seccomp

package

v0.4.0 Latest Latest Go to latest Published: Apr 13, 2025 License: MIT Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

git.gensokyo.uk/security/fortify

Documentation ¶

Overview ¶

Package seccomp provides filter presets and high level wrappers around libseccomp.

Index ¶

Constants
func GetOutput() func(v ...any)
func Load(opts FilterOpts) error
func NewFile(opts FilterOpts) proc.File
func SetOutput(f func(v ...any))
type Encoder
- func New(opts FilterOpts) *Encoder
- func (e *Encoder) Close() error
- func (e *Encoder) Read(p []byte) (n int, err error)
type File
- func (f *File) ErrCount() int
- func (f *File) Fulfill(ctx context.Context, dispatchErr func(error)) error
type FilterOpts
type LibraryError
- func (e *LibraryError) Error() string
- func (e *LibraryError) Is(err error) bool

Constants ¶

View Source

const (
	PresetStrict = FilterExt | FilterDenyNS | FilterDenyTTY | FilterDenyDevel
	PresetCommon = PresetStrict | FilterMultiarch
)

Variables ¶

This section is empty.

Functions ¶

func GetOutput ¶

func GetOutput() func(v ...any)

func Load ¶

func Load(opts FilterOpts) error

Load loads a filter into the kernel.

func NewFile ¶

func NewFile(opts FilterOpts) proc.File

NewFile returns an instance of exporter implementing proc.File.

func SetOutput ¶

func SetOutput(f func(v ...any))

Types ¶

type Encoder ¶

type Encoder struct {
	// contains filtered or unexported fields
}

An Encoder writes a BPF program to an output stream.

Methods of Encoder are not safe for concurrent use.

An Encoder must not be copied after first use.

func New ¶

func New(opts FilterOpts) *Encoder

New returns an inactive Encoder instance.

func (*Encoder) Close ¶

func (e *Encoder) Close() error

func (*Encoder) Read ¶

func (e *Encoder) Read(p []byte) (n int, err error)

type File ¶

type File struct {
	proc.BaseFile
	// contains filtered or unexported fields
}

File implements proc.File and provides access to the read end of exporter pipe.

func (*File) ErrCount ¶

func (f *File) ErrCount() int

func (*File) Fulfill ¶

func (f *File) Fulfill(ctx context.Context, dispatchErr func(error)) error

type FilterOpts ¶ added in v0.4.0

type FilterOpts = C.f_filter_opts

const (

	// FilterExt are project-specific extensions.
	FilterExt FilterOpts = C.F_EXT
	// FilterDenyNS denies namespace setup syscalls.
	FilterDenyNS FilterOpts = C.F_DENY_NS
	// FilterDenyTTY denies faking input.
	FilterDenyTTY FilterOpts = C.F_DENY_TTY
	// FilterDenyDevel denies development-related syscalls.
	FilterDenyDevel FilterOpts = C.F_DENY_DEVEL
	// FilterMultiarch allows multiarch/emulation.
	FilterMultiarch FilterOpts = C.F_MULTIARCH
	// FilterLinux32 sets PER_LINUX32.
	FilterLinux32 FilterOpts = C.F_LINUX32
	// FilterCan allows AF_CAN.
	FilterCan FilterOpts = C.F_CAN
	// FilterBluetooth allows AF_BLUETOOTH.
	FilterBluetooth FilterOpts = C.F_BLUETOOTH
)

type LibraryError ¶

type LibraryError struct {
	Prefix  string
	Seccomp syscall.Errno
	Errno   error
}

LibraryError represents a libseccomp error.

func (*LibraryError) Error ¶

func (e *LibraryError) Error() string

func (*LibraryError) Is ¶

func (e *LibraryError) Is(err error) bool

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL