{"push_id":3409221269,"size":18,"distinct_size":18,"ref":"refs/heads/seccomp","head":"c2d0f37561a59a318eb83445ddeff76c289e851d","before":"93b36e2b705b5f6790da36c7e129fb46d3997138","commits":[{"sha":"92110de6c4960d8b39acc245a524b4cae364cad7","author":{"name":"Julian Stecklina","email":"93f8bb0eb2c659b85694486c41717eaf0fe23cd4@alien8.de"},"message":"Fixed basic seccomp filter for glibc\n\nSigned-off-by: Julian Stecklina <js@alien8.de>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/92110de6c4960d8b39acc245a524b4cae364cad7"},{"sha":"b23aad01b9c49afba9b6c35e311dd5b97bcf0b1d","author":{"name":"Julian Stecklina","email":"93f8bb0eb2c659b85694486c41717eaf0fe23cd4@alien8.de"},"message":"Fixed advanced seccomp filter for glibc\n\nSigned-off-by: Julian Stecklina <js@alien8.de>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/b23aad01b9c49afba9b6c35e311dd5b97bcf0b1d"},{"sha":"0bab4b1113bea5efdfc4725ca0548cd19f2bc63a","author":{"name":"Andreea Florescu","email":"f68a7d732e796861f8e79ea704b43a5ee52eddaf@amazon.com"},"message":"CI: added build tests for gnu target\n\nThe test_build cartesian product now also includes the build target.\n\nSigned-off-by: Andreea Florescu <fandree@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/0bab4b1113bea5efdfc4725ca0548cd19f2bc63a"},{"sha":"942f6c3bb43f03d8eb9722d4321ccca87fbb894e","author":{"name":"Julian Stecklina","email":"3a0b7f7e7482ac3ab28d6381fc9892b07df2c74c@amazon.de"},"message":"doc: add a section about building with glibc\n\nSigned-off-by: Julian Stecklina <jsteckli@amazon.de>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/942f6c3bb43f03d8eb9722d4321ccca87fbb894e"},{"sha":"f7464b56729f39341b853a2fbc5fb7154376d394","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp: build the 'basic' rule set starting...\n\n...from the 'advanced' one.\n\n* unify the high-level filter implementation into `SeccompFilterContext`\n  for simple-mode and advanced-mode alike\n* eliminate the `SeccompLevel` enum\n* eliminate the static syscall whitelist\n* make the rule priority no longer an `Option`\n* inline BPF macro-like functions\n* add `Display` trait for seccomp errors and unit test\n\nFixes #920\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/f7464b56729f39341b853a2fbc5fb7154376d394"},{"sha":"e9502a9cc89f0d618d7d845f49349184a3e145bf","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp: add more unit tests\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/e9502a9cc89f0d618d7d845f49349184a3e145bf"},{"sha":"e5dc221177ef8e0e1db358517bcfeaf1daabb7de","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"vmm: add more unit tests\n\nInlining THE `allow_syscall*` functions causes the number of LOC to\neffectively increase, therefore decreasing the coverage (even though\nthey're covered). So, we have to increase it somewhere else.\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/e5dc221177ef8e0e1db358517bcfeaf1daabb7de"},{"sha":"f056de354f47b1497db21ad6b231cede05a4e0f6","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp integ tests: remove `SeccompLevel` and...\n\n...refactor demo jailers to use the same syscall list for building the\nrules.\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/f056de354f47b1497db21ad6b231cede05a4e0f6"},{"sha":"e2b2071562f1074d95a8398f7fe415717548afc3","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp integ tests: rename demo_advanced_seccomp\n\n...to demo_seccomp, as it contains the code for both basic and advanced\nfiltering in the demo test jails.\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/e2b2071562f1074d95a8398f7fe415717548afc3"},{"sha":"ba686fcb773e35c293971644381d0e82762fb5db","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp integ tests: use a single fixture\n\nInstead of removing and rebuilding the demo binaries for the seccomp\ninteg tests, we can build them once and have them deleted at the end of\nthe session.\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/ba686fcb773e35c293971644381d0e82762fb5db"},{"sha":"7ca16c7a3268d4cf16006cc4be30334d8e4e70b8","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"integ tests: add src dir argument to cargo_build\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/7ca16c7a3268d4cf16006cc4be30334d8e4e70b8"},{"sha":"770fb9ffc2d9cb87ade89ff46d6615b3cc726509","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp integ tests: use `aux_bin_paths` fixture\n\nRenamed `demo_harmless_firecracker` and `demo_malicious_firecracker` to\n`demo_harmless` and `demo_malicious` respectively, as they have\nnothing to do with the Firecracker binary.\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/770fb9ffc2d9cb87ade89ff46d6615b3cc726509"},{"sha":"617d20b2fe1626e5d139172aa22df4a3e9401fd0","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp/aarch64: disable build warning\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/617d20b2fe1626e5d139172aa22df4a3e9401fd0"},{"sha":"2214b1e534c9d15d72d3df2f2aa678fc4ae90b7c","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp: allow SYS_open with any arguments\n\nThe code for allowing SYS_open was already there, followed by a list of\nseccomp rules that should have restricted it, but were no longer\napplicable. The correct behavior for this syscall is to let it through\nwith any arguments.\n\nFixes #972\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/2214b1e534c9d15d72d3df2f2aa678fc4ae90b7c"},{"sha":"25893ab8c6975210546a9042c13cea9fd6ac4641","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp: remove priority, add `allow_syscall_if`\n\n* replace `HashMap` with `BTreeMap` to have some idea of the order in\n  which the rules are added in the filter. In this case, they will be\n  added in the order of the syscall number. This is particularly useful\n  in tests, where we use the direct BPF representation to assert on the\n  builder's results.\n* allow_syscall_if is added for readability alongside `allow_syscall`.\n* new macros `and!` and `or!`, also added for readability, chain seccomp\n  conditions and rules, respectively, so that:\n  * conditions chained with `and!` are turned into a rule that will\n    allow the syscall iff _all_ the conditions apply;\n  * rules chained with `or!` stop the seccomp filter if at least one of\n    them is true.\n* discovered that the advanced filters for mmap were also moot as they\n  were overridden by a `vec![]`. Replaced with `allow_syscall`.\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/25893ab8c6975210546a9042c13cea9fd6ac4641"},{"sha":"183ea41c8307f61eeb01a4466f8713c6d55c11e7","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"seccomp: whitelist SYS_getrandom\n\nWe might not need the one coming from `clap`, but we still need it for\nMMDS because MMDS uses hashmaps and hashmaps in Rust do SYS_getrandom\nfor the hash function's random seed.\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/183ea41c8307f61eeb01a4466f8713c6d55c11e7"},{"sha":"190b3c12ffcbeb6b8aeb9365a4c7b461a0f5ddac","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"rename SeccompFilterContext to SeccompFilter\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/190b3c12ffcbeb6b8aeb9365a4c7b461a0f5ddac"},{"sha":"c2d0f37561a59a318eb83445ddeff76c289e851d","author":{"name":"Alexandra Iordache","email":"750ec4522de000f31ad44d64614ad5747f238032@amazon.com"},"message":"rename setup_seccomp to SeccompFilter::apply\n\nSigned-off-by: Alexandra Iordache <aghecen@amazon.com>","distinct":true,"url":"https://api.github.com/repos/aghecenco/firecracker/commits/c2d0f37561a59a318eb83445ddeff76c289e851d"}]}
{"actor":{"display_login":"aghecenco"}}