seccompiler 0.5.0

Provides easy-to-use seccomp-bpf jailing.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

// Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0 OR BSD-3-Clause

mod aarch64;
mod riscv64;
mod x86_64;

use crate::backend::TargetArch;
use std::collections::HashMap;

/// Creates and owns a mapping from the arch-specific syscall name to the right number.
#[derive(Debug)]
pub(crate) struct SyscallTable {
    map: HashMap<&'static str, i64>,
}

impl SyscallTable {
    pub fn new(arch: TargetArch) -> Self {
        Self {
            map: match arch {
                TargetArch::aarch64 => aarch64::make_syscall_table(),
                TargetArch::x86_64 => x86_64::make_syscall_table(),
                TargetArch::riscv64 => riscv64::make_syscall_table(),
            },
        }
    }

    /// Returns the arch-specific syscall number based on the given name.
    pub fn get_syscall_nr(&self, sys_name: &str) -> Option<i64> {
        self.map.get(sys_name).copied()
    }
}

#[cfg(test)]
mod tests {
    use super::SyscallTable;
    use crate::backend::TargetArch;

    #[test]
    fn test_get_syscall_nr() {
        // get number for a valid syscall
        let instance_x86_64 = SyscallTable::new(TargetArch::x86_64);
        let instance_aarch64 = SyscallTable::new(TargetArch::aarch64);
        let instance_riscv64 = SyscallTable::new(TargetArch::riscv64);

        assert_eq!(instance_x86_64.get_syscall_nr("close").unwrap(), 3);
        assert_eq!(instance_aarch64.get_syscall_nr("close").unwrap(), 57);
        assert_eq!(instance_riscv64.get_syscall_nr("close").unwrap(), 57);

        // invalid syscall name
        assert!(instance_x86_64.get_syscall_nr("nosyscall").is_none());
        assert!(instance_aarch64.get_syscall_nr("nosyscall").is_none());
        assert!(instance_riscv64.get_syscall_nr("nosyscall").is_none());
    }
}