api: Add 2 fltatrs for managing unknown syscalls

Add two new filter attributes, SCMP_FLTATR_ACT_ENOSYS and
SCMP_FLTATR_CTL_KVER.  When SCMP_FLTATR_CTL_KVERMAX is set, then
libseccomp will handle syscalls as follows:

* syscalls with explicit actions set by the user will behave as
  before
* syscalls that are not explicitly called out by the user's filter
  but are valid for the specified kernel version will return the
  default filter action (SCMP_FLTATR_ACT_DEFAULT).
* syscalls that are newer than the specified kernel version will
  return the unknown filter action (SCMP_FLTATR_ACT_ENOSYS)

Note that setting the SCMP_FLTATR_CTL_KVERMAX can result in large
seccomp BPF filters.  It's recommended to also enable the binary
tree optimization (SCMP_FLTATR_CTL_OPTIMIZE = 2) to speed up
filter traversal in the kernel.

Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>

Author: drakenclimber

include/seccomp.h.in

@@ -79,6 +79,17 @@ enum scmp_filter_attr {
 					 */
 	SCMP_FLTATR_API_SYSRAWRC = 9,	/**< return the system return codes */
 	SCMP_FLTATR_CTL_WAITKILL = 10,	/**< request wait killable semantics */
+	SCMP_FLTATR_ACT_ENOSYS = 11,	/**< action to take when an unknown
+					 * (newer than this filter) syscall is
+					 * invoked.  Must be used in conjunction
+					 * with SCMP_FLTATR_CTL_KVER
+					 */
+	SCMP_FLTATR_CTL_KVERMAX = 12,	/**< maximum kernel version understood
+					 * by the user application.  syscalls
+					 * from newer kernel versions will
+					 * return with the action in
+					 * SCMP_FLTATR_ACT_UNKNOWN
+					 */
 	_SCMP_FLTATR_MAX,
 };
 

src/db.c

@@ -1073,6 +1073,8 @@ int db_col_reset(struct db_filter_col *col, uint32_t def_action)
 	col->attr.optimize = 1;
 	col->attr.api_sysrawrc = 0;
 	col->attr.wait_killable_recv = 0;
+	col->attr.act_enosys = SCMP_ACT_ERRNO(38);
+	col->attr.kvermax = SCMP_KV_UNDEF;
 
 	/* set the state */
 	col->state = _DB_STA_VALID;
@@ -1333,6 +1335,12 @@ int db_col_attr_get(const struct db_filter_col *col,
 	case SCMP_FLTATR_CTL_WAITKILL:
 		*value = col->attr.wait_killable_recv;
 		break;
+	case SCMP_FLTATR_ACT_ENOSYS:
+		*value = col->attr.act_enosys;
+		break;
+	case SCMP_FLTATR_CTL_KVERMAX:
+		*value = col->attr.kvermax;
+		break;
 	default:
 		rc = -EINVAL;
 		break;
@@ -1449,6 +1457,18 @@ int db_col_attr_set(struct db_filter_col *col,
 	case SCMP_FLTATR_CTL_WAITKILL:
 		col->attr.wait_killable_recv = (value ? 1 : 0);
 		break;
+	case SCMP_FLTATR_ACT_ENOSYS:
+		if (db_col_action_valid(col, value) == 0)
+			col->attr.act_enosys = value;
+		else
+			return -EINVAL;
+		db_col_precompute_reset(col);
+		break;
+	case SCMP_FLTATR_CTL_KVERMAX:
+		if (value <= SCMP_KV_UNDEF || value >=__SCMP_KV_MAX)
+			return -EINVAL;
+		col->attr.kvermax = value;
+		break;
 	default:
 		rc = -EINVAL;
 		break;

src/db.h

@@ -126,6 +126,13 @@ struct db_filter_attr {
 	uint32_t api_sysrawrc;
 	/* request SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV */
 	uint32_t wait_killable_recv;
+	/*
+	 * action to take if an unknown (newer than this filter) syscall is
+	 * invoked
+	 */
+	uint32_t act_enosys;
+	/* maximum kernel version understood by the userspace program */
+	uint32_t kvermax;
 };
 
 struct db_filter {

src/python/libseccomp.pxd

@@ -66,6 +66,8 @@ cdef extern from "seccomp.h":
         SCMP_FLTATR_CTL_OPTIMIZE
         SCMP_FLTATR_API_SYSRAWRC
         SCMP_FLTATR_CTL_WAITKILL
+        SCMP_FLTATR_ACT_ENOSYS
+        SCMP_FLTATR_CTL_KVERMAX
 
     cdef enum scmp_compare:
         SCMP_CMP_NE

src/python/seccomp.pyx

@@ -334,6 +334,8 @@ cdef class Attr:
                    2: binary tree sorted by syscall number
     API_SYSRAWRC - return the raw syscall codes
     CTL_WAITKILL - request wait killable semantics
+    ACT_ENOSYS - set the action to take for unknown (too new) syscalls
+    CTL_KVERMAX - the newest kernel version understood by the user application
     """
     ACT_DEFAULT = libseccomp.SCMP_FLTATR_ACT_DEFAULT
     ACT_BADARCH = libseccomp.SCMP_FLTATR_ACT_BADARCH
@@ -345,6 +347,8 @@ cdef class Attr:
     CTL_OPTIMIZE = libseccomp.SCMP_FLTATR_CTL_OPTIMIZE
     API_SYSRAWRC = libseccomp.SCMP_FLTATR_API_SYSRAWRC
     CTL_WAITKILL = libseccomp.SCMP_FLTATR_CTL_WAITKILL
+    ACT_ENOSYS = libseccomp.SCMP_FLTATR_ACT_ENOSYS
+    CTL_KVERMAX = libseccomp.SCMP_FLTATR_CTL_KVERMAX
 
 cdef class Arg:
     """ Python object representing a SyscallFilter syscall argument.