Struct seccompiler::SeccompFilter

pub struct SeccompFilter { /* private fields */ }

Filter containing rules assigned to syscall numbers.

Implementations

impl SeccompFilter

pub fn new( rules: BTreeMap<i64, Vec<SeccompRule>>, mismatch_action: SeccompAction, match_action: SeccompAction, target_arch: TargetArch ) -> Result<Self, Error>

Creates a new filter with a set of rules, an on-match and default action.

Arguments

• rules - Map containing syscall numbers and their respective SeccompRules.
• mismatch_action - SeccompAction taken for all syscalls that do not match any rule.
• match_action - SeccompAction taken for system calls that match the filter.
• target_arch - Target architecture of the generated BPF filter.

Example

use seccompiler::{
    SeccompAction, SeccompCmpArgLen, SeccompCmpOp, SeccompCondition, SeccompFilter, SeccompRule,
};
use std::convert::TryInto;

let filter = SeccompFilter::new(
    vec![
        (libc::SYS_accept4, vec![]),
        (
            libc::SYS_fcntl,
            vec![
                SeccompRule::new(vec![
                    SeccompCondition::new(
                        1,
                        SeccompCmpArgLen::Dword,
                        SeccompCmpOp::Eq,
                        libc::F_SETFD as u64,
                    )
                    .unwrap(),
                    SeccompCondition::new(
                        2,
                        SeccompCmpArgLen::Dword,
                        SeccompCmpOp::Eq,
                        libc::FD_CLOEXEC as u64,
                    )
                    .unwrap(),
                ])
                .unwrap(),
                SeccompRule::new(vec![SeccompCondition::new(
                    1,
                    SeccompCmpArgLen::Dword,
                    SeccompCmpOp::Eq,
                    libc::F_GETFD as u64,
                )
                .unwrap()])
                .unwrap(),
            ],
        ),
    ]
    .into_iter()
    .collect(),
    SeccompAction::Trap,
    SeccompAction::Allow,
    std::env::consts::ARCH.try_into().unwrap(),
);

Trait Implementations

impl Clone for SeccompFilter

fn clone(&self) -> SeccompFilter

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SeccompFilter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for SeccompFilter

fn eq(&self, other: &SeccompFilter) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl TryFrom<SeccompFilter> for BpfProgram

type Error = Error

The type returned in the event of a conversion error.

fn try_from(filter: SeccompFilter) -> Result<Self, Error>

Performs the conversion.

impl Eq for SeccompFilter

impl StructuralEq for SeccompFilter

impl StructuralPartialEq for SeccompFilter