Feat/validators seccomp bpf cgroup

src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/AiGenerated.kt

@@ -413,6 +413,21 @@ fun getAllAIGeneratedValidators(): Map<Validator, OptionValueInformation> {
     Validator("config_parse_socket_service", "0") to ConfigParseSocketServiceOptionValue() as OptionValueInformation,
     Validator("config_parse_service_sockets", "0") to ConfigParseServiceSocketsOptionValue() as OptionValueInformation,
 
+    // Batch 2026-10: seccomp-bpf-cgroup
+    Validator("config_parse_syscall_filter", "0") to ConfigParseSyscallFilterOptionValue() as OptionValueInformation,
+    Validator("config_parse_syscall_log", "0") to ConfigParseSyscallLogOptionValue() as OptionValueInformation,
+    Validator("config_parse_restrict_filesystems", "0") to ConfigParseRestrictFilesystemsOptionValue() as OptionValueInformation,
+    Validator("config_parse_private_bpf", "0") to ConfigParsePrivateBpfOptionValue() as OptionValueInformation,
+    Validator("config_parse_bpf_delegate_commands", "0") to ConfigParseBpfDelegateCommandsOptionValue() as OptionValueInformation,
+    Validator("config_parse_bpf_delegate_maps", "0") to ConfigParseBpfDelegateMapsOptionValue() as OptionValueInformation,
+    Validator("config_parse_bpf_delegate_programs", "0") to ConfigParseBpfDelegateProgramsOptionValue() as OptionValueInformation,
+    Validator("config_parse_bpf_delegate_attachments", "0") to ConfigParseBpfDelegateAttachmentsOptionValue() as OptionValueInformation,
+    Validator("config_parse_cgroup_nft_set", "NFT_SET_PARSE_CGROUP") to ConfigParseCgroupNftSetOptionValue() as OptionValueInformation,
+    Validator("config_parse_bpf_foreign_program", "0") to ConfigParseBpfForeignProgramOptionValue() as OptionValueInformation,
+    Validator("config_parse_xattr", "0") to ConfigParseXattrOptionValue() as OptionValueInformation,
+    Validator("config_parse_socket_bindtodevice", "0") to ConfigParseSocketBindtodeviceOptionValue() as OptionValueInformation,
+    // END Batch 2026-10: seccomp-bpf-cgroup
+
   )
 
   return allValidators

src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseBpfDelegateAttachmentsOptionValue.kt

