~/jendhub

def example

bend-osdev-bpf@0.1.0.0 · check.bend:77

import bend-osdev-bpf@0.1.0.0/check.bend as Check
import Base
import bend-osdev-bpf@0.1.0.0/insn.bend as I
import bend-osdev-bpf@0.1.0.0/seccomp.bend as S

77# seccomp(2), EXAMPLES: install_filter(59, AUDIT_ARCH_X86_64, 99): execve
78# (59) fails with errno 99, other calls are allowed, and another
79# architecture or an x32 call kills the process
80def example() -> List<&2, I.BpfOp>:
81  [I.BpfLdAbs{I.BpfW{}, 4}, I.BpfJmp{I.BpfJeq{}, I.BpfK{S.seccomp_arch_x86_64()}, 0, 5}, I.BpfLdAbs{I.BpfW{}, 0}, I.BpfJmp{I.BpfJgt{}, I.BpfK{U32.sub(S.seccomp_x32_syscall_bit(), 1)}, 3, 0}, I.BpfJmp{I.BpfJeq{}, I.BpfK{59}, 0, 1}, I.BpfRet{I.BpfRetK{S.SeccompAction.to_u32(S.SeccompErrno{99})}}, I.BpfRet{I.BpfRetK{S.SeccompAction.to_u32(S.SeccompAllow{})}}, I.BpfRet{I.BpfRetK{S.SeccompAction.to_u32(S.SeccompKillProcess{})}}]

Uses (11)

Used by (1)