Mirror of strace – the linux syscall tracer
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

seccomp.c 2.5KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697
  1. #include <stddef.h>
  2. #include <unistd.h>
  3. #include <errno.h>
  4. #include <sys/prctl.h>
  5. #include <asm/unistd.h>
  6. #include <linux/audit.h>
  7. #include <linux/filter.h>
  8. #include <linux/seccomp.h>
  9. #if defined __i386__
  10. # define SECCOMP_ARCH AUDIT_ARCH_I386
  11. #elif defined __x86_64__
  12. # define SECCOMP_ARCH AUDIT_ARCH_X86_64
  13. #elif defined __arm__
  14. # define SECCOMP_ARCH AUDIT_ARCH_ARM
  15. #elif defined __arm64__ || defined __aarch64__
  16. # define SECCOMP_ARCH AUDIT_ARCH_AARCH64
  17. #else
  18. # error unsupported architecture
  19. #endif
  20. #define SOCK_FILTER_KILL_PROCESS \
  21. BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL)
  22. #define SOCK_FILTER_DENY_SYSCALL(nr, err) \
  23. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ ## nr, 0, 1), \
  24. BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | (SECCOMP_RET_DATA & (err)))
  25. #define SOCK_FILTER_ALLOW_SYSCALL(nr) \
  26. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ ## nr, 0, 1), \
  27. BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
  28. static const struct sock_filter filter[] = {
  29. /* load architecture */
  30. BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, arch)),
  31. /* jump forward 1 instruction if architecture matches */
  32. BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SECCOMP_ARCH, 1, 0),
  33. /* kill process */
  34. SOCK_FILTER_KILL_PROCESS,
  35. /* load syscall number */
  36. BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
  37. /* allow syscalls */
  38. SOCK_FILTER_ALLOW_SYSCALL(close),
  39. SOCK_FILTER_ALLOW_SYSCALL(exit),
  40. SOCK_FILTER_ALLOW_SYSCALL(exit_group),
  41. /* deny syscalls */
  42. SOCK_FILTER_DENY_SYSCALL(sync, EBUSY),
  43. SOCK_FILTER_DENY_SYSCALL(setsid, EACCES),
  44. SOCK_FILTER_DENY_SYSCALL(getpid, EPERM),
  45. SOCK_FILTER_DENY_SYSCALL(munlockall, SECCOMP_RET_DATA),
  46. /* kill process */
  47. SOCK_FILTER_KILL_PROCESS
  48. };
  49. static const struct sock_fprog prog = {
  50. .len = sizeof(filter) / sizeof(filter[0]),
  51. .filter = (struct sock_filter *) filter,
  52. };
  53. int
  54. main(void)
  55. {
  56. int fds[2];
  57. close(0);
  58. close(1);
  59. if (pipe(fds))
  60. return 77;
  61. if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
  62. return 77;
  63. if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
  64. return 77;
  65. if (close(0) || close(1))
  66. _exit(1);
  67. #define TEST_DENIED_SYSCALL(nr, err, fail) \
  68. do { \
  69. errno = 0; \
  70. if (syscall(__NR_ ## nr, 0xbad, 0xf00d, 0xdead, 0xbeef, err, fail) != -1 \
  71. || err != errno) \
  72. close(-fail); \
  73. } while (0)
  74. TEST_DENIED_SYSCALL(sync, EBUSY, 2);
  75. TEST_DENIED_SYSCALL(setsid, EACCES, 3);
  76. TEST_DENIED_SYSCALL(getpid, EPERM, 4);
  77. TEST_DENIED_SYSCALL(munlockall, SECCOMP_RET_DATA, 5);
  78. _exit(0);
  79. }