python: Fix a typo in a comment

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Paul Moore <pmoore@redhat.com>
python: Fix a crash when resolve_syscall fails

Now it raises KeyError.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
configure: Add a fallback for missing _sifields._sigsys

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Add seccomp_sigsys_decode and seccomp_sigsys_set_return_value

This can decode a SIGSYS to a struct seccomp_data.  It shows the raw
(untranslated) values as opposed to the translated values.  For
example, socketcall will show up as socketcall.

Decoding can be used by itself to print useful error messages, and
decoding can be used in conjunction with
seccomp_sigsys_set_return_value to emulate trapped syscalls.

This supports x86_64, i386, and ARM if the syscall architecture
matches the libseccomp architecture.  It also supports i386 compat
syscalls with a 64-bit libseccomp.  (That is unlikely to happen
without either some kind of thunk library to load 32-bit code into a
64-bit process or explicit invocations of compat syscalls from
64-bit code.)  It should also work on x32, although I haven't tested
it.

(NB: ARM, in theory, supports syscalls with seven arguments.  The
only syscall like this is sys_syscall, which is (AFAICT) only exists
because it's awkward to implement syscall(2) on OABI without it.
seccomp does not, and probably never will, support filtering on the
seventh argument of sys_syscall, and there's little point for us to
have a nasty special case just to be able to decode it..)

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
python: Wrap syscall decoding and emulation

This attempts to be Pythonic rather than exposing the C API directly.
Use it like this:

import os
import seccomp
import errno

f = seccomp.SyscallFilter(seccomp.ALLOW)
f.add_rule(seccomp.TRAP, 'setgid')
f.add_rule(seccomp.TRAP, 'getgid')
f.load()

def handler(t):
    return -errno.ENOTTY
seccomp.set_trap_handler(handler)
try:
    os.setgid(99999)
except Exception, e:
    print 'setgid said %s' % e

print ''

seccomp.set_trap_handler(seccomp.trace_trapped_syscall)
def bad():
    print os.getgid()
bad()

This program will print:

setgid said [Errno 25] Inappropriate ioctl for device

Dying due to seccomp-blocked syscall
Traceback (most recent call last):
  File "test.py", line 23, in <module>
    bad()
  File "test.py", line 22, in bad
    print os.getgid()
getgid(0x0, 0x0, 0x4, 0x0, 0x0, 0x3CAEF13240)

(Note: those arguments are bogus.  A considerably fancier future version
 could know the syscall signatures and the mapping from raw to logical
 arguments to allow a nicer message like "... getgid()".  In the mean time,
 this makes debugging much easier.)

Signed-off-by: Andy Lutomirski <luto@amacapital.net>