),
///     ArgCmp::new(1, ArgCmpOp::Lt, 123, 0),
/// );
/// assert_eq!(
///     scmp_argcmp!(arg2 <= 123),
///     ArgCmp::new(2, ArgCmpOp::Le, 123, 0),
/// );
/// assert_eq!(
///     scmp_argcmp!(arg3 == 123),
///     ArgCmp::new(3, ArgCmpOp::Eq, 123, 0),
/// );
/// assert_eq!(
///     scmp_argcmp!(arg4 > 123),
///     ArgCmp::new(4, ArgCmpOp::Gt, 123, 0),
/// );
/// assert_eq!(
///     scmp_argcmp!(arg5 >= 123),
///     ArgCmp::new(5, ArgCmpOp::Ge, 123, 0),
/// );
/// assert_eq!(
///     scmp_argcmp!(arg0 & 0b0010 == 123),
///     ArgCmp::new(0, ArgCmpOp::MaskedEq, 0b0010, 123),
/// );
/// ```
#[rustfmt::skip]
#[macro_export]
macro_rules! scmp_argcmp {
    ($arg:ident != $datum:expr) => {
        ArgCmp::new($crate::scmp_argcmp_arg!($arg), $crate::seccomp::ArgCmpOp::Ne, $datum, 0)
    };

    ($arg:ident < $datum:expr) => {
        ArgCmp::new($crate::scmp_argcmp_arg!($arg), $crate::seccomp::ArgCmpOp::Lt, $datum, 0)
    };

    ($arg:ident <= $datum:expr) => {
        ArgCmp::new($crate::scmp_argcmp_arg!($arg), $crate::seccomp::ArgCmpOp::Le, $datum, 0)
    };

    ($arg:ident == $datum:expr) => {
        ArgCmp::new($crate::scmp_argcmp_arg!($arg), $crate::seccomp::ArgCmpOp::Eq, $datum, 0)
    };

    ($arg:ident > $datum:expr) => {
        ArgCmp::new($crate::scmp_argcmp_arg!($arg), $crate::seccomp::ArgCmpOp::Gt, $datum, 0)
    };

    ($arg:ident >= $datum:expr) => {
        ArgCmp::new($crate::scmp_argcmp_arg!($arg), $crate::seccomp::ArgCmpOp::Ge, $datum, 0)
    };

    ($arg:ident & $mask:literal == $datum:expr) => {
        ArgCmp::new($crate::scmp_argcmp_arg!($arg), $crate::seccomp::ArgCmpOp::MaskedEq, $mask, $datum)
    };
}