Add condition operator to accepts list of values

[luben karavelov]

Currently it is not possible to only allow certain values in a filter that is permissive. If we had x in [values] and x not_in [values] operators, it would be possible to express such conditions. Currently we have to list all values that we want to deny. Example of the proposed:

"enable_only_inet": {
  "mismatch_action": "allow",
  "match_action": { "errno": 1},
  "filter": [
     {
       "syscall": "socket",
       "args": [
          {
            "index": 0,
            "type": "dword",
            "op", "not_in"
            "val": [2, 10],
            "comment": "deny all except AF_INET or AF_INET6"
          }
        ]
     }
   ]
}

[Alin Dima]

If I understand correctly, you want a filter that allows everything, except for the socket syscalls with types AF_INET and AF_INET6?

However, you can write it as:

"enable_only_inet": {
  "mismatch_action": "allow",
  "match_action": { "errno": 1 },
  "filter": [
     {
        "syscall": "socket",
        "args": [
          {
            "index": 0,
            "type": "dword",
            "op": "eq"
            "val": 2
          }
        ]
     },
     {
        "syscall": "socket",
        "args": [
          {
            "index": 0,
            "type": "dword",
            "op": "eq"
            "val": 10
          }
        ]
     },
   ]
}

Is this what you currently are using?

What you are proposing would be a bit of syntactic sugar that would complicate the implementation and the file format quite a lot.
One core thing we tried to keep for seccompiler is its simplicity in the filter format. The interface we currently have tries to satisfy all use cases while keeping the code simple enough and not introducing a lot of conflicting cases in the validation of the format.

In this specific case I believe it introduces more overhead and complexity than simplicity.

[Alin Dima]

Or are you trying to deny every socket call that doesn't have AF_INET or AF_INET6 types?
If that's the case, indeed you'd need to list all possible types of socket address types.

In order to simplify this, you could use the Le, Ge, etc. operators, potentially.

As a general rule though, it's not recommended to use denylists for this exact reason. You need to have huge lists of potentially dangerous system calls and parameters that need to be updated frequently (and leave room for security issues if not updated).