<commit_before># WHAT IS IT?
Kafel is a language and library for specifying syscall filtering policies.
The policies are compiled into BPF code that can be used with seccomp-filter.

This is NOT an official Google product.

# Usage

## With verbose error reporting
```c
struct sock_fprog prog;
kafel_ctxt_t ctxt = kafel_ctxt_create();
kafel_set_input_string(ctxt, seccomp_policy);
if (kafel_compile(ctxt, &prog)) {
  fprintf(stderr, "policy compilation failed: %s", kafel_error_msg(ctxt));
  kafel_ctxt_destroy(&ctxt);
  exit(-1);
}
kafel_ctxt_destroy(&ctxt);
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
free(prog.filter);
```

## Without verbose error reporting
```c
struct sock_fprog prog;
if (kafel_compile_string(seccomp_policy, &prog)) {
  fputs("policy compilation failed", stderr);
  exit(-1);
}
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
free(prog.filter);
```

# Policy language

A simple language is used to define policies.

Policy file consists of statements.

A statement can be:
 * a constant definition
 * a policy definition
 * a policy definition statement
 * a default action statement

Policy definition statements placed at file scope will be added to the implicit
top level policy.
This top level policy is going to be compiled.

## Default action statement

```
DEFAULT the_action
```

Specifies that action `the_action` should be taken when no rule matches.

The default action must be specified just once.

If the policy file specifies no default actions, the default action will
be KILL

## Numbers

Kafel supports following number notations:
 * Decimal `42`
 * Hexadecimal `0xfa1`
 * Octal `0777`
 * Binary `0b10101`

## Constant definitions

You may define numeric constants to make your policies more readable.
Constant definitions may be placed almost anywhere in the policy file.
A constant definiton cannot be placed inside of a policy defintion.
The defined constants can then be used anywhere where a number is expected.

```
#define MYCONST 123<commit_msg>docs: fix typos<commit_after># WHAT IS IT?
Kafel is a language and library for specifying syscall filtering policies.
The policies are compiled into BPF code that can be used with seccomp-filter.

This is NOT an official Google product.

# Usage

## With verbose error reporting
```c
struct sock_fprog prog;
kafel_ctxt_t ctxt = kafel_ctxt_create();
kafel_set_input_string(ctxt, seccomp_policy);
if (kafel_compile(ctxt, &prog)) {
  fprintf(stderr, "policy compilation failed: %s", kafel_error_msg(ctxt));
  kafel_ctxt_destroy(&ctxt);
  exit(-1);
}
kafel_ctxt_destroy(&ctxt);
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
free(prog.filter);
```

## Without verbose error reporting
```c
struct sock_fprog prog;
if (kafel_compile_string(seccomp_policy, &prog)) {
  fputs("policy compilation failed", stderr);
  exit(-1);
}
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog, 0, 0);
free(prog.filter);
```

# Policy language

A simple language is used to define policies.

Policy file consists of statements.

A statement can be:
 * a constant definition
 * a policy definition
 * a policy definition statement
 * a default action statement

Policy definition statements placed at file scope will be added to the implicit
top level policy.
This top level policy is going to be compiled.

## Default action statement

```
DEFAULT the_action
```

Specifies that action `the_action` should be taken when no rule matches.

The default action must be specified just once.

If the policy file specifies no default actions, the default action will
be KILL

## Numbers

Kafel supports following number notations:
 * Decimal `42`
 * Hexadecimal `0xfa1`
 * Octal `0777`
 * Binary `0b10101`

## Constant definitions

You may define numeric constants to make your policies more readable.
Constant definitions may be placed almost anywhere in the policy file.
A constant definition cannot be placed inside of a policy definition.
The defined constants can then be used anywhere where a number is expected.

```
#define MYCONST 123
{'fraction_non_alphanumeric': 0.07800891530460624, 'fraction_numerical': 0.011391778107974244, 'mean_word_length': 5.110438729198185, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '433443', 'n_tokens_mistral': 1266, 'n_tokens_neox': 1211, 'n_words': 503}