@@ -0,0 +1,57 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.FlexibleLiteralChoiceTerminal
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.bpfDelegateList
+
+/*
+ * BPFDelegateAttachments= ([Service]/[Socket]/[Mount]/[Swap]).
+ *
+ * man    https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#BPFDelegateAttachments=
+ * parser https://github.com/systemd/systemd/blob/0f0682b773/src/core/load-fragment.c#L181   config_parse_bpf_delegate_attachments (0), via DEFINE_CONFIG_PARSE_PTR
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.h#L287   bpf_delegate_attachments_from_string
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.c#L4221-L4253   bpf_delegate_from_string ("any", or a "," list; unknown names warned and ignored)
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.c#L4197   DEFINE_STRING_TABLE_LOOKUP(bpf_delegate_attach_type) — exact streq
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/generate-bpf-delegate-configs.py   builds bpf_delegate_attach_type_table from enum bpf_attach_type in src/include/uapi/linux/bpf.h
+ * tests  https://github.com/systemd/systemd/blob/0f0682b773/test/units/TEST-07-PID1.private-bpf.sh#L52   BPFDelegateAttachments=BPFFlowDissector,BPFCgroupSysctl,BPFNetfilter
+ * linux  https://man7.org/linux/man-pages/man2/bpf.2.html
+ */
+
+/**
+ * Validator for `BPFDelegateAttachments=` (the bpffs `delegate_attachs=` mount option; only effective with `PrivateBPF=yes`).
+ *
+ * Either `any` (the whole value) or a comma-separated list of the names below — see [bpfDelegateList]
+ * for the splitting rules (commas only, no spaces; empty fields are skipped). The names are what
+ * src/core/generate-bpf-delegate-configs.py makes of each `BPF_…` enumerator of `enum bpf_attach_type` in the
+ * uapi bpf.h systemd bundles at 0f0682b773 (`BPF_FOO_BAR` → `BPFFooBar`; aliases written as
+ * `X = Y,` are skipped by its regex and therefore not accepted). Regenerate with
+ *
+ *     python3 src/core/generate-bpf-delegate-configs.py code src/include/uapi/linux/bpf.h
+ *
+ * An unknown name is logged ("Unknown BPF delegate option, ignoring") and dropped, so it is flagged.
+ * The list tracks the bundled kernel header, so a newer systemd may know names this one does not.
+ *
+ * Covers: Service.BPFDelegateAttachments, Socket.BPFDelegateAttachments, Mount.BPFDelegateAttachments, Swap.BPFDelegateAttachments.
+ *
+ * The empty assignment (mask 0, i.e. nothing delegated) never reaches the grammar.
+ */
+class ConfigParseBpfDelegateAttachmentsOptionValue : SimpleGrammarOptionValues(
+    "config_parse_bpf_delegate_attachments",
+    bpfDelegateList(
+        FlexibleLiteralChoiceTerminal(
+            "BPFCgroupInetIngress", "BPFCgroupInetEgress", "BPFCgroupInetSockCreate", "BPFCgroupSockOps", "BPFSkSkbStreamParser",
+            "BPFSkSkbStreamVerdict", "BPFCgroupDevice", "BPFSkMsgVerdict", "BPFCgroupInet4Bind", "BPFCgroupInet6Bind",
+            "BPFCgroupInet4Connect", "BPFCgroupInet6Connect", "BPFCgroupInet4PostBind", "BPFCgroupInet6PostBind", "BPFCgroupUdp4Sendmsg",
+            "BPFCgroupUdp6Sendmsg", "BPFLircMode2", "BPFFlowDissector", "BPFCgroupSysctl", "BPFCgroupUdp4Recvmsg",
+            "BPFCgroupUdp6Recvmsg", "BPFCgroupGetsockopt", "BPFCgroupSetsockopt", "BPFTraceRawTp", "BPFTraceFentry",
+            "BPFTraceFexit", "BPFModifyReturn", "BPFLsmMac", "BPFTraceIter", "BPFCgroupInet4Getpeername",
+            "BPFCgroupInet6Getpeername", "BPFCgroupInet4Getsockname", "BPFCgroupInet6Getsockname", "BPFXdpDevmap", "BPFCgroupInetSockRelease",
+            "BPFXdpCpumap", "BPFSkLookup", "BPFXdp", "BPFSkSkbVerdict", "BPFSkReuseportSelect",
+            "BPFSkReuseportSelectOrMigrate", "BPFPerfEvent", "BPFTraceKprobeMulti", "BPFLsmCgroup", "BPFStructOps",
+            "BPFNetfilter", "BPFTcxIngress", "BPFTcxEgress", "BPFTraceUprobeMulti", "BPFCgroupUnixConnect",
+            "BPFCgroupUnixSendmsg", "BPFCgroupUnixRecvmsg", "BPFCgroupUnixGetpeername", "BPFCgroupUnixGetsockname", "BPFNetkitPrimary",
+            "BPFNetkitPeer", "BPFTraceKprobeSession", "BPFTraceUprobeSession", "BPFTraceFsession", "BPFTraceFentryMulti",
+            "BPFTraceFexitMulti", "BPFTraceFsessionMulti",
+        )
+    )
+)

src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseBpfDelegateCommandsOptionValue.kt

