syd 3.58.0

//
// Syd: rock-solid application kernel
// src/kernel/signalfd.rs: signalfd(2) and signalfd4(2) handlers
//
// Copyright (c) 2026 Ali Polatel <alip@chesswob.org>
//
// SPDX-License-Identifier: GPL-3.0

// SAFETY: This module has been liberated from unsafe code!
#![forbid(unsafe_code)]

use libc::{c_int, SIGKILL};
use libseccomp::ScmpNotifResp;
use nix::{errno::Errno, sys::signalfd::SfdFlags};

use crate::{
    confine::scmp_arch_sigstop,
    cookie::{safe_exit_group, safe_signalfd},
    log_enabled,
    path::XPath,
    req::UNotifyEventRequest,
    sandbox::{Action, Capability, SandboxGuard},
    syslog::LogLevel,
    warn, xfmt,
};

pub(crate) fn sys_signalfd(request: UNotifyEventRequest) -> ScmpNotifResp {
    syscall_handler!(request, |request: UNotifyEventRequest| {
        handle_signalfd(&request, 0 /*flags*/)
    })
}

pub(crate) fn sys_signalfd4(request: UNotifyEventRequest) -> ScmpNotifResp {
    syscall_handler!(request, |request: UNotifyEventRequest| {
        handle_signalfd(&request, request.scmpreq.data.args[3])
    })
}

fn handle_signalfd(request: &UNotifyEventRequest, flags: u64) -> Result<ScmpNotifResp, Errno> {
    let req = request.scmpreq;
    let fd = req.data.args[0];

    // Assert BPF enforcement.
    assert_ne!(
        fd & 0x80000000,
        0,
        "BUG: signalfd(2) handler called with invalid fd {fd:#x}, report a bug!"
    );

    // Linux validates size/mask and copies mask before checking flags.
    let mut mask = request.remote_sigmask(req.data.args[1], req.data.args[2])?;

    // Linux rejects unknown flag bits.
    let mut flags = to_sfd_flags(flags)?;

    // Linux requires fd to be -1 to create signalfd(2).
    if fd & 0xFFFFFFFF != 0xFFFFFFFF {
        return Err(Errno::EBADF);
    }

    let sandbox = request.get_sandbox();
    let force_cloexec = sandbox.flags.force_cloexec();
    let force_rand_fd = sandbox.flags.force_rand_fd();
    sandbox_signalfd(request, &sandbox)?;
    drop(sandbox); // release the read lock.

    // Linux ignores SIGKILL/SIGSTOP in mask.
    mask.del(SIGKILL);
    mask.del(scmp_arch_sigstop(req.data.arch));

    let cloexec = force_cloexec || flags.contains(SfdFlags::SFD_CLOEXEC);
    flags.insert(SfdFlags::SFD_CLOEXEC);

    let fd = safe_signalfd(mask, flags)?;

    request.send_fd(fd, cloexec, force_rand_fd)
}

#[expect(clippy::cognitive_complexity)]
fn sandbox_signalfd(
    request: &UNotifyEventRequest,
    sandbox: &SandboxGuard<'_>,
) -> Result<(), Errno> {
    let caps = Capability::CAP_CREATE;
    if sandbox.getcaps(caps).is_empty() {
        // Sandboxing is off.
        return Ok(());
    }

    let name = XPath::from_bytes(b"!signalfd");
    let action = sandbox.check_name(caps, name);

    if action.is_logging() && log_enabled!(LogLevel::Warn) {
        if sandbox.log_scmp() {
            warn!("ctx": "access", "cap": caps, "act": action,
                "sys": request.syscall, "path": &name,
                "tip": xfmt!("configure `allow/{caps}+{name}'"),
                "req": request);
        } else {
            warn!("ctx": "access", "cap": caps, "act": action,
                "sys": request.syscall, "path": &name,
                "tip": xfmt!("configure `allow/{caps}+{name}'"),
                "pid": request.scmpreq.pid);
        }
    }

    match action {
        Action::Allow | Action::Warn => Ok(()),
        Action::Deny | Action::Filter => Err(Errno::ENODEV),
        Action::Panic => panic!(),
        Action::Exit => safe_exit_group(Errno::ENODEV as i32),
        action => {
            // Stop|Kill
            let _ = request.kill(action);
            Err(Errno::ENODEV)
        }
    }
}

fn to_sfd_flags(arg: u64) -> Result<SfdFlags, Errno> {
    // Linux truncates upper bits.
    #[expect(clippy::cast_possible_truncation)]
    let flags = arg as c_int;

    // Reject invalid bits.
    SfdFlags::from_bits(flags).ok_or(Errno::EINVAL)
}