introvirt::SystemCallFilter Class Reference

Base class for system call filtering. More...

#include <SystemCallFilter.hh>

Public Member Functions
void	mask (uint64_t mask)
	Mask incoming system calls with the given mask before checking for a match.
uint64_t	mask () const
	Get the mask that is in use by the filter.
void	enabled (bool enabled)
	Set if the filter is enabled.
bool	enabled () const
	Check if the filter is enabled.
bool	matches (const Event &event) const
	Check if the filter matches the given system call event.
bool	matches (const Vcpu &vcpu) const
	Check if the filter matches the given system call event.
void	set_32 (uint32_t index, bool enabled)
	Set a filter entry for 32-bit system calls.
void	set_64 (uint32_t index, bool enabled)
	Set a filter entry for 64-bit system calls.
void	clear ()
	Clear the filter.
	SystemCallFilter ()
	Construct a new System Call Filter object.
virtual	~SystemCallFilter ()
	Destroy the instance.

Detailed Description

Base class for system call filtering.

This class may be used on its own, but checks will be performed in libintrovirt rather than the hypervisor, which will perform worse.

Ideally, the hypervisor library exends this class, and has the hypervisor map in the bitmap page. Then, system call filtering can be performed at the hypervisor level, rather than in libintrovirt.

Constructor & Destructor Documentation

SystemCallFilter()

introvirt::SystemCallFilter::SystemCallFilter

(

)

Construct a new System Call Filter object.

~SystemCallFilter()

virtual introvirt::SystemCallFilter::~SystemCallFilter ( )

virtual

Destroy the instance.

Member Function Documentation

clear()

void introvirt::SystemCallFilter::clear

(

)

Clear the filter.

enabled() [1/2]

bool introvirt::SystemCallFilter::enabled

(

)

const

Check if the filter is enabled.

If the filter is not enabled, matches() will always return true.

Returns

true if the bitmap is enabled

false if the bitmap is not enabled

enabled() [2/2]

void introvirt::SystemCallFilter::enabled

(

bool

enabled

)

Set if the filter is enabled.

Parameters

enabled

If set to true, enable the bitmap

Examples

ivexec.cc.

mask() [1/2]

uint64_t introvirt::SystemCallFilter::mask

(

)

const

Get the mask that is in use by the filter.

Returns

the system call mask

mask() [2/2]

void introvirt::SystemCallFilter::mask

(

uint64_t

mask

)

Mask incoming system calls with the given mask before checking for a match.

This allows each check to be performed with a mask. For example, if the system call 0xABCD comes in, and the mask is set to 0xFF, the filter will attempt to match 0xCD.

Parameters

mask	The mask to set

matches() [1/2]

bool introvirt::SystemCallFilter::matches

(

const Event &

event

)

const

Check if the filter matches the given system call event.

matches() will always return true if the filter is not enabled.

Parameters

event

The incoming event

Returns

true if the event mathces out filter

false if the event does not match our filter

matches() [2/2]

bool introvirt::SystemCallFilter::matches

(

const Vcpu &

vcpu

)

const

Check if the filter matches the given system call event.

matches() will always return true if the filter is not enabled.

This version is more naive, and assumes the call number is held in rax.

Parameters

vcpu	The vcpu to check (syscall number read from vcpu registers)

Returns

true if the event matches our filter

false if the event does not match our filter

set_32()

void introvirt::SystemCallFilter::set_32	(	uint32_t	index,
		bool	enabled
	)

Set a filter entry for 32-bit system calls.

Parameters

index	The system call number to set
enabled	Set to true to enable intercepts for the given index

set_64()

void introvirt::SystemCallFilter::set_64	(	uint32_t	index,
		bool	enabled
	)

Set a filter entry for 64-bit system calls.

Parameters

index	The system call number to set
enabled	Set to true to enable intercepts for the given index

---

The documentation for this class was generated from the following file:

• /home/runner/work/IntroVirt/IntroVirt/include/introvirt/core/syscall/SystemCallFilter.hh