Blob Blame History Raw
#
# pseudo filter code start
#
# filter for arch x86_64 (3221225534)
if ($arch == 3221225534)
  if ($syscall > 2)
    if ($syscall > 10)
      if ($syscall > 14)
        # filter for syscall "pwrite64" (18) [priority: 65531]
        if ($syscall == 18)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 107)
              if ($a1.hi32 == 0)
                if ($a1.lo32 == 108)
                  action ERRNO(18);
        # filter for syscall "pread64" (17) [priority: 65533]
        if ($syscall == 17)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 106)
              action ERRNO(17);
        # filter for syscall "ioctl" (16) [priority: 65535]
        if ($syscall == 16)
          action ERRNO(16);
        # filter for syscall "rt_sigreturn" (15) [priority: 65535]
        if ($syscall == 15)
          action ERRNO(15);
      else # ($syscall <= 14)
        # filter for syscall "rt_sigprocmask" (14) [priority: 65535]
        if ($syscall == 14)
          action ERRNO(14);
        # filter for syscall "rt_sigaction" (13) [priority: 65535]
        if ($syscall == 13)
          action ERRNO(13);
        # filter for syscall "brk" (12) [priority: 65535]
        if ($syscall == 12)
          action ERRNO(12);
        # filter for syscall "munmap" (11) [priority: 65535]
        if ($syscall == 11)
          action ERRNO(11);
    else # ($syscall <= 10)
      if ($syscall > 6)
        # filter for syscall "mprotect" (10) [priority: 65533]
        if ($syscall == 10)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 105)
              action ERRNO(10);
        # filter for syscall "mmap" (9) [priority: 65535]
        if ($syscall == 9)
          action ERRNO(9);
        # filter for syscall "lseek" (8) [priority: 65533]
        if ($syscall == 8)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 104)
              action ERRNO(8);
        # filter for syscall "poll" (7) [priority: 65535]
        if ($syscall == 7)
          action ERRNO(7);
      else # ($syscall <= 6)
        # filter for syscall "lstat" (6) [priority: 65535]
        if ($syscall == 6)
          action ERRNO(6);
        # filter for syscall "fstat" (5) [priority: 65533]
        if ($syscall == 5)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 103)
              action ERRNO(5);
        # filter for syscall "stat" (4) [priority: 65535]
        if ($syscall == 4)
          action ERRNO(4);
        # filter for syscall "close" (3) [priority: 65535]
        if ($syscall == 3)
          action ERRNO(3);
  else # ($syscall <= 2)
    # filter for syscall "open" (2) [priority: 65535]
    if ($syscall == 2)
      action ERRNO(2);
    # filter for syscall "write" (1) [priority: 65533]
    if ($syscall == 1)
      if ($a0.hi32 == 0)
        if ($a0.lo32 == 102)
          action ERRNO(1);
    # filter for syscall "read" (0) [priority: 65531]
    if ($syscall == 0)
      if ($a0.hi32 == 0)
        if ($a0.lo32 == 100)
          if ($a1.hi32 == 0)
            if ($a1.lo32 == 101)
              action ERRNO(0);
  # default action
  action ALLOW;
# filter for arch aarch64 (3221225655)
if ($arch == 3221225655)
  if ($syscall > 62)
    if ($syscall > 139)
      if ($syscall > 226)
        # filter for syscall "lstat" (4294957133) [priority: 65535]
        if ($syscall == 4294957133)
          action ERRNO(6);
        # filter for syscall "open" (4294957130) [priority: 65535]
        if ($syscall == 4294957130)
          action ERRNO(2);
        # filter for syscall "poll" (4294957127) [priority: 65535]
        if ($syscall == 4294957127)
          action ERRNO(7);
        # filter for syscall "stat" (4294957122) [priority: 65535]
        if ($syscall == 4294957122)
          action ERRNO(4);
      else # ($syscall <= 226)
        # filter for syscall "mprotect" (226) [priority: 65533]
        if ($syscall == 226)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 105)
              action ERRNO(10);
        # filter for syscall "mmap" (222) [priority: 65535]
        if ($syscall == 222)
          action ERRNO(9);
        # filter for syscall "munmap" (215) [priority: 65535]
        if ($syscall == 215)
          action ERRNO(11);
        # filter for syscall "brk" (214) [priority: 65535]
        if ($syscall == 214)
          action ERRNO(12);
    else # ($syscall <= 139)
      if ($syscall > 68)
        # filter for syscall "rt_sigreturn" (139) [priority: 65535]
        if ($syscall == 139)
          action ERRNO(15);
        # filter for syscall "rt_sigprocmask" (135) [priority: 65535]
        if ($syscall == 135)
          action ERRNO(14);
        # filter for syscall "rt_sigaction" (134) [priority: 65535]
        if ($syscall == 134)
          action ERRNO(13);
        # filter for syscall "fstat" (80) [priority: 65533]
        if ($syscall == 80)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 103)
              action ERRNO(5);
      else # ($syscall <= 68)
        # filter for syscall "pwrite64" (68) [priority: 65531]
        if ($syscall == 68)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 107)
              if ($a1.hi32 == 0)
                if ($a1.lo32 == 108)
                  action ERRNO(18);
        # filter for syscall "pread64" (67) [priority: 65533]
        if ($syscall == 67)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 106)
              action ERRNO(17);
        # filter for syscall "write" (64) [priority: 65533]
        if ($syscall == 64)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 102)
              action ERRNO(1);
        # filter for syscall "read" (63) [priority: 65531]
        if ($syscall == 63)
          if ($a0.hi32 == 0)
            if ($a0.lo32 == 100)
              if ($a1.hi32 == 0)
                if ($a1.lo32 == 101)
                  action ERRNO(0);
  else # ($syscall <= 62)
    # filter for syscall "lseek" (62) [priority: 65533]
    if ($syscall == 62)
      if ($a0.hi32 == 0)
        if ($a0.lo32 == 104)
          action ERRNO(8);
    # filter for syscall "close" (57) [priority: 65535]
    if ($syscall == 57)
      action ERRNO(3);
    # filter for syscall "ioctl" (29) [priority: 65535]
    if ($syscall == 29)
      action ERRNO(16);
  # default action
  action ALLOW;
# invalid architecture action
action KILL;
#
# pseudo filter code end
#