Skip to content

Commit d5efc18

Browse files
keszybzkeszybz
committed
seccomp-util, analyze: export comments as a help string
Just to make the whole thing easier for users.
1 parent 40eb6a8 commit d5efc18

File tree

4 files changed

+23
-19
lines changed

4 files changed

+23
-19
lines changed

‎man/systemd.exec.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1339,11 +1339,11 @@
13391339
</row>
13401340
<row>
13411341
<entry>@module</entry>
1342-
<entry>Kernel module control (<citerefentry project='man-pages'><refentrytitle>init_module</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>delete_module</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)</entry>
1342+
<entry>Loading and unloading of kernel modules (<citerefentry project='man-pages'><refentrytitle>init_module</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>delete_module</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)</entry>
13431343
</row>
13441344
<row>
13451345
<entry>@mount</entry>
1346-
<entry>File system mounting and unmounting (<citerefentry project='man-pages'><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)</entry>
1346+
<entry>Mounting and unmounting of file systems (<citerefentry project='man-pages'><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)</entry>
13471347
</row>
13481348
<row>
13491349
<entry>@network-io</entry>
@@ -1359,7 +1359,7 @@
13591359
</row>
13601360
<row>
13611361
<entry>@process</entry>
1362-
<entry>Process control, execution, namespaces (<citerefentry project='man-pages'><refentrytitle>clone</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>kill</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>namespaces</refentrytitle><manvolnum>7</manvolnum></citerefentry>, …</entry>
1362+
<entry>Process control, execution, namespaceing operations (<citerefentry project='man-pages'><refentrytitle>clone</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>kill</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>namespaces</refentrytitle><manvolnum>7</manvolnum></citerefentry>, …</entry>
13631363
</row>
13641364
<row>
13651365
<entry>@raw-io</entry>

‎src/analyze/analyze.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1280,6 +1280,7 @@ static void dump_syscall_filter(const SyscallFilterSet *set) {
12801280
const char *syscall;
12811281

12821282
printf("%s\n", set->name);
1283+
printf(" # %s\n", set->help);
12831284
NULSTR_FOREACH(syscall, set->value)
12841285
printf(" %s\n", syscall);
12851286
}

‎src/shared/seccomp-util.c‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -218,8 +218,8 @@ bool is_seccomp_available(void) {
218218

