seccomp: add aarch64 architecture identifier
@@ -283,12 +283,19 @@ const SECCOMP_RET_TRACE: u32 = 0x7ff0_0000;
const SECCOMP_RET_TRAP: u32 = 0x0003_0000;
const SECCOMP_RET_MASK: u32 = 0x0000_ffff;
-// x86_64 architecture identifier.
+// Architecture identifier.
// See /usr/include/linux/audit.h .
+
+#[cfg(target_arch = "x86_64")]
// Defined as:
// `#define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)`
const AUDIT_ARCH_X86_64: u32 = 62 | 0x8000_0000 | 0x4000_0000;
+#[cfg(target_arch = "aarch64")]
+// Defined as:
+// `#define AUDIT_ARCH_AARCH64 (EM_AARCH64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)`
+const AUDIT_ARCH_AARCH64: u32 = 183 | 0x8000_0000 | 0x4000_0000;
+
// The maximum number of a syscall argument.
// A syscall can have at most 6 arguments.
// Arguments are numbered from 0 to 5.
@@ -848,7 +855,6 @@ impl SeccompFilter {
///
pub fn apply(self) -> Result<()> {
let mut bpf_filter = Vec::new();
-
bpf_filter.extend(VALIDATE_ARCHITECTURE());
bpf_filter.extend(self.into_bpf().map_err(|_| Error::Load(libc::EINVAL))?);
@@ -1026,7 +1032,10 @@ fn BPF_STMT(code: u16, k: u32) -> sock_filter {
fn VALIDATE_ARCHITECTURE() -> Vec<sock_filter> {
vec![
BPF_STMT(BPF_LD + BPF_W + BPF_ABS, 4),
+ #[cfg(target_arch = "x86_64")]
BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, AUDIT_ARCH_X86_64, 1, 0),
+ #[cfg(target_arch = "aarch64")]
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, AUDIT_ARCH_AARCH64, 1, 0),
BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_KILL),
]
}
@@ -1280,7 +1289,10 @@ mod tests {
code: 21,
jt: 1,
jf: 0,
- k: 0xC000_003E,
+ #[cfg(target_arch = "x86_64")]
+ k: AUDIT_ARCH_X86_64,
+ #[cfg(target_arch = "aarch64")]
+ k: AUDIT_ARCH_AARCH64,
},
sock_filter {
code: 6,
