| 173 | |
| 174 | |
| 175 | Try<ContainerSeccompProfile::Syscall::Filter> parseSyscallFilter( |
| 176 | const JSON::Object& json, |
| 177 | bool* architectureMatched) |
| 178 | { |
| 179 | ContainerSeccompProfile::Syscall::Filter result; |
| 180 | |
| 181 | // Parse `arches` section which defines filtering rules by CPU architecture. |
| 182 | const auto arches = json.at<JSON::Array>("arches"); |
| 183 | if (arches.isError()) { |
| 184 | return Error(arches.error()); |
| 185 | } |
| 186 | |
| 187 | if (arches.isSome()) { |
| 188 | static const hashmap<string, ContainerSeccompProfile::Architecture> |
| 189 | architectures({{"x86", ContainerSeccompProfile::ARCH_X86}, |
| 190 | {"amd64", ContainerSeccompProfile::ARCH_X86_64}, |
| 191 | {"x32", ContainerSeccompProfile::ARCH_X32}, |
| 192 | {"arm", ContainerSeccompProfile::ARCH_ARM}, |
| 193 | {"arm64", ContainerSeccompProfile::ARCH_AARCH64}, |
| 194 | {"mips", ContainerSeccompProfile::ARCH_MIPS}, |
| 195 | {"mipsel", ContainerSeccompProfile::ARCH_MIPSEL}, |
| 196 | {"mips64", ContainerSeccompProfile::ARCH_MIPS64}, |
| 197 | {"mipsel64", ContainerSeccompProfile::ARCH_MIPSEL64}, |
| 198 | {"mips64n32", ContainerSeccompProfile::ARCH_MIPS64N32}, |
| 199 | {"mipsel64n32", ContainerSeccompProfile::ARCH_MIPSEL64N32}, |
| 200 | {"ppc", ContainerSeccompProfile::ARCH_PPC}, |
| 201 | {"ppc64le", ContainerSeccompProfile::ARCH_PPC64LE}, |
| 202 | {"s390", ContainerSeccompProfile::ARCH_S390}, |
| 203 | {"s390x", ContainerSeccompProfile::ARCH_S390X}}); |
| 204 | |
| 205 | foreach (const JSON::Value& item, arches->values) { |
| 206 | if (!item.is<JSON::String>()) { |
| 207 | return Error("'arches' contains non-string item"); |
| 208 | } |
| 209 | |
| 210 | const auto arch = item.as<JSON::String>().value; |
| 211 | if (!architectures.contains(arch)) { |
| 212 | return Error("Unknown architecture: '" + arch + "'"); |
| 213 | } |
| 214 | |
| 215 | Try<bool> nativeArch = |
| 216 | SeccompFilter::nativeArch(architectures.get(arch).get()); |
| 217 | |
| 218 | if (nativeArch.isError()) { |
| 219 | return Error(nativeArch.error()); |
| 220 | } |
| 221 | |
| 222 | *architectureMatched = nativeArch.get(); |
| 223 | if (*architectureMatched) { |
| 224 | break; |
| 225 | } |
| 226 | } |
| 227 | } |
| 228 | |
| 229 | // Parse `caps` section which defines filtering rules by Linux capabilities. |
| 230 | const auto caps = json.at<JSON::Array>("caps"); |
| 231 | if (caps.isError()) { |
| 232 | return Error(caps.error()); |