219219
const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
220220
[SYSCALL_FILTER_SET_DEFAULT] = {
221-
/* Default list: the most basic of operations */
222221
.name = "@default",
222+
.help = "System calls that are always permitted",
223223
.value =
224224
"clock_getres\0"
225225
"clock_gettime\0"
@@ -236,8 +236,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
236236
"time\0"
237237
},
238238
[SYSCALL_FILTER_SET_BASIC_IO] = {
239-
/* Basic IO */
240239
.name = "@basic-io",
240+
.help = "Basic IO",
241241
.value =
242242
"close\0"
243243
"dup2\0"
@@ -254,8 +254,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
254254
"writev\0"
255255
},
256256
[SYSCALL_FILTER_SET_CLOCK] = {
257-
/* Clock */
258257
.name = "@clock",
258+
.help = "Change the system time",
259259
.value =
260260
"adjtimex\0"
261261
"clock_adjtime\0"
@@ -264,8 +264,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
264264
"stime\0"
265265
},
266266
[SYSCALL_FILTER_SET_CPU_EMULATION] = {
267-
/* CPU emulation calls */
268267
.name = "@cpu-emulation",
268+
.help = "System calls for CPU emulation functionality",
269269
.value =
270270
"modify_ldt\0"
271271
"subpage_prot\0"
@@ -274,8 +274,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
274274
"vm86old\0"
275275
},
276276
[SYSCALL_FILTER_SET_DEBUG] = {
277-
/* Debugging/Performance Monitoring/Tracing */
278277
.name = "@debug",
278+
.help = "Debugging, performance monitoring and tracing functionality",
279279
.value =
280280
"lookup_dcookie\0"
281281
"perf_event_open\0"
@@ -289,8 +289,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
289289
"sys_debug_setcontext\0"
290290
},
291291
[SYSCALL_FILTER_SET_IO_EVENT] = {
292-
/* Event loop use */
293292
.name = "@io-event",
293+
.help = "Event loop system calls",
294294
.value =
295295
"_newselect\0"
296296
"epoll_create1\0"
@@ -308,9 +308,10 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
308308
"select\0"
309309
},
310310
[SYSCALL_FILTER_SET_IPC] = {
311-
/* Message queues, SYSV IPC or other IPC */
312311
.name = "@ipc",
313-
.value = "ipc\0"
312+
.help = "SysV IPC, POSIX Message Queues or other IPC",
313+
.value =
314+
"ipc\0"
314315
"memfd_create\0"
315316
"mq_getsetattr\0"
316317
"mq_notify\0"
@@ -336,24 +337,24 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
336337
"shmget\0"
337338
},
338339
[SYSCALL_FILTER_SET_KEYRING] = {
339-
/* Keyring */
340340
.name = "@keyring",
341+
.help = "Kernel keyring access",
341342
.value =
342343
"add_key\0"
343344
"keyctl\0"
344345
"request_key\0"
345346
},
346347
[SYSCALL_FILTER_SET_MODULE] = {
347-
/* Kernel module control */
348348
.name = "@module",
349+
.help = "Loading and unloading of kernel modules",
349350
.value =
350351
"delete_module\0"
351352
"finit_module\0"
352353
"init_module\0"
353354
},
354355
[SYSCALL_FILTER_SET_MOUNT] = {
355-
/* Mounting */
356356
.name = "@mount",
357+
.help = "Mounting and unmounting of file systems",
357358
.value =
358359
"chroot\0"
359360
"mount\0"
@@ -362,8 +363,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
362363
"umount\0"
363364
},
364365
[SYSCALL_FILTER_SET_NETWORK_IO] = {
365-
/* Network or Unix socket IO, should not be needed if not network facing */
366366
.name = "@network-io",
367+
.help = "Network or Unix socket IO, should not be needed if not network facing",
367368
.value =
368369
"accept4\0"
369370
"accept\0"
@@ -388,8 +389,9 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
388389
"socketpair\0"
389390
},
390391
[SYSCALL_FILTER_SET_OBSOLETE] = {
391-
/* Unusual, obsolete or unimplemented, some unknown even to libseccomp */
392+
/* some unknown even to libseccomp */
392393
.name = "@obsolete",
394+
.help = "Unusual, obsolete or unimplemented system calls",
393395
.value =
394396
"_sysctl\0"
395397
"afs_syscall\0"
@@ -417,8 +419,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
417419
"vserver\0"
418420
},
419421
[SYSCALL_FILTER_SET_PRIVILEGED] = {
420-
/* Nice grab-bag of all system calls which need superuser capabilities */
421422
.name = "@privileged",
423+
.help = "All system calls which need super-user capabilities",
422424
.value =
423425
"@clock\0"
424426
"@module\0"
@@ -459,8 +461,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
459461
"vhangup\0"
460462
},
461463
[SYSCALL_FILTER_SET_PROCESS] = {
462-
/* Process control, execution, namespaces */
463464
.name = "@process",
465+
.help = "Process control, execution, namespaceing operations",
464466
.value =
465467
"arch_prctl\0"
466468
"clone\0"
@@ -475,8 +477,8 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
475477
"vfork\0"
476478
},
477479
[SYSCALL_FILTER_SET_RAW_IO] = {
478-
/* Raw I/O ports */
479480
.name = "@raw-io",
481+
.help = "Raw I/O port access",
480482
.value =
481483
"ioperm\0"
482484
"iopl\0"

‎src/shared/seccomp-util.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ bool is_seccomp_available(void);
3434

3535
typedef struct SyscallFilterSet {
3636
const char *name;
37+
const char *help;
3738
const char *value;
3839
} SyscallFilterSet;
3940

0 commit comments

Comments
 (0)