diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..16a4da0 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +Cargo.lock +target +*~ diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 0000000..d580103 --- /dev/null +++ b/.gitmodules @@ -0,0 +1,3 @@ +[submodule "libseccomp"] + path = libseccomp + url = https://github.com/seccomp/libseccomp.git diff --git a/Cargo.toml b/Cargo.toml index ed76a1e..c84b7e7 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,12 +1,16 @@ [package] -name = "seccomp-sys" +name = "seccomp-droundy-sys" version = "0.1.2" -authors = ["Alexander Polakov "] +authors = ["Alexander Polakov ", "David Roundy "] license = "LGPL-2.1" keywords = ["linux", "seccomp"] description = "low-level bindings to libseccomp" -repository = "https://github.com/polachok/seccomp-sys" +repository = "https://github.com/droundy/seccomp-sys" readme = "README.md" [dependencies] libc = "0.2" + +[build-dependencies] +pkg-config = "^0.3.9" +gcc = "0.3" diff --git a/README.md b/README.md index 9516dae..b05263f 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,11 @@ -seccomp-sys ------------ +seccomp-droundy-sys +------------------- -Raw bindings to libseccomp. Requires [libseccomp](https://github.com/seccomp/libseccomp) to be installed. +Raw bindings to libseccomp. Does not require +[libseccomp](https://github.com/seccomp/libseccomp) to be installed, +but instead compiles it from source if it is not installed. -This library provides a high level interface to constructing, analyzing and installing seccomp filters via a BPF passed to the Linux Kernel's prctl() syscall. +This is a fork of https://github.com/polachok/seccomp-sys. -[Documentation](http://plhk.ru/static/doc/seccomp-sys/seccomp_sys/index.html) +This library provides a high level interface to constructing, analyzing and installing seccomp filters via a BPF passed to the Linux Kernel's prctl() syscall. diff --git a/build.rs b/build.rs new file mode 100644 index 0000000..57987c3 --- /dev/null +++ b/build.rs @@ -0,0 +1,58 @@ +extern crate pkg_config; +extern crate gcc; + +use std::io::{Read,Write}; + +fn main() { + + if pkg_config::probe_library("libseccomp").is_err() { + // libseccomp is not installed as a system library... We thus + // need to build it from source. + if !std::path::Path::new("libseccomp/.git").exists() { + let _ = std::process::Command::new("git") + .args(&["submodule", "update", "--init"]) + .status(); + } + + let src_dir = std::path::Path::new("libseccomp/src"); + + // I manually determine which files to compile, and then use + // the gcc crate, which *does* know how to cross-compile + // properly to do the actual building of the library. + let mut sources = Vec::new(); + for f in src_dir.read_dir() { + for f in f.flat_map(|f| f.ok()) { // lazy way to ignore errors + if f.path().extension() == Some(std::ffi::OsStr::new("c")) + && f.file_name() != std::ffi::OsStr::new("arch-syscall-check.c") + && f.file_name() != std::ffi::OsStr::new("arch-syscall-dump.c") { + sources.push(f.path()); + } + } + } + // I create an empty file named config.h, since libseccomp + // doesn't actually require anything in the config.h, just + // that it exist. + let out_dir = std::path::PathBuf::from(std::env::var("OUT_DIR").unwrap()); + std::fs::File::create(out_dir.join("configure.h")).unwrap(); + + let mut header_in = std::fs::File::open(src_dir.join("../include/seccomp.h.in")).unwrap(); + let mut contents = String::new(); + header_in.read_to_string(&mut contents) + .expect("something went wrong reading the seccomp.h.in"); + let contents = contents.replace("@VERSION_MAJOR@", "2"); + let contents = contents.replace("@VERSION_MINOR@", "3"); + let contents = contents.replace("@VERSION_MICRO@", "2"); + { + let mut header_out = std::fs::File::create(out_dir.join("seccomp.h")).unwrap(); + write!(header_out, "{}", contents).unwrap(); + } + + gcc::Build::new() + .files(sources) + .include(&out_dir) + .include(&src_dir) + .include(src_dir.join("..")) + .include(src_dir.join("../include")) + .compile("libseccomp.a"); + } +} diff --git a/examples/kill-setuid.rs b/examples/kill-setuid.rs index 9cff181..9c194ba 100644 --- a/examples/kill-setuid.rs +++ b/examples/kill-setuid.rs @@ -1,19 +1,19 @@ extern crate libc; -extern crate seccomp_sys; +extern crate seccomp_droundy_sys; fn main() { unsafe { - let context = seccomp_sys::seccomp_init(seccomp_sys::SCMP_ACT_ALLOW); - let comparator = seccomp_sys::scmp_arg_cmp { + let context = seccomp_droundy_sys::seccomp_init(seccomp_droundy_sys::SCMP_ACT_ALLOW); + let comparator = seccomp_droundy_sys::scmp_arg_cmp { arg: 0, - op: seccomp_sys::scmp_compare::SCMP_CMP_EQ, + op: seccomp_droundy_sys::scmp_compare::SCMP_CMP_EQ, datum_a: 1000, datum_b: 0, }; /* arg[0] equals 1000 */ let syscall_number = 105; /* setuid on x86_64 */ - assert!(seccomp_sys::seccomp_rule_add(context, seccomp_sys::SCMP_ACT_KILL, syscall_number, 1, comparator) == 0); - assert!(seccomp_sys::seccomp_load(context) == 0); + assert!(seccomp_droundy_sys::seccomp_rule_add(context, seccomp_droundy_sys::SCMP_ACT_KILL, syscall_number, 1, comparator) == 0); + assert!(seccomp_droundy_sys::seccomp_load(context) == 0); assert!(libc::setuid(1000) == 0); /* process would be killed here */ } } diff --git a/libseccomp b/libseccomp new file mode 160000 index 0000000..9b01871 --- /dev/null +++ b/libseccomp @@ -0,0 +1 @@ +Subproject commit 9b01871813cae608dcab455098b83488fa4cf65f diff --git a/src/lib.rs b/src/lib.rs index f74ba92..b8746d1 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -109,7 +109,6 @@ pub struct scmp_arg_cmp { pub datum_b: scmp_datum_t, } -#[link(name = "seccomp")] extern { /** * Initialize the filter state