get_filters (seccomp.rs)

Applies seccomp BPF filters to the calling thread for syscall sandboxing and restrictions.

// Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
use std::fmt::Debug;
use std::fs::File;
use std::io::{BufReader, Read};
use std::path::Path;

use seccompiler::{deserialize_binary, BpfThreadMap, DeserializationError};
use vmm::seccomp_filters::get_empty_filters;

const THREAD_CATEGORIES: [&str; 3] = ["vmm", "api", "vcpu"];

// This byte limit is passed to `bincode` to guard against a potential memory
// allocation DOS caused by binary filters that are too large.
// This limit can be safely determined since the maximum length of a BPF
// filter is 4096 instructions and Firecracker has a finite number of threads.
const DESERIALIZATION_BYTES_LIMIT: Option<u64> = Some(100_000);

/// Error retrieving seccomp filters.
#[derive(Debu

... (truncated -- full source via MCP)