compiler

Documentation

Index

• Constants
• func Compile(policy tree.Policy) ([]unix.SockFilter, error)

Constants

const (
	SECCOMP_RET_KILL  = uint32(0x00000000) /* kill the task immediately */
	SECCOMP_RET_TRAP  = uint32(0x00030000) /* disallow and force a SIGSYS */
	SECCOMP_RET_ERRNO = uint32(0x00050000) /* returns an errno */
	SECCOMP_RET_TRACE = uint32(0x7ff00000) /* pass to a tracer or disallow */
	SECCOMP_RET_ALLOW = uint32(0x7fff0000) /* allow */
)

const BPF_MOD = 0x90

const BPF_XOR = 0xA0

const OP_ADD_X = syscall.BPF_ALU | syscall.BPF_ADD | syscall.BPF_X

const OP_AND_X = syscall.BPF_ALU | syscall.BPF_AND | syscall.BPF_X

const OP_DIV_X = syscall.BPF_ALU | syscall.BPF_DIV | syscall.BPF_X

const OP_JEQ_K = syscall.BPF_JMP | syscall.BPF_JEQ | syscall.BPF_K

const OP_JEQ_X = syscall.BPF_JMP | syscall.BPF_JEQ | syscall.BPF_X

const OP_JGE_X = syscall.BPF_JMP | syscall.BPF_JGE | syscall.BPF_X

const OP_JGT_X = syscall.BPF_JMP | syscall.BPF_JGT | syscall.BPF_X

const OP_JMP_K = syscall.BPF_JMP | syscall.BPF_JA

const OP_JSET_K = syscall.BPF_JMP | syscall.BPF_JSET | syscall.BPF_K

const OP_LOAD = syscall.BPF_LD | syscall.BPF_W | syscall.BPF_ABS

const OP_LOAD_MEM = syscall.BPF_LD | syscall.BPF_MEM

const OP_LOAD_MEM_X = syscall.BPF_LDX | syscall.BPF_MEM

const OP_LOAD_VAL = syscall.BPF_LD | syscall.BPF_IMM

const OP_LSH_X = syscall.BPF_ALU | syscall.BPF_LSH | syscall.BPF_X

const OP_MOD_X = syscall.BPF_ALU | BPF_MOD | syscall.BPF_X

const OP_MUL_X = syscall.BPF_ALU | syscall.BPF_MUL | syscall.BPF_X

const OP_OR_X = syscall.BPF_ALU | syscall.BPF_OR | syscall.BPF_X

const OP_RET_K = syscall.BPF_RET | syscall.BPF_K

const OP_RSH_X = syscall.BPF_ALU | syscall.BPF_RSH | syscall.BPF_X

const OP_STORE = syscall.BPF_ST

const OP_STORE_X = syscall.BPF_STX

const OP_SUB_X = syscall.BPF_ALU | syscall.BPF_SUB | syscall.BPF_X

const OP_XOR_X = syscall.BPF_ALU | BPF_XOR | syscall.BPF_X

Functions

func Compile

func Compile(policy tree.Policy) ([]unix.SockFilter, error)

Compile will take a parsed policy and generate an optimized sock filter for that policy The policy is assumed to have been unified and simplified before compilation starts - no unresolved variables or calls should exist in the policy.