enosys: add functionality to dump filter

Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>

diff --git a/bash-completion/enosys b/bash-completion/enosys
index 7ce7609a755a915c0ca47399c8ada3650d88602e..24971c349d42846f416766ef1b5f7ff4f4790c14 100644 (file)
--- a/bash-completion/enosys
+++ b/bash-completion/enosys
@@ -16,6 +16,8 @@ _waitpid_module()
                        ;;
                '-m'|'--list-ioctl')
                        return 0
+               '-d'|'--dump')
+                       return 0
                        ;;
                '-h'|'--help'|'-V'|'--version')
                        return 0
@@ -27,6 +29,7 @@ _waitpid_module()
                                --ioctl
                                --list
                                --list-ioctl
+                               --dump
                                --help
                                --version"
                        COMPREPLY=( $(compgen -W "${OPTS[*]}" -- $cur) )

diff --git a/misc-utils/enosys.1.adoc b/misc-utils/enosys.1.adoc
index a9bc693b1eb3cad51732e51b504d37c0ece37c95..71452e078ea6caca661c3408b9cf9afe5f8bf500 100644 (file)
--- a/misc-utils/enosys.1.adoc
+++ b/misc-utils/enosys.1.adoc
@@ -36,6 +36,11 @@ List syscalls known to *enosys*.
 *-m*, *--list-ioctl*::
 List ioctls known to *enosys*.
 
+*-d*, *--dump*::
+Dump seccomp bytecode filter to standard output.
++
+The dump can for example be used by *setpriv --seccomp-filter*.
+
 include::man-common/help-version.adoc[]
 
 == EXIT STATUS

diff --git a/misc-utils/enosys.c b/misc-utils/enosys.c
index b806c7054b147d61a8eb40e8028b5c23548907d6..d6a518e21646953cfc21f423091bddba2d4cdef2 100644 (file)
--- a/misc-utils/enosys.c
+++ b/misc-utils/enosys.c
@@ -35,6 +35,7 @@
 #include "xalloc.h"
 #include "strutils.h"
 #include "seccomp.h"
+#include "all-io.h"
 
 #define IS_LITTLE_ENDIAN (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
 
@@ -77,6 +78,7 @@ static void __attribute__((__noreturn__)) usage(void)
        fputs(_(" -s, --syscall           syscall to block\n"), out);
        fputs(_(" -i, --ioctl             ioctl to block\n"), out);
        fputs(_(" -l, --list              list known syscalls\n"), out);
+       fputs(_(" -d, --dump              dump seccomp bytecode\n"), out);
 
        fputs(USAGE_SEPARATOR, out);
        fprintf(out, USAGE_HELP_OPTIONS(25));
@@ -95,12 +97,13 @@ int main(int argc, char **argv)
 {
        int c;
        size_t i;
-       bool found;
+       bool found, dump = false;
        static const struct option longopts[] = {
                { "syscall",    required_argument, NULL, 's' },
                { "ioctl",      required_argument, NULL, 'i' },
                { "list",       no_argument,       NULL, 'l' },
                { "list-ioctl", no_argument,       NULL, 'm' },
+               { "dump",       no_argument,       NULL, 'd' },
                { "version",    no_argument,       NULL, 'V' },
                { "help",       no_argument,       NULL, 'h' },
                { 0 }
@@ -119,7 +122,7 @@ int main(int argc, char **argv)
        bindtextdomain(PACKAGE, LOCALEDIR);
        textdomain(PACKAGE);
 
-       while ((c = getopt_long (argc, argv, "+Vhs:i:lm", longopts, NULL)) != -1) {
+       while ((c = getopt_long (argc, argv, "+Vhs:i:lmd", longopts, NULL)) != -1) {
                switch (c) {
                case 's':
                        found = 0;
@@ -167,6 +170,9 @@ int main(int argc, char **argv)
                        for (i = 0; lt(i, ARRAY_SIZE(ioctls)); i++)
                                printf("%5ld %s\n", ioctls[i].number, ioctls[i].name);
                        return EXIT_SUCCESS;
+               case 'd':
+                       dump = true;
+                       break;
                case 'V':
                        print_version(EXIT_SUCCESS);
                case 'h':
@@ -176,7 +182,7 @@ int main(int argc, char **argv)
                }
        }
 
-       if (optind >= argc)
+       if (!dump && optind >= argc)
                errtryhelp(EXIT_FAILURE);
 
        struct sock_filter filter[BPF_MAXINSNS];
@@ -233,6 +239,12 @@ int main(int argc, char **argv)
 
        INSTR(BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW));
 
+       if (dump) {
+               if (write_all(STDOUT_FILENO, filter, (f - filter) * sizeof(filter[0])))
+                       err(EXIT_FAILURE, _("Could not dump seccomp filter"));
+               return EXIT_SUCCESS;
+       }
+
        struct sock_fprog prog = {
                .len    = f - filter,
                .filter = filter,