criu/images/seccomp.proto

// SPDX-License-Identifier: MIT

syntax = "proto2";

message seccomp_filter {
	required bytes		filter			= 1;
	optional uint32		prev			= 2;
	optional uint32		flags			= 3;
}

message seccomp_entry {
	repeated seccomp_filter		seccomp_filters	= 1;
}
images: re-license as Expat license (so-called MIT) This changes the license of all files in the images/ directory from GPLv2 to the Expat license (so-called MIT). According to git the files have been authored by: Abhishek Dubey Adrian Reber Alexander Mikhalitsyn Alice Frosi Andrei Vagin (Andrew Vagin, Andrey Vagin) Cyrill Gorcunov Dengguangxing Dmitry Safonov Guoyun Sun Kirill Tkhai Kir Kolyshkin Laurent Dufour Michael Holzheu Michał Cłapiński Mike Rapoport Nicolas Viennot Nikita Spiridonov Pavel Emelianov (Pavel Emelyanov) Pavel Tikhomirov Radostin Stoyanov rbruno@gsd.inesc-id.pt Sebastian Pipping Stanislav Kinsburskiy Tycho Andersen Valeriy Vdovin The Expat license (so-called MIT) can be found here: https://opensource.org/licenses/MIT According to that link the correct SPDX short identifier is 'MIT'. https://spdx.org/licenses/MIT.html Signed-off-by: Adrian Reber <areber@redhat.com> 2020-05-08 11:36:57 +00:00			`// SPDX-License-Identifier: MIT`

Add missing "proto2" syntax marker .. to address protobuf 3.x proto-c warnings Signed-off-by: Pavel Emelyanov <xemul@virtuozzo.com> 2016-07-01 21:49:54 +02:00			`syntax = "proto2";`

seccomp: add support for SECCOMP_MODE_FILTER This commit adds basic support for dumping and restoring seccomp filters via the new ptrace interface. There are two current known limitations with this approach: 1. This approach doesn't support restoring tasks who first do a seccomp() and then a setuid(); the test elaborates on this and I don't think it is tough to do, but it is not done yet. 2. Filters are compared via memcmp(), so two tasks which have the same parent task and install identical (via memory) filters will have those filters considered to be the "same". Since we force all tasks to have the same creds (including seccomp filters) right now, this isn't a problem. The approach used here is very similar to the cgroup approach: the actual filters are stored in a seccomp.img, and each task has an id that points to the part of the filter tree it needs to restore. This keeps us from dumping the same filter multiple times, since filters are inherited on fork. v2: * remove unused seccomp_filters field from struct rst_info * rework memory layout for passing filters to restorer blob * add a sanity check when finding inherited filters Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@parallels.com> 2015-11-16 22:17:45 -07:00			`message seccomp_filter {`
			`required bytes filter = 1;`
			`optional uint32 prev = 2;`
seccomp: Fetch seccomp flags if kernel provides Note that there is no real usage of this flag on restore, we simply save it in image and will make a real use later. Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com> Signed-off-by: Andrei Vagin <avagin@virtuozzo.com> 2018-05-07 11:42:44 +03:00			`optional uint32 flags = 3;`
seccomp: add support for SECCOMP_MODE_FILTER This commit adds basic support for dumping and restoring seccomp filters via the new ptrace interface. There are two current known limitations with this approach: 1. This approach doesn't support restoring tasks who first do a seccomp() and then a setuid(); the test elaborates on this and I don't think it is tough to do, but it is not done yet. 2. Filters are compared via memcmp(), so two tasks which have the same parent task and install identical (via memory) filters will have those filters considered to be the "same". Since we force all tasks to have the same creds (including seccomp filters) right now, this isn't a problem. The approach used here is very similar to the cgroup approach: the actual filters are stored in a seccomp.img, and each task has an id that points to the part of the filter tree it needs to restore. This keeps us from dumping the same filter multiple times, since filters are inherited on fork. v2: * remove unused seccomp_filters field from struct rst_info * rework memory layout for passing filters to restorer blob * add a sanity check when finding inherited filters Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> Signed-off-by: Pavel Emelyanov <xemul@parallels.com> 2015-11-16 22:17:45 -07:00			`}`

			`message seccomp_entry {`
			`repeated seccomp_filter seccomp_filters = 1;`
			`}`