Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RFE: implement range checks #94

Open
topimiettinen opened this issue Sep 10, 2017 · 1 comment · May be fixed by #95
Open

RFE: implement range checks #94

topimiettinen opened this issue Sep 10, 2017 · 1 comment · May be fixed by #95
Assignees
@pcmoore
Labels
enhancement priority/medium
Milestone
v2.7.0

Comments

@topimiettinen
Copy link

Please add support for checking (preferrably multiple and masked) range(s) of values. For example in systemd (systemd/systemd#6256) we'd like to construct a filter which only allows personality(2) with following use cases:

personality(0xffffffff) to query personality
personality(PER_LINUX) (or personality(PER_LINUX32)) for effectively no change to current personality

while blocking all other cases.

This could be implemented with new (optionally masked and/or negated) compare operations with multiple ranges complemented with a negative check: SCMP_CMP_MASKED_INRANGE, SCMP_CMP_MASKED_NOTINRANGE, SCMP_CMP_INRANGE and SCMP_CMP_NOTINRANGE.

#44 may be related.
This was referenced Sep 10, 2017
Closed
Closed
@pcmoore pcmoore self-assigned this Sep 11, 2017
topimiettinen added a commit to topimiettinen/libseccomp that referenced this issue Sep 17, 2017
@topimiettinen
Range ops
363dfca 
Add ops for checking whether arguments are in a specified range,
optionally negated and/or with mask: SCMP_CMP_{MASKED_}{NOT_}IN_RANGE.

Closes: seccomp#94

Signed-off-by: Topi Miettinen <[email protected]>
@topimiettinen topimiettinen linked a pull request Sep 17, 2017 that will close this issue
Open
@pcmoore pcmoore added this to the v2.5 milestone Jan 28, 2018
@pcmoore pcmoore modified the milestones: v2.5, v2.6 Aug 26, 2019
This was referenced Aug 19, 2020
Merged
Open
@pcmoore
Copy link
Member

pcmoore commented Jan 7, 2024

In an effort to get v2.6.0 out sooner than later, I'm going to suggest we push this out to v2.7.0; if you have any concerns or objections please drop a comment.

@pcmoore pcmoore modified the milestones: v2.6.0, v2.7.0 Jan 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@pcmoore pcmoore

Labels
enhancement priority/medium
Projects
None yet
Milestone
v2.7.0
Development

Successfully merging a pull request may close this issue.

RFE: syscall argument range checking ops topimiettinen/libseccomp
2 participants
@pcmoore @topimiettinen