crates/heimdall-seccomp/src/lib.rs
// SPDX-License-Identifier: AGPL-3.0-only
// Copyright (C) 2026 Ignalina ApS and Vetra Automation AB
//! heimdall-seccomp (spec §3, §4): **Heimdall is a defensive sandbox.**
//!
//! - [`Profile`] / [`StaticProfile`]: the allowlist of one workload, arch and
//! libc. Generated by `heimdall-probe`, checked in, never widened by hand.
//! - [`bpf::build`]: a pure-Rust classic-BPF builder (no libseccomp, no C).
//! - [`Mode`]: **enforcing** (unknown call = `SECCOMP_RET_KILL_PROCESS`,
//! logged by the kernel audit) or **audit** (`SECCOMP_RET_LOG`, test boxes
//! only: it needs a [`TestBox`] token).
//! - [`notif`]: the small USER_NOTIF API (receive, `ID_VALID`, respond,
//! `ADDFD`) that the broker (heimdall-broker) and the probe build on.
//! - [`launch`]: start a program with a filter installed just before exec,
//! optionally handing its USER_NOTIF listener to the parent.
//! - [`interp`]: a classic-BPF interpreter, so a program can be checked
//! offline against [`Profile::evaluate`].
//! - [`oci`]: the same profile as a standard OCI seccomp JSON (Kubernetes
//! `seccompProfile: Localhost`).
//!
//! Rule semantics (the same in [`Profile::evaluate`], the BPF program and the
//! interpreter): the rules of one syscall are tried in order; a rule matches
//! when its `when` is empty or any of its alternatives matches, and an
//! alternative matches when every [`ArgCmp`] in it matches
//! (`(arg & mask) == value`, on the low 32 bits for [`Width::W32`]). The first
//! matching rule's action wins; no match gives the mode's default action.
//! On x86_64 every x32 call (`nr >= 0x4000_0000`) and every foreign arch is
//! killed, in every mode.
pub mod arch;
pub mod bpf;
pub mod interp;
pub mod launch;
pub mod notif;
pub mod oci;
pub mod profile;
mod tables;
pub use arch::{Arch, Libc};
pub use bpf::{Mode, Program, TestBox};
pub use profile::{Action, ArgCmp, Profile, ProfileError, Rule, StaticProfile, StaticRule, Width};