From 5b7b3fa9a4d8ca4ad08d6648752e28ee66f0ffae Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 3 Feb 2025 18:10:29 +0900 Subject: helper/seccomp: implement reader interface via pipe This also does not require the libc tmpfile call. BPF programs emitted by libseccomp seems to be deterministic. The tests would catch regressions as it verifies the program against known good output backed by manual testing. Signed-off-by: Ophestra --- helper/seccomp/api.go | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 helper/seccomp/api.go (limited to 'helper/seccomp/api.go') diff --git a/helper/seccomp/api.go b/helper/seccomp/api.go new file mode 100644 index 00000000..5b4a42c3 --- /dev/null +++ b/helper/seccomp/api.go @@ -0,0 +1,51 @@ +package seccomp + +import ( + "errors" + "io" + "os" + "syscall" +) + +func Export(opts SyscallOpts) (f *os.File, err error) { + if f, err = tmpfile(); err != nil { + return + } + if err = exportFilter(f.Fd(), opts); err != nil { + return + } + _, err = f.Seek(0, io.SeekStart) + return +} + +/* +An Encoder writes a BPF program to an output stream. + +Methods of Encoder are not safe for concurrent use. + +An Encoder must not be copied after first use. +*/ +type Encoder struct { + *exporter +} + +func (e *Encoder) Read(p []byte) (n int, err error) { + if err = e.prepare(); err != nil { + return + } + return e.r.Read(p) +} + +func (e *Encoder) Close() error { + if e.r == nil { + return syscall.EINVAL + } + + // this hangs if the cgo thread fails to exit + return errors.Join(e.closeWrite(), <-e.exportErr) +} + +// New returns an inactive Encoder instance. +func New(opts SyscallOpts) *Encoder { + return &Encoder{newExporter(opts)} +} -- cgit v1.3.1