seccomp #

Seccomp policies compiled to classic BPF, with argument filters.

A policy is the OCI runtime specification's seccomp profile: a default action, and rules that each apply an action to a set of syscall names when every comparison on the syscall's arguments holds. Seccomp.compile turns a policy into the classic-BPF program seccomp(2) takes, Seccomp.install applies it to the calling process, and Seccomp.eval runs a program over a synthesised struct seccomp_data as the kernel does, so a policy is tested in memory on any host.

Installation #

opam install seccomp

Usage #

The rule moby's default profile gives clone for a caller without CAP_SYS_ADMIN: allowed only when no namespace flag is set, so a process that dropped its capabilities cannot regain a full set in a user namespace of its own.

# let aarch64 =
    Seccomp.Abi.v ~audit_arch:0xC00000B7l ~name:"SCMP_ARCH_AARCH64"
      [ ("clone", 220) ];;
val aarch64 : Seccomp.Abi.t = <abstr>
# let policy =
    Seccomp.v ~default_action:Seccomp.Errno
      ~syscalls:
        [
          Seccomp.rule ~action:Seccomp.Allow
            ~args:
              [
                Seccomp.arg ~index:0 ~value:0x7E020000L ~value_two:0L
                  ~op:Seccomp.Masked_eq ();
              ]
            [ "clone" ];
        ]
      ();;
val policy : Seccomp.t =
  {Seccomp.default_action = Seccomp.Errno; default_errno_ret = None;
   architectures = [];
   syscalls =
    [{Seccomp.names = ["clone"]; action = Seccomp.Allow; errno_ret = None;
      args =
       [{Seccomp.index = 0; value = 2114060288L; value_two = 0L;
         op = Seccomp.Masked_eq}]}]}
# let clone flags =
    Result.bind (Seccomp.compile ~abi:aarch64 policy) (fun program ->
        Seccomp.eval ~abi:aarch64 program ~nr:220 ~args:[ flags ]);;
val clone : int64 -> (Seccomp.action * int, string) result = <fun>
# clone 17L;;
- : (Seccomp.action * int, string) result = Ok (Seccomp.Allow, 0)
# clone 0x10000011L;;
- : (Seccomp.action * int, string) result = Ok (Seccomp.Errno, 1)

On Linux, Seccomp.install policy applies the same policy, compiled for the host, to the calling process.

Licence #

ISC