@@ -0,0 +1,52 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.FlexibleLiteralChoiceTerminal
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.bpfDelegateList
+
+/*
+ * BPFDelegateCommands= ([Service]/[Socket]/[Mount]/[Swap]).
+ *
+ * man    https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#BPFDelegateCommands=
+ * parser https://github.com/systemd/systemd/blob/0f0682b773/src/core/load-fragment.c#L178   config_parse_bpf_delegate_commands (0), via DEFINE_CONFIG_PARSE_PTR
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.h#L263   bpf_delegate_commands_from_string
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.c#L4221-L4253   bpf_delegate_from_string ("any", or a "," list; unknown names warned and ignored)
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.c#L4194   DEFINE_STRING_TABLE_LOOKUP(bpf_delegate_cmd) — exact streq
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/generate-bpf-delegate-configs.py   builds bpf_delegate_cmd_table from enum bpf_cmd in src/include/uapi/linux/bpf.h
+ * tests  https://github.com/systemd/systemd/blob/0f0682b773/test/units/TEST-07-PID1.private-bpf.sh#L49   BPFDelegateCommands=BPFObjPin,BPFBtfLoad,BPFMapFreeze,BPFLinkDetach
+ * linux  https://man7.org/linux/man-pages/man2/bpf.2.html
+ */
+
+/**
+ * Validator for `BPFDelegateCommands=` (the bpffs `delegate_cmds=` mount option; only effective with `PrivateBPF=yes`).
+ *
+ * Either `any` (the whole value) or a comma-separated list of the names below — see [bpfDelegateList]
+ * for the splitting rules (commas only, no spaces; empty fields are skipped). The names are what
+ * src/core/generate-bpf-delegate-configs.py makes of each `BPF_…` enumerator of `enum bpf_cmd` in the
+ * uapi bpf.h systemd bundles at 0f0682b773 (`BPF_FOO_BAR` → `BPFFooBar`; aliases written as
+ * `X = Y,` are skipped by its regex and therefore not accepted). Regenerate with
+ *
+ *     python3 src/core/generate-bpf-delegate-configs.py code src/include/uapi/linux/bpf.h
+ *
+ * An unknown name is logged ("Unknown BPF delegate option, ignoring") and dropped, so it is flagged.
+ * The list tracks the bundled kernel header, so a newer systemd may know names this one does not.
+ *
+ * Covers: Service.BPFDelegateCommands, Socket.BPFDelegateCommands, Mount.BPFDelegateCommands, Swap.BPFDelegateCommands.
+ *
+ * The empty assignment (mask 0, i.e. nothing delegated) never reaches the grammar.
+ */
+class ConfigParseBpfDelegateCommandsOptionValue : SimpleGrammarOptionValues(
+    "config_parse_bpf_delegate_commands",
+    bpfDelegateList(
+        FlexibleLiteralChoiceTerminal(
+            "BPFMapCreate", "BPFMapLookupElem", "BPFMapUpdateElem", "BPFMapDeleteElem", "BPFMapGetNextKey",
+            "BPFProgLoad", "BPFObjPin", "BPFObjGet", "BPFProgAttach", "BPFProgDetach",
+            "BPFProgTestRun", "BPFProgGetNextId", "BPFMapGetNextId", "BPFProgGetFdById", "BPFMapGetFdById",
+            "BPFObjGetInfoByFd", "BPFProgQuery", "BPFRawTracepointOpen", "BPFBtfLoad", "BPFBtfGetFdById",
+            "BPFTaskFdQuery", "BPFMapLookupAndDeleteElem", "BPFMapFreeze", "BPFBtfGetNextId", "BPFMapLookupBatch",
+            "BPFMapLookupAndDeleteBatch", "BPFMapUpdateBatch", "BPFMapDeleteBatch", "BPFLinkCreate", "BPFLinkUpdate",
+            "BPFLinkGetFdById", "BPFLinkGetNextId", "BPFEnableStats", "BPFIterCreate", "BPFLinkDetach",
+            "BPFProgBindMap", "BPFTokenCreate", "BPFProgStreamReadByFd", "BPFProgAssocStructOps",
+        )
+    )
+)

src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseBpfDelegateMapsOptionValue.kt

