procd/jail/seccomp-inject.c, branch master

jail: skip Thumb injection on cores without Thumb state

2026-09-19T08:30:42Z

The top-level asm assembles a Thumb copy of the syscall and breakpoint snippets. An ARMv4 core has no Thumb state, so the assembler rejects both the .thumb switch and the Thumb SVC encoding and the gemini (fa526) build fails. Emit the Thumb snippets only where the ISA has Thumb: a core that cannot execute Thumb never has a tracee in it. Fixes: f15d0c407c09 ("jail: apply OCI seccomp filters via ptrace syscall injection") Signed-off-by: Daniel Golle

jail: force classic MIPS encoding for injected instructions

2026-09-13T11:40:03Z

On MIPS targets built with -mips16 the top-level asm inherits the command-line ISA, so the assembler rejects the syscall opcode and the build fails. Emit the snippet inside .set nomips16/.set nomicromips, which is also what the tracee needs: the injected code is entered at an even PC and therefore always decoded as classic MIPS. Fixes: f15d0c407c09 ("jail: apply OCI seccomp filters via ptrace syscall injection") Signed-off-by: Daniel Golle

jail: add seccomp trace, audit and complain modes

2026-08-21T04:31:30Z

Add a ptrace-based syscall tracer, selected via -m (enforce, trace, audit or complain) with -M naming an NDJSON log. Trace records every syscall, classifying each into a startup phase (linker, init, app) resolved from entry-point and libc breakpoints, so a generated profile can cover the application phase alone. Audit and complain run the real seccomp filter but rewrite its returns to SECCOMP_RET_TRACE, logging every denial; audit then enforces (errno or kill, including the two-stop errno arches), while complain permits and only records. Events stream to a udebug ring and, as a fallback, to the NDJSON file. procd's instance config gains seccomp_mode and seccomp_log, passed through to ujail as -m and -M. Signed-off-by: Daniel Golle

jail: apply OCI seccomp filters via ptrace syscall injection

2026-08-21T04:30:22Z

Arm the compiled cBPF profile by injecting prctl(NO_NEW_PRIVS) and seccomp(SET_MODE_FILTER) into the freshly-execve'd workload over ptrace. The child does PTRACE_TRACEME before its final execve; the parent catches the post-execve stop, drives the two syscalls via a temporary trap at the program counter, restores registers and code, then detaches. This installs the filter for static binaries too, closing the gap left by the dropped LD_PRELOAD installer (preload.c, seccomp.c and the shared library are removed). A dynamic binary needs extra loader and libc pre-main syscalls. They are granted once in a phase-1 app + linker_base filter, then revoked with deny deltas at the entry and main boundaries (located via AT_BASE/auxv and ELF marker addresses), each delta reverting to the profile default. Static and Go-style binaries collapse to fewer phases. NOTIFY or flag profiles still go in-process; audit and complain modes reuse the same staging to log denials. Signed-off-by: Daniel Golle