# chaseccomp

chaseccomp is a simple BPF assembler for interfacing with seccomp.

Input files look something like:

```
# load syscall number
load nr
# check if it's exit_group
ifeq SYS_exit_group allow
# if not, die
ret kill
: allow
# else, allow
ret allow
```

It has labels, conditional jumps, and support for C identifiers.  In fact,
C identifiers are just passed on to the C compiler.

It also has an "ifeqdef" statement, which wraps each "ifeq" in an ifdef.
This lets us use the same filters for all platforms - if it doesn't support
a syscall, its "allow" rule just doesn't get compiled in.

Ideally, the filter should be constructed by sorting the syscalls in order
of usage frequency and then checking each syscall with ifeqdef.

The assembler runs in four steps:

* audit_nr.h is generated by compiling a dummy program and parsing its ELF
  header.  This is included from common.chasc, which checks the audit arch
  number at the top of the filter.
* gen_defs generates a chasc file with C preprocessor directives from
  `$<.chasc`.
* The C preprocessor reads the chasc file, disabling filters for syscalls
  that do not apply to this platform.  The output is in `$<.chasc.expanded`.
* gen_syscalls takes `$<.chasc.expanded` and outputs `chasc_$<.h`.  This is
  the final header file we include in the actual program.
