alcove

@doc prctl(2): operations on a process

This function can be used to set BPF syscall filters on processes
(seccomp mode).

A list can be used for prctl operations requiring a C structure as
an argument. List elements are used to contiguously populate a buffer
(it is up to the caller to add padding):

* binary(): the element is copied directly into the buffer

  On return, the contents of the binary is returned to the caller.

* {ptr, N}: N bytes of memory is allocated and zeroed. The pointer is
  placed in the buffer.

  On return, the contents of the memory is returned to the caller.

* {ptr, binary()}

   Memory equal to the size of the binary is allocated and initialized
   with the contents of the binary.

   On return, the contents of the memory is returned to the caller.

== Support ==

* Linux

== Examples ==

To enforce a seccomp filter:

```
-module(seccomp).

-include_lib("alcove/include/alcove_seccomp.hrl").

-export([run/2, run/3, filter/3]).

-define(DENY_SYSCALL(Syscall), [
    ?BPF_JUMP(?BPF_JMP + ?BPF_JEQ + ?BPF_K, (Syscall), 0, 1),
    ?BPF_STMT(?BPF_RET + ?BPF_K, ?SECCOMP_RET_KILL)
]).

filter(Drv, Pid, Syscall) ->
    Arch = alcove:define(Drv, Pid, alcove:audit_arch()),
    NR = alcove:syscall_constant(Drv, Pid, syscall_constant, Syscall),

    [
        ?VALIDATE_ARCHITECTURE(Arch),
        ?EXAMINE_SYSCALL,
        ?DENY_SYSCALL(NR),
        ?BPF_STMT(?BPF_RET + ?BPF_K, ?SECCOMP_RET_ALLOW)
    ].

run(Drv, Pid) ->
    run(Drv, Pid, sys_getcwd).

run(Drv, Pid, Syscall) ->
    Filter = filter(Drv, Pid, Syscall),

    {ok, _, _, _, _, _} = alcove:prctl(Drv, Pid, pr_set_no_new_privs, 1, 0, 0, 0),
    Pad = (erlang:system_info({wordsize, external}) - 2) * 8,

    Prog = [
        <<(iolist_size(Filter) div 8):2/native-unsigned-integer-unit:8>>,
        <<0:Pad>>,
        {ptr, list_to_binary(Filter)}
    ],
    %% alcove:seccomp(Drv, Pid, seccomp_set_mode_filter, 0, Prog)
    alcove:prctl(Drv, Pid, pr_set_seccomp, seccomp_mode_filter, Prog, 0, 0).
'''

@see seccomp/5