api: add an API to query the system's architecture

In C we add seccomp_arch_native(void), in Python we add Arch.system().
Both functions return an architecture token value.

Signed-off-by: Paul Moore <pmoore@redhat.com>

diff --git a/doc/Makefile b/doc/Makefile
index 348a04b4c0b8c712ec70ccbd2d5abb7fe94be37f..2c77ec94bcca9cce99562e9f62653aca46411d4c 100644 (file)
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -47,6 +47,8 @@ MAN3 = \
        man/man3/seccomp_attr_set.3 \
        man/man3/seccomp_attr_get.3 \
        man/man3/seccomp_arch_add.3 \
+       man/man3/seccomp_arch_exist.3 \
+       man/man3/seccomp_arch_native.3 \
        man/man3/seccomp_arch_remove.3 \
        man/man3/seccomp_merge.3
 

diff --git a/doc/man/man3/seccomp_arch_add.3 b/doc/man/man3/seccomp_arch_add.3
index 7315e9c9b6c3f2fcf5dd99ba524d99c66c8dd560..99d9cc77d6b8859a9463f2460b7874ed522b1826 100644 (file)
--- a/doc/man/man3/seccomp_arch_add.3
+++ b/doc/man/man3/seccomp_arch_add.3
@@ -1,8 +1,8 @@
-.TH "seccomp_arch_add" 3 "28 September 2012" "paul@paul-moore.com" "libseccomp Documentation"
+.TH "seccomp_arch_add" 3 "26 November 2012" "paul@paul-moore.com" "libseccomp Documentation"
 .\" //////////////////////////////////////////////////////////////////////////
 .SH NAME
 .\" //////////////////////////////////////////////////////////////////////////
-seccomp_arch_add, seccomp_arch_remove, seccomp_arch_exist \- Manage seccomp filter architectures
+seccomp_arch_add, seccomp_arch_remove, seccomp_arch_exist, seccomp_arch_native \- Manage seccomp filter architectures
 .\" //////////////////////////////////////////////////////////////////////////
 .SH SYNOPSIS
 .\" //////////////////////////////////////////////////////////////////////////
@@ -15,6 +15,7 @@ seccomp_arch_add, seccomp_arch_remove, seccomp_arch_exist \- Manage seccomp filt
 .B #define SCMP_ARCH_X86
 .B #define SCMP_ARCH_X86_64
 .sp
+.BI "uint32_t seccomp_arch_native();"
 .BI "int seccomp_arch_exist(const scmp_filter_ctx " ctx ", uint32_t " arch_token ");"
 .BI "int seccomp_arch_add(scmp_filter_ctx " ctx ", uint32_t " arch_token ");"
 .BI "int seccomp_arch_remove(scmp_filter_ctx " ctx ", uint32_t " arch_token ");"
@@ -41,7 +42,11 @@ should be the
 .BR SCMP_ARCH_*
 defined constants; with the
 .BR SCMP_ARCH_NATIVE
-constant always referring to the native compiled architecture.
+constant always referring to the native compiled architecture.  The
+.BR seccomp_arch_native ()
+function returns the system's architecture such that it will match one of the
+.BR SCMP_ARCH_*
+constants.
 .P
 When a seccomp filter is initialized with the call to
 .BR seccomp_init (3)

diff --git a/doc/man/man3/seccomp_arch_native.3 b/doc/man/man3/seccomp_arch_native.3
new file mode 100644 (file)
index 0000000..f72602b
--- /dev/null
+++ b/doc/man/man3/seccomp_arch_native.3
@@ -0,0 +1 @@
+.so man3/seccomp_arch_add.3

diff --git a/include/seccomp.h b/include/seccomp.h
index d9cf250a756baec4fc09c66f8322ba408b60cdac..b09f3d3750e493f36320db4d3a0046b4b074fd30 100644 (file)
--- a/include/seccomp.h
+++ b/include/seccomp.h
@@ -225,6 +225,14 @@ void seccomp_release(scmp_filter_ctx ctx);
  */
 int seccomp_merge(scmp_filter_ctx ctx_dst, scmp_filter_ctx ctx_src);
 
+/**
+ * Return the native architecture token
+ *
+ * This function returns the native architecture token value, e.g. SCMP_ARCH_*.
+ *
+ */
+uint32_t seccomp_arch_native(void);
+
 /**
  * Check to see if an existing architecture is present in the filter
  * @param ctx the filter context

diff --git a/src/api.c b/src/api.c
index cf6198277a4585dd88dfd10708c95270d6edadd8..8f4d46b8027aaa41439802f79a130cedd393e1f1 100644 (file)
--- a/src/api.c
+++ b/src/api.c
@@ -140,6 +140,12 @@ int seccomp_merge(scmp_filter_ctx ctx_dst, scmp_filter_ctx ctx_src)
        return db_col_merge(col_dst, col_src);
 }
 
