1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
#!/usr/bin/ucode -R
import { readfile, writefile, basename, unlink } from 'fs';
const ACT_KILL = 'SCMP_ACT_KILL_PROCESS';
const ACT_ALLOW = 'SCMP_ACT_ALLOW';
function usage(name) {
if (name == 'trace2seccomp')
warn("usage: trace2seccomp [--merged|--two-phase] [-o out.json] <trace.ndjson>\n");
else
warn(sprintf("usage: %s <program> [args...]\n", name));
exit(1);
}
function shq(s) {
return "'" + replace(s, "'", "'\\''") + "'";
}
function invoked_name() {
let cmd = readfile('/proc/self/cmdline');
if (!cmd)
return basename(sourcepath());
let parts = split(cmd, '\x00');
while (length(parts) && parts[length(parts) - 1] == '')
pop(parts);
let idx = length(parts) - length(ARGV) - 1;
if (idx < 0)
return basename(sourcepath());
return basename(parts[idx]);
}
function collect(ndjson, want_phase) {
let seen = {};
for (let line in split(ndjson, '\n')) {
if (!length(line))
continue;
let ev;
try { ev = json(line); }
catch (e) { continue; }
if (type(ev) != 'object' || ev.event != 'syscall' || !ev.syscall)
continue;
if (want_phase && ev.phase != want_phase)
continue;
seen[ev.syscall] = true;
}
return sort(keys(seen));
}
function profile(names) {
return {
defaultAction: ACT_KILL,
syscalls: [ { names: names, action: ACT_ALLOW } ]
};
}
function emit(obj, outfile) {
let text = sprintf("%.J\n", obj);
if (!outfile) {
print(text);
return;
}
if (writefile(outfile, text) == null)
die(sprintf("cannot write %s\n", outfile));
}
function run_trace(prog, args) {
let tmp = sprintf("/tmp/.trace2seccomp.%d.ndjson", time());
let cmd = "ujail -m trace -M " + shq(tmp) + " -- " + shq(prog);
for (let a in args)
cmd += " " + shq(a);
system(cmd);
let nd = readfile(tmp);
unlink(tmp);
return nd;
}
function run_live(name) {
if (!length(ARGV))
usage(name);
let prog = ARGV[0];
let nd = run_trace(prog, slice(ARGV, 1));
if (nd == null)
die("no trace captured (did ujail run?)\n");
let out = sprintf("/tmp/%s.%d.json", basename(prog), time());
emit(profile(collect(nd, 'app')), out);
warn(sprintf("seccomp profile written to %s\n", out));
}
function run_offline() {
let merged, two_phase, outfile, infile;
let i = 0;
while (i < length(ARGV)) {
let a = ARGV[i];
if (a == '--merged')
merged = true;
else if (a == '--two-phase')
two_phase = true;
else if (a == '-o')
outfile = ARGV[++i];
else
infile = a;
i++;
}
if (!infile)
usage('trace2seccomp');
let nd = readfile(infile);
if (nd == null)
die(sprintf("cannot read %s\n", infile));
if (two_phase)
emit({ predl: profile(collect(nd, null)), postdl: profile(collect(nd, 'app')) }, outfile);
else if (merged)
emit(profile(collect(nd, null)), outfile);
else
emit(profile(collect(nd, 'app')), outfile);
}
let self = invoked_name();
if (self == 'utrace' || self == 'seccomp-trace')
run_live(self);
else
run_offline();
|
