enable building libseccomp from source (downloaded from github) if it is not already installed

.gitignore

@@ -0,0 +1,3 @@
+Cargo.lock
+target
+*~

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "libseccomp"]
+	path = libseccomp
+	url = https://github.com/seccomp/libseccomp.git

Cargo.toml

@@ -1,12 +1,16 @@
 [package]
-name = "seccomp-sys"
+name = "seccomp-droundy-sys"
 version = "0.1.2"
-authors = ["Alexander Polakov <apolyakov@beget.ru>"]
+authors = ["Alexander Polakov <apolyakov@beget.ru>", "David Roundy <daveroundy@gmail.com>"]
 license = "LGPL-2.1"
 keywords = ["linux", "seccomp"]
 description = "low-level bindings to libseccomp"
-repository = "https://github.com/polachok/seccomp-sys"
+repository = "https://github.com/droundy/seccomp-sys"
 readme = "README.md"
 
 [dependencies]
 libc = "0.2"
+
+[build-dependencies]
+pkg-config = "^0.3.9"
+gcc = "0.3"

README.md

@@ -1,9 +1,11 @@
-seccomp-sys
------------
+seccomp-droundy-sys
+-------------------
 
-Raw bindings to libseccomp. Requires [libseccomp](https://github.com/seccomp/libseccomp) to be installed.
+Raw bindings to libseccomp. Does not require
+[libseccomp](https://github.com/seccomp/libseccomp) to be installed,
+but instead compiles it from source if it is not installed.
 
-This library provides a high level interface to constructing, analyzing and installing seccomp filters via a BPF passed to the Linux Kernel's prctl() syscall.
+This is a fork of https://github.com/polachok/seccomp-sys.
 
-[Documentation](http://plhk.ru/static/doc/seccomp-sys/seccomp_sys/index.html)
+This library provides a high level interface to constructing, analyzing and installing seccomp filters via a BPF passed to the Linux Kernel's prctl() syscall.
 

build.rs

@@ -0,0 +1,58 @@
+extern crate pkg_config;
+extern crate gcc;
+
+use std::io::{Read,Write};
+
+fn main() {
+
+    if pkg_config::probe_library("libseccomp").is_err() {
+        // libseccomp is not installed as a system library... We thus
+        // need to build it from source.
+        if !std::path::Path::new("libseccomp/.git").exists() {
+            let _ = std::process::Command::new("git")
+                .args(&["submodule", "update", "--init"])
+                .status();
+        }
+
+        let src_dir = std::path::Path::new("libseccomp/src");
+
+        // I manually determine which files to compile, and then use
+        // the gcc crate, which *does* know how to cross-compile
+        // properly to do the actual building of the library.
+        let mut sources = Vec::new();
+        for f in src_dir.read_dir() {
+            for f in f.flat_map(|f| f.ok()) { // lazy way to ignore errors
+                if f.path().extension() == Some(std::ffi::OsStr::new("c"))
+                    && f.file_name() != std::ffi::OsStr::new("arch-syscall-check.c")
+                    && f.file_name() != std::ffi::OsStr::new("arch-syscall-dump.c") {
+                        sources.push(f.path());
+                    }
+            }
+        }
+        // I create an empty file named config.h, since libseccomp
+        // doesn't actually require anything in the config.h, just
+        // that it exist.
+        let out_dir = std::path::PathBuf::from(std::env::var("OUT_DIR").unwrap());
+        std::fs::File::create(out_dir.join("configure.h")).unwrap();
+
+        let mut header_in = std::fs::File::open(src_dir.join("../include/seccomp.h.in")).unwrap();
+        let mut contents = String::new();
+        header_in.read_to_string(&mut contents)
+            .expect("something went wrong reading the seccomp.h.in");
+        let contents = contents.replace("@VERSION_MAJOR@", "2");
+        let contents = contents.replace("@VERSION_MINOR@", "3");
+        let contents = contents.replace("@VERSION_MICRO@", "2");
+        {
+            let mut header_out = std::fs::File::create(out_dir.join("seccomp.h")).unwrap();
+            write!(header_out, "{}", contents).unwrap();
+        }
+
+        gcc::Build::new()
+            .files(sources)
+            .include(&out_dir)
+            .include(&src_dir)
+            .include(src_dir.join(".."))
+            .include(src_dir.join("../include"))
+            .compile("libseccomp.a");
+    }
+}

examples/kill-setuid.rs

@@ -1,19 +1,19 @@
 extern crate libc;
-extern crate seccomp_sys;
+extern crate seccomp_droundy_sys;
 
 fn main() {
     unsafe {
-        let context = seccomp_sys::seccomp_init(seccomp_sys::SCMP_ACT_ALLOW);
-        let comparator = seccomp_sys::scmp_arg_cmp {
+        let context = seccomp_droundy_sys::seccomp_init(seccomp_droundy_sys::SCMP_ACT_ALLOW);
+        let comparator = seccomp_droundy_sys::scmp_arg_cmp {
             arg: 0,
-            op: seccomp_sys::scmp_compare::SCMP_CMP_EQ,
+            op: seccomp_droundy_sys::scmp_compare::SCMP_CMP_EQ,
             datum_a: 1000,
             datum_b: 0,
         }; /* arg[0] equals 1000 */
 
         let syscall_number = 105; /* setuid on x86_64 */
-        assert!(seccomp_sys::seccomp_rule_add(context, seccomp_sys::SCMP_ACT_KILL, syscall_number, 1, comparator) == 0);
-        assert!(seccomp_sys::seccomp_load(context) == 0);
+        assert!(seccomp_droundy_sys::seccomp_rule_add(context, seccomp_droundy_sys::SCMP_ACT_KILL, syscall_number, 1, comparator) == 0);
+        assert!(seccomp_droundy_sys::seccomp_load(context) == 0);
         assert!(libc::setuid(1000) == 0); /* process would be killed here */
     }
 }

src/lib.rs

@@ -109,7 +109,6 @@ pub struct scmp_arg_cmp {
         pub datum_b: scmp_datum_t,
 }
 
-#[link(name = "seccomp")]
 extern {
     /**
      * Initialize the filter state