+/* NOTE - function header comment in include/seccomp.h */
+uint32_t seccomp_arch_native(void)
+{
+       return arch_def_native.token;
+}
+
 /* NOTE - function header comment in include/seccomp.h */
 int seccomp_arch_exist(const scmp_filter_ctx ctx, uint32_t arch_token)
 {

diff --git a/src/python/libseccomp.pxd b/src/python/libseccomp.pxd
index 4faed03f3c88dbd6f98366774d673fbdd147a4c4..b5ca659336c5f9304fd818c5231be449b427e7c4 100644 (file)
--- a/src/python/libseccomp.pxd
+++ b/src/python/libseccomp.pxd
@@ -65,6 +65,7 @@ cdef extern from "seccomp.h":
 
     int seccomp_merge(scmp_filter_ctx ctx_dst, scmp_filter_ctx ctx_src)
 
+    uint32_t seccomp_arch_native()
     int seccomp_arch_exist(scmp_filter_ctx ctx, uint32_t arch_token)
     int seccomp_arch_add(scmp_filter_ctx ctx, uint32_t arch_token)
     int seccomp_arch_remove(scmp_filter_ctx ctx, uint32_t arch_token)

diff --git a/src/python/seccomp.pyx b/src/python/seccomp.pyx
index 30e28a0bf976d57a33b12df76ab0ba9cae3e67db..45a6f531ee370e7a868c13258a3aea69ae59dace 100644 (file)
--- a/src/python/seccomp.pyx
+++ b/src/python/seccomp.pyx
@@ -99,11 +99,18 @@ cdef class Arch:
     X86 - 32-bit x86
     X86_64 - 64-bit x86
     """
-
     NATIVE = libseccomp.SCMP_ARCH_NATIVE
     X86 = libseccomp.SCMP_ARCH_X86
     X86_64 = libseccomp.SCMP_ARCH_X86_64
 
+    def system(self):
+        """ Return the system's architecture
+
+        Description:
+        Return an integer value matching the native architecture.
+        """
+        return libseccomp.seccomp_arch_native()
+
 cdef class Attr:
     """ Python object representing the SyscallFilter attributes.
 

diff --git a/tests/16-arch-basic.c b/tests/16-arch-basic.c
index e053db209fc4bd4c5febac290a352106e8522fad..f2d122c0a496abcc12c7ee061eab81332ecfaa20 100644 (file)
--- a/tests/16-arch-basic.c
+++ b/tests/16-arch-basic.c
@@ -40,12 +40,12 @@ int main(int argc, char *argv[])
        if (ctx == NULL)
                goto out;
 
-       if (seccomp_arch_exist(ctx, SCMP_ARCH_X86) == -EEXIST) {
+       if (seccomp_arch_native() != SCMP_ARCH_X86) {
                rc = seccomp_arch_add(ctx, SCMP_ARCH_X86);
                if (rc != 0)
                        goto out;
        }
-       if (seccomp_arch_exist(ctx, SCMP_ARCH_X86_64) == -EEXIST) {
+       if (seccomp_arch_native() != SCMP_ARCH_X86_64) {
                rc = seccomp_arch_add(ctx, SCMP_ARCH_X86_64);
                if (rc != 0)
                        goto out;

diff --git a/tests/16-arch-basic.py b/tests/16-arch-basic.py
index eebe9a31bdc0412389eda6d75223c2bf93c3f80d..6103f67cbdbcd799078dfa4d74b349d17f96dd8a 100755 (executable)
--- a/tests/16-arch-basic.py
+++ b/tests/16-arch-basic.py
@@ -30,9 +30,9 @@ from seccomp import *
 
 def test(args):
     f = SyscallFilter(KILL)
-    if not f.exist_arch(Arch.X86):
+    if not Arch.system() == Arch.X86:
         f.add_arch(Arch.X86)
-    if not f.exist_arch(Arch.X86_64):
+    if not Arch.system() == Arch.X86_64:
         f.add_arch(Arch.X86_64)
     f.add_rule(ALLOW, "read", Arg(0, EQ, sys.stdin))
     f.add_rule(ALLOW, "write", Arg(0, EQ, sys.stdout))