logswan

commit 764d332dfba248e1e688fb25325d788536b38661
parent bc4aec062d7767f0ef252c8c52864b968c7bc303
Author: Frederic Cambus <fred@statdns.com>
Date:   Sat, 26 Oct 2019 17:53:06 +0200

Define and use the LOGSWAN_ALLOW_SYSCALL macro to make code more readable.

Diffstat:
M
src/seccomp.h
 | 
51
++++++++++++++++++++-------------------------------

1 file changed, 20 insertions(+), 31 deletions(-)
diff --git a/src/seccomp.h b/src/seccomp.h
@@ -4,7 +4,7 @@
  * https://www.logswan.org
  *
  * Created:      2015-05-31
- * Last Updated: 2019-10-23
+ * Last Updated: 2019-10-26
  *
  * Logswan is released under the BSD 2-Clause license.
  * See LICENSE file for details.
@@ -18,39 +18,28 @@
 #include <linux/filter.h>
 #include <linux/seccomp.h>
 
+#define LOGSWAN_ALLOW_SYSCALL(syscall) \
+	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_##syscall, 0, 1), \
+	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
+
 static struct sock_filter filter[] = {
 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)),
 
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_brk, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_close, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_dup, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_exit_group, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_fcntl, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_fstat, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_ioctl, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_lseek, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_open, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_openat, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_mmap, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_munmap, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_read, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_write, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_writev, 0, 1),
-	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
+	LOGSWAN_ALLOW_SYSCALL(brk),
+	LOGSWAN_ALLOW_SYSCALL(close),
+	LOGSWAN_ALLOW_SYSCALL(dup),
+	LOGSWAN_ALLOW_SYSCALL(exit_group),
+	LOGSWAN_ALLOW_SYSCALL(fcntl),
+	LOGSWAN_ALLOW_SYSCALL(fstat),
+	LOGSWAN_ALLOW_SYSCALL(ioctl),
+	LOGSWAN_ALLOW_SYSCALL(lseek),
+	LOGSWAN_ALLOW_SYSCALL(open),
+	LOGSWAN_ALLOW_SYSCALL(openat),
+	LOGSWAN_ALLOW_SYSCALL(mmap),
+	LOGSWAN_ALLOW_SYSCALL(munmap),
+	LOGSWAN_ALLOW_SYSCALL(read),
+	LOGSWAN_ALLOW_SYSCALL(write),
+	LOGSWAN_ALLOW_SYSCALL(writev),
 
 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
 };