@@ -0,0 +1,52 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.FlexibleLiteralChoiceTerminal
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.bpfDelegateList
+
+/*
+ * BPFDelegateMaps= ([Service]/[Socket]/[Mount]/[Swap]).
+ *
+ * man    https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#BPFDelegateMaps=
+ * parser https://github.com/systemd/systemd/blob/0f0682b773/src/core/load-fragment.c#L179   config_parse_bpf_delegate_maps (0), via DEFINE_CONFIG_PARSE_PTR
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.h#L271   bpf_delegate_maps_from_string
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.c#L4221-L4253   bpf_delegate_from_string ("any", or a "," list; unknown names warned and ignored)
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.c#L4195   DEFINE_STRING_TABLE_LOOKUP(bpf_delegate_map_type) — exact streq
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/generate-bpf-delegate-configs.py   builds bpf_delegate_map_type_table from enum bpf_map_type in src/include/uapi/linux/bpf.h
+ * tests  https://github.com/systemd/systemd/blob/0f0682b773/test/units/TEST-07-PID1.private-bpf.sh#L50   BPFDelegateMaps=BPFMapTypeArray,BPFMapTypeCpumap,BPFMapTypeRingbuf
+ * linux  https://man7.org/linux/man-pages/man2/bpf.2.html
+ */
+
+/**
+ * Validator for `BPFDelegateMaps=` (the bpffs `delegate_maps=` mount option; only effective with `PrivateBPF=yes`).
+ *
+ * Either `any` (the whole value) or a comma-separated list of the names below — see [bpfDelegateList]
+ * for the splitting rules (commas only, no spaces; empty fields are skipped). The names are what
+ * src/core/generate-bpf-delegate-configs.py makes of each `BPF_…` enumerator of `enum bpf_map_type` in the
+ * uapi bpf.h systemd bundles at 0f0682b773 (`BPF_FOO_BAR` → `BPFFooBar`; aliases written as
+ * `X = Y,` are skipped by its regex and therefore not accepted). Regenerate with
+ *
+ *     python3 src/core/generate-bpf-delegate-configs.py code src/include/uapi/linux/bpf.h
+ *
+ * An unknown name is logged ("Unknown BPF delegate option, ignoring") and dropped, so it is flagged.
+ * The list tracks the bundled kernel header, so a newer systemd may know names this one does not.
+ *
+ * Covers: Service.BPFDelegateMaps, Socket.BPFDelegateMaps, Mount.BPFDelegateMaps, Swap.BPFDelegateMaps.
+ *
+ * The empty assignment (mask 0, i.e. nothing delegated) never reaches the grammar.
+ */
+class ConfigParseBpfDelegateMapsOptionValue : SimpleGrammarOptionValues(
+    "config_parse_bpf_delegate_maps",
+    bpfDelegateList(
+        FlexibleLiteralChoiceTerminal(
+            "BPFMapTypeUnspec", "BPFMapTypeHash", "BPFMapTypeArray", "BPFMapTypeProgArray", "BPFMapTypePerfEventArray",
+            "BPFMapTypePercpuHash", "BPFMapTypePercpuArray", "BPFMapTypeStackTrace", "BPFMapTypeCgroupArray", "BPFMapTypeLruHash",
+            "BPFMapTypeLruPercpuHash", "BPFMapTypeLpmTrie", "BPFMapTypeArrayOfMaps", "BPFMapTypeHashOfMaps", "BPFMapTypeDevmap",
+            "BPFMapTypeSockmap", "BPFMapTypeCpumap", "BPFMapTypeXskmap", "BPFMapTypeSockhash", "BPFMapTypeCgroupStorageDeprecated",
+            "BPFMapTypeReuseportSockarray", "BPFMapTypePercpuCgroupStorageDeprecated", "BPFMapTypeQueue", "BPFMapTypeStack", "BPFMapTypeSkStorage",
+            "BPFMapTypeDevmapHash", "BPFMapTypeStructOps", "BPFMapTypeRingbuf", "BPFMapTypeInodeStorage", "BPFMapTypeTaskStorage",
+            "BPFMapTypeBloomFilter", "BPFMapTypeUserRingbuf", "BPFMapTypeCgrpStorage", "BPFMapTypeArena", "BPFMapTypeInsnArray",
+            "BPFMapTypeRhash",
+        )
+    )
+)

src/main/kotlin/net/sjrx/intellij/plugins/systemdunitfiles/semanticdata/optionvalues/ai/ConfigParseBpfDelegateProgramsOptionValue.kt

