Skip to content

Commit 58a7c20

Browse files
pcmoorepcmoore
committed
api: add a seccomp_version() API call
This will allow callers to dynamically query the libseccomp library to determine the version information. We do not currently plan on exposing this API via any of the supported language bindings. Signed-off-by: Paul Moore <[email protected]>
1 parent d5fd8b9 commit 58a7c20

9 files changed

Lines changed: 210 additions & 4 deletions

File tree

‎doc/Makefile.am‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,5 @@ dist_man3_MANS = \
4242
man/man3/seccomp_syscall_resolve_name.3 \
4343
man/man3/seccomp_syscall_resolve_name_arch.3 \
4444
man/man3/seccomp_syscall_resolve_name_rewrite.3 \
45-
man/man3/seccomp_syscall_resolve_num_arch.3
45+
man/man3/seccomp_syscall_resolve_num_arch.3 \
46+
man/man3/seccomp_version.3

‎doc/man/man3/seccomp_version.3‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
.TH "seccomp_version" 3 "18 February 2016" "[email protected]" "libseccomp Documentation"
2+
.\" //////////////////////////////////////////////////////////////////////////
3+
.SH NAME
4+
.\" //////////////////////////////////////////////////////////////////////////
5+
seccomp_version \- Query the libseccomp version information
6+
.\" //////////////////////////////////////////////////////////////////////////
7+
.SH SYNOPSIS
8+
.\" //////////////////////////////////////////////////////////////////////////
9+
.nf
10+
.B #include <seccomp.h>
11+
.sp
12+
.B struct scmp_version {
13+
.B unsigned int major;
14+
.B unsigned int minor;
15+
.B unsigned int micro;
16+
.B }
17+
.sp
18+
.BI "const struct scmp_version *seccomp_version(" void ");"
19+
.sp
20+
Link with \fI\-lseccomp\fP.
21+
.fi
22+
.\" //////////////////////////////////////////////////////////////////////////
23+
.SH DESCRIPTION
24+
.\" //////////////////////////////////////////////////////////////////////////
25+
.P
26+
The
27+
.BR seccomp_version ()
28+
and
29+
.BR seccomp_reset ()
30+
functions return a pointer to a
31+
.B scmp_version
32+
struct which contains the version information of the currently loaded
33+
libseccomp library. This function can be used by applications that need to
34+
verify that they are linked to a specific libseccomp version at runtime.
35+
.P
36+
The caller should not attempt to free the returned
37+
.B scmp_version
38+
struct when finished.
39+
.\" //////////////////////////////////////////////////////////////////////////
40+
.SH RETURN VALUE
41+
.\" //////////////////////////////////////////////////////////////////////////
42+
The
43+
.BR seccomp_version ()
44+
function returns a pointer to a
45+
.B scmp_version
46+
structure on success, NULL on failure. The caller should not attempt to free
47+
the returned structure.
48+
.\" //////////////////////////////////////////////////////////////////////////
49+
.SH EXAMPLES
50+
.\" //////////////////////////////////////////////////////////////////////////
51+
.nf
52+
#include <seccomp.h>
53+
54+
int main(int argc, char *argv[])
55+
{
56+
const struct scmp_version *ver;
57+
58+
ver = seccomp_version();
59+
if (ver == NULL)
60+
goto err;
61+
62+
/* ... */
63+
64+
return 0;
65+
66+
err:
67+
return \-1;
68+
}
69+
.fi
70+
.\" //////////////////////////////////////////////////////////////////////////
71+
.SH NOTES
72+
.\" //////////////////////////////////////////////////////////////////////////
73+
.P
74+
While the seccomp filter can be generated independent of the kernel, kernel
75+
support is required to load and enforce the seccomp filter generated by
76+
libseccomp.
77+
.P
78+
The libseccomp project site, with more information and the source code
79+
repository, can be found at https://github.com/seccomp/libseccomp. This tool,
80+
as well as the libseccomp library, is currently under development, please
81+
report any bugs at the project site or directly to the author.
82+
.\" //////////////////////////////////////////////////////////////////////////
83+
.SH AUTHOR
84+
.\" //////////////////////////////////////////////////////////////////////////
85+
Paul Moore <[email protected]>
86+
.\" //////////////////////////////////////////////////////////////////////////
87+

‎include/seccomp.h.in‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,12 @@ extern "C" {
3939
#define SCMP_VER_MINOR @VERSION_MINOR@
4040
#define SCMP_VER_MICRO @VERSION_MICRO@
4141

42+
struct scmp_version {
43+
unsigned int major;
44+
unsigned int minor;
45+
unsigned int micro;
46+
};
47+
4248
/*
4349
* types
4450
*/
@@ -252,6 +258,15 @@ struct scmp_arg_cmp {
252258
* functions
253259
*/
254260

261+
/**
262+
* Query the library version information
263+
*
264+
* This function returns a pointer to a populated scmp_version struct, the
265+
* caller does not need to free the structure when finished.
266+
*
267+
*/
268+
const struct scmp_version *seccomp_version(void);
269+
255270
/**
256271
* Initialize the filter state
257272
* @param def_action the default filter action

