bend-osdev-bpf
Search uses release 0.1.0.0 · 317 definitions
Definitions (317)
- law validated_returns
- law validated_ignores_tail
- law ret_k
- law ja_skips
- law jeq_taken_skips
- law jeq_not_taken_skips
- law insn_round_trip
- law program_round_trip
- law octets_over_limita stored program with a byte at offset max (so more than max bytes) is refused, whatever its bytes
- law most_restrictive
- law combine_newer
- law combine_older
- law combine_assoc
- law action_round_trip
- law seccomp_validated_acts
- def rarpbpf(4), EXAMPLES: accept only Reverse ARP requests, as the manual writes it with BPF_STMT and BPF_JUMP (0x8035, ETHERTYPE_REVARP; 3, REVARP_REQUEST)
- def rarp_ops
- def hostsbpf(4): accept IP packets between 128.3.112.15 and 128.3.112.35
- def fingerbpf(4): accept TCP finger packets (port 79), skipping IP fragments, with the IP header length from BPF_LDX | BPF_MSH
- def pkt_rarpEthernet frames: a RARP request, an ARP request, and IPv4 TCP packets
- def pkt_arp
- def pkt_abfrom 128.3.112.15 to 128.3.112.35, and from 128.3.112.15 to 10.0.0.1
- def pkt_ac
- def pkt_fingerto TCP port 79; to port 80; a fragment to port 79; and to port 79 after a 24-byte IP header
- def pkt_web
- def pkt_frag
- def pkt_finger_opts
- law rarp_prepares
- law rarp_accepts
- law rarp_rejects_arp
- law hosts_accepts
- law hosts_rejects
- law finger_accepts
- law finger_accepts_options
- law finger_rejects_port
- law finger_rejects_fragment
- law short_packeta load past the end of the input answers 0
- law divide_by_zero_xso does a division by X = 0
- law length_load
- law scratch_and_aluM[15] = 5; X = 3; A = M[15] * X = 15; M[0] = X; X = M[15]; A = -(A - X)
- law validate_accepts
- law validate_empty
- law validate_too_long
- law validate_jump_out
- law validate_no_return
- law validate_scratch
- law validate_div_zero
- law decode_bad_opcode
- law program_bytes
- law program_bytes_back
- law octets_max_defaultthe default limit on stored programs: 8 bytes for each of BPF_MAXINSNS instructions (compared as U32, which holds both)
- law octets_limit_refuses
- law octets_limit_accepts
- def seccomp_exampleseccomp(2), EXAMPLES, install_filter(syscall_nr, t_arch, f_errno) with t_arch = AUDIT_ARCH_X86_64, so upper_nr_limit = X32_SYSCALL_BIT - 1: the call syscall_nr fails with f_errno, other calls are allowed, and another architecture or an x32 call (nr above the limit) kills the process
- def sc_call
- def denyERRNO(e) for system call nr, ALLOW for the others
- law seccomp_example_valid
- law seccomp_example_errno
- law seccomp_example_allow
- law seccomp_example_other_arch
- law seccomp_example_x32
- law seccomp_rejects_byte_load
- law seccomp_rejects_unaligned
- law stack_newest_on_tietwo filters with the same action: the newer one wins, with its data
- law stack_most_restrictive
- law stack_empty_allows
- law unknown_action_kills
- law install_path_limit
- law install_pushes
- law seccomp_rejects_mod
- law seccomp_example_writethe page's runs: ./a.out 1 0xC000003E 99 makes write (1) fail, and ./a.out 295 0xC000003E 99 leaves the calls whoami makes alone
- law seccomp_example_preadv
- law validate_mem_initscratch memory read before it is written: refused by default, on every path (here the jump past the store), and allowed by the permissive options
- law validate_mem_init_path
- law validate_mem_init_written
- law validate_mem_after_jumpcode after a jump is reached only by jumps to it; code after a return counts as reached from the return, as Linux counts it
- law validate_mem_after_return
- law validate_permissive
- law witness_skip_length
- law witness_octets_over
- law witness_rank_le
- law witness_rank_lt