@@ -0,0 +1,56 @@
+package net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.ai
+
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.SimpleGrammarOptionValues
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.FlexibleLiteralChoiceTerminal
+import net.sjrx.intellij.plugins.systemdunitfiles.semanticdata.optionvalues.grammar.bpfDelegateList
+
+/*
+ * BPFDelegatePrograms= ([Service]/[Socket]/[Mount]/[Swap]).
+ *
+ * man    https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#BPFDelegatePrograms=
+ * parser https://github.com/systemd/systemd/blob/0f0682b773/src/core/load-fragment.c#L180   config_parse_bpf_delegate_programs (0), via DEFINE_CONFIG_PARSE_PTR
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.h#L279   bpf_delegate_programs_from_string
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.c#L4221-L4253   bpf_delegate_from_string ("any", or a "," list; unknown names warned and ignored)
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/namespace.c#L4196   DEFINE_STRING_TABLE_LOOKUP(bpf_delegate_prog_type) — exact streq
+ * leaf   https://github.com/systemd/systemd/blob/0f0682b773/src/core/generate-bpf-delegate-configs.py   builds bpf_delegate_prog_type_table from enum bpf_prog_type in src/include/uapi/linux/bpf.h
+ * tests  https://github.com/systemd/systemd/blob/0f0682b773/test/units/TEST-07-PID1.private-bpf.sh#L51   BPFDelegatePrograms=BPFProgTypeTracepoint,BPFProgTypeXdp,BPFProgTypeTracing
+ * linux  https://man7.org/linux/man-pages/man2/bpf.2.html
+ */
+
+/**
+ * Validator for `BPFDelegatePrograms=` (the bpffs `delegate_progs=` mount option; only effective with `PrivateBPF=yes`).
+ *
+ * Either `any` (the whole value) or a comma-separated list of the names below — see [bpfDelegateList]
+ * for the splitting rules (commas only, no spaces; empty fields are skipped). The names are what
+ * src/core/generate-bpf-delegate-configs.py makes of each `BPF_…` enumerator of `enum bpf_prog_type` in the
+ * uapi bpf.h systemd bundles at 0f0682b773 (`BPF_FOO_BAR` → `BPFFooBar`; aliases written as
+ * `X = Y,` are skipped by its regex and therefore not accepted). Regenerate with
+ *
+ *     python3 src/core/generate-bpf-delegate-configs.py code src/include/uapi/linux/bpf.h
+ *
+ * An unknown name is logged ("Unknown BPF delegate option, ignoring") and dropped, so it is flagged.
+ * The list tracks the bundled kernel header, so a newer systemd may know names this one does not.
+ *
+ * Quirk faithfully reproduced: the generator's `(\w+)\b,` full-match also skips enumerators followed
+ * by a comment, so `BPF_PROG_TYPE_SYSCALL, /* … */` (bpf.h#L1094) never becomes `BPFProgTypeSyscall`
+ * and that spelling is rejected by systemd (and every later program type is shifted down one bit —
+ * an upstream bug, see the batch QUESTIONS.md).
+ *
+ * Covers: Service.BPFDelegatePrograms, Socket.BPFDelegatePrograms, Mount.BPFDelegatePrograms, Swap.BPFDelegatePrograms.
+ *
+ * The empty assignment (mask 0, i.e. nothing delegated) never reaches the grammar.
+ */
+class ConfigParseBpfDelegateProgramsOptionValue : SimpleGrammarOptionValues(
+    "config_parse_bpf_delegate_programs",
+    bpfDelegateList(
+        FlexibleLiteralChoiceTerminal(
+            "BPFProgTypeUnspec", "BPFProgTypeSocketFilter", "BPFProgTypeKprobe", "BPFProgTypeSchedCls", "BPFProgTypeSchedAct",
+            "BPFProgTypeTracepoint", "BPFProgTypeXdp", "BPFProgTypePerfEvent", "BPFProgTypeCgroupSkb", "BPFProgTypeCgroupSock",
+            "BPFProgTypeLwtIn", "BPFProgTypeLwtOut", "BPFProgTypeLwtXmit", "BPFProgTypeSockOps", "BPFProgTypeSkSkb",
+            "BPFProgTypeCgroupDevice", "BPFProgTypeSkMsg", "BPFProgTypeRawTracepoint", "BPFProgTypeCgroupSockAddr", "BPFProgTypeLwtSeg6local",
+            "BPFProgTypeLircMode2", "BPFProgTypeSkReuseport", "BPFProgTypeFlowDissector", "BPFProgTypeCgroupSysctl", "BPFProgTypeRawTracepointWritable",
+            "BPFProgTypeCgroupSockopt", "BPFProgTypeTracing", "BPFProgTypeStructOps", "BPFProgTypeExt", "BPFProgTypeLsm",
+            "BPFProgTypeSkLookup", "BPFProgTypeNetfilter",
+        )
+    )
+)