‎src/api.c‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,12 @@
3838

3939
#define API __attribute__((visibility("default")))
4040

41+
const struct scmp_version library_version = {
42+
.major = SCMP_VER_MAJOR,
43+
.minor = SCMP_VER_MINOR,
44+
.micro = SCMP_VER_MICRO,
45+
};
46+
4147
/**
4248
* Validate a filter context
4349
* @param ctx the filter context
@@ -66,6 +72,12 @@ static int _syscall_valid(int syscall)
6672
return 0;
6773
}
6874

75+
/* NOTE - function header comment in include/seccomp.h */
76+
API const struct scmp_version *seccomp_version(void)
77+
{
78+
return &library_version;
79+
}
80+
6981
/* NOTE - function header comment in include/seccomp.h */
7082
API scmp_filter_ctx seccomp_init(uint32_t def_action)
7183
{

‎tests/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,4 @@ util.pyc
3535
28-sim-arch_x86
3636
29-sim-pseudo_syscall
3737
30-sim-socket_syscalls
38+
31-basic-version_check

‎tests/31-basic-version_check.c‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
/**
2+
* Seccomp Library test program
3+
*
4+
* Copyright (c) 2016 Red Hat <[email protected]>
5+
* Author: Paul Moore <[email protected]>
6+
*/
7+
8+
/*
9+
* This library is free software; you can redistribute it and/or modify it
10+
* under the terms of version 2.1 of the GNU Lesser General Public License as
11+
* published by the Free Software Foundation.
12+
*
13+
* This library is distributed in the hope that it will be useful, but WITHOUT
14+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
15+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
16+
* for more details.
17+
*
18+
* You should have received a copy of the GNU Lesser General Public License
19+
* along with this library; if not, see <http://www.gnu.org/licenses>.
20+
*/
21+
22+
#include <errno.h>
23+
#include <unistd.h>
24+
25+
#include <seccomp.h>
26+
27+
int main(int argc, char *argv[])
28+
{
29+
const struct scmp_version *ver;
30+
31+
ver = seccomp_version();
32+
if (ver == NULL)
33+
return -1;
34+
35+
if (ver->major != SCMP_VER_MAJOR ||
36+
ver->minor != SCMP_VER_MINOR ||
37+
ver->micro != SCMP_VER_MICRO)
38+
return -2;
39+
40+
return 0;
41+
}

‎tests/31-basic-version_check.py‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/usr/bin/env python
2+
3+
#
4+
# Seccomp Library test program
5+
#
6+
# Copyright (c) 2016 Red Hat <[email protected]>
7+
# Author: Paul Moore <[email protected]>
8+
#
9+
10+
#
11+
# This library is free software; you can redistribute it and/or modify it
12+
# under the terms of version 2.1 of the GNU Lesser General Public License as
13+
# published by the Free Software Foundation.
14+
#
15+
# This library is distributed in the hope that it will be useful, but WITHOUT
16+
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17+
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
18+
# for more details.
19+
#
20+
# You should have received a copy of the GNU Lesser General Public License
21+
# along with this library; if not, see <http://www.gnu.org/licenses>.
22+
#
23+
24+
import argparse
25+
import sys
26+
27+
import util
28+
29+
from seccomp import *
30+
31+
# NOTE: this is a NULL test since we don't support the seccomp_version() API
32+
# via the libseccomp python bindings
33+
34+
# kate: syntax python;
35+
# kate: indent-mode python; space-indent on; indent-width 4; mixedindent off;

‎tests/31-basic-version_check.tests‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#
2+
# libseccomp regression test automation data
3+
#
4+
# Copyright (c) 2016 Red Hat <[email protected]>
5+
# Author: Paul Moore <[email protected]>
6+
#
7+
8+
test type: basic
9+
10+
# Test command
11+
31-basic-version_check

‎tests/Makefile.am‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@ check_PROGRAMS = \
5858
27-sim-bpf_blk_state \
5959
28-sim-arch_x86 \
6060
29-sim-pseudo_syscall \
61-
30-sim-socket_syscalls
61+
30-sim-socket_syscalls \
62+
31-basic-version_check
6263

6364
EXTRA_DIST_TESTPYTHON = \
6465
util.py \
@@ -91,7 +92,8 @@ EXTRA_DIST_TESTPYTHON = \
9192
27-sim-bpf_blk_state.py \
9293
28-sim-arch_x86.py \
9394
29-sim-pseudo_syscall.py \
94-
30-sim-socket_syscalls.py
95+
30-sim-socket_syscalls.py \
96+
31-basic-version_check.py
9597

9698
EXTRA_DIST_TESTCFGS = \
9799
01-sim-allow.tests \
@@ -123,7 +125,8 @@ EXTRA_DIST_TESTCFGS = \
123125
27-sim-bpf_blk_state.tests \
124126
28-sim-arch_x86.tests \
125127
29-sim-pseudo_syscall.tests \
126-
30-sim-socket_syscalls.tests
128+
30-sim-socket_syscalls.tests \
129+
31-basic-version_check.tests
127130

128131
EXTRA_DIST_TESTSCRIPTS = regression testdiff testgen
129132

0 commit comments

Comments
 (0)