syscallfilter: port to libseccomp
This commit is contained in:
Ronny Chevalier
committed by
Lennart Poettering
Lennart Poettering
parent
c6f7b693fe
commit
c0467cf387
@@ -1,7 +1,3 @@
|
||||
/syscall-from-name.gperf
|
||||
/syscall-from-name.h
|
||||
/syscall-list.txt
|
||||
/syscall-to-name.h
|
||||
/errno-from-name.gperf
|
||||
/errno-from-name.h
|
||||
/errno-list.txt
|
||||
|
||||
@@ -1,76 +0,0 @@
|
||||
/*
|
||||
* seccomp example for x86 (32-bit and 64-bit) with BPF macros
|
||||
*
|
||||
* Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
|
||||
* Authors:
|
||||
* Will Drewry <wad@chromium.org>
|
||||
* Kees Cook <keescook@chromium.org>
|
||||
*
|
||||
* The code may be used by anyone for any purpose, and can serve as a
|
||||
* starting point for developing applications using mode 2 seccomp.
|
||||
*/
|
||||
#ifndef _SECCOMP_BPF_H_
|
||||
#define _SECCOMP_BPF_H_
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stddef.h>
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
#include <signal.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#include <sys/prctl.h>
|
||||
|
||||
#include <linux/unistd.h>
|
||||
#include <linux/audit.h>
|
||||
#include <linux/filter.h>
|
||||
#include <linux/seccomp.h>
|
||||
|
||||
#ifndef SECCOMP_MODE_FILTER
|
||||
# define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
|
||||
# define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */
|
||||
# define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
|
||||
# define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
|
||||
struct seccomp_data {
|
||||
int nr;
|
||||
__u32 arch;
|
||||
__u64 instruction_pointer;
|
||||
__u64 args[6];
|
||||
};
|
||||
#endif
|
||||
#ifndef SYS_SECCOMP
|
||||
# define SYS_SECCOMP 1
|
||||
#endif
|
||||
|
||||
#define syscall_nr (offsetof(struct seccomp_data, nr))
|
||||
#define arch_nr (offsetof(struct seccomp_data, arch))
|
||||
|
||||
#if defined(__i386__)
|
||||
# define REG_SYSCALL REG_EAX
|
||||
# define ARCH_NR AUDIT_ARCH_I386
|
||||
#elif defined(__x86_64__)
|
||||
# define REG_SYSCALL REG_RAX
|
||||
# define ARCH_NR AUDIT_ARCH_X86_64
|
||||
#else
|
||||
# warning "Platform does not support seccomp filter yet"
|
||||
# define REG_SYSCALL 0
|
||||
# define ARCH_NR 0
|
||||
#endif
|
||||
|
||||
#define VALIDATE_ARCHITECTURE \
|
||||
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, arch_nr), \
|
||||
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
|
||||
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
|
||||
|
||||
#define EXAMINE_SYSCALL \
|
||||
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_nr)
|
||||
|
||||
#define ALLOW_SYSCALL(name) \
|
||||
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
|
||||
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
|
||||
|
||||
#define _KILL_PROCESS \
|
||||
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
|
||||
|
||||
#endif /* _SECCOMP_BPF_H_ */
|
||||
@@ -1,47 +0,0 @@
|
||||
#ifndef _LINUX_SECCOMP_H
|
||||
#define _LINUX_SECCOMP_H
|
||||
|
||||
|
||||
#include <linux/types.h>
|
||||
|
||||
|
||||
/* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, <mode>) */
|
||||
#define SECCOMP_MODE_DISABLED 0 /* seccomp is not in use. */
|
||||
#define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */
|
||||
#define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */
|
||||
|
||||
/*
|
||||
* All BPF programs must return a 32-bit value.
|
||||
* The bottom 16-bits are for optional return data.
|
||||
* The upper 16-bits are ordered from least permissive values to most.
|
||||
*
|
||||
* The ordering ensures that a min_t() over composed return values always
|
||||
* selects the least permissive choice.
|
||||
*/
|
||||
#define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */
|
||||
#define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */
|
||||
#define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */
|
||||
#define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */
|
||||
#define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */
|
||||
|
||||
/* Masks for the return value sections. */
|
||||
#define SECCOMP_RET_ACTION 0x7fff0000U
|
||||
#define SECCOMP_RET_DATA 0x0000ffffU
|
||||
|
||||
/**
|
||||
* struct seccomp_data - the format the BPF program executes over.
|
||||
* @nr: the system call number
|
||||
* @arch: indicates system call convention as an AUDIT_ARCH_* value
|
||||
* as defined in <linux/audit.h>.
|
||||
* @instruction_pointer: at the time of the system call.
|
||||
* @args: up to 6 system call arguments always stored as 64-bit values
|
||||
* regardless of the architecture.
|
||||
*/
|
||||
struct seccomp_data {
|
||||
int nr;
|
||||
__u32 arch;
|
||||
__u64 instruction_pointer;
|
||||
__u64 args[6];
|
||||
};
|
||||
|
||||
#endif /* _LINUX_SECCOMP_H */
|
||||
@@ -1,56 +0,0 @@
|
||||
/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
|
||||
|
||||
/***
|
||||
This file is part of systemd.
|
||||
|
||||
Copyright 2012 Lennart Poettering
|
||||
|
||||
systemd is free software; you can redistribute it and/or modify it
|
||||
under the terms of the GNU Lesser General Public License as published by
|
||||
the Free Software Foundation; either version 2.1 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
systemd is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public License
|
||||
along with systemd; If not, see <http://www.gnu.org/licenses/>.
|
||||
***/
|
||||
|
||||
#include <sys/syscall.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "util.h"
|
||||
#include "syscall-list.h"
|
||||
|
||||
static const struct syscall_name* lookup_syscall(register const char *str,
|
||||
register unsigned int len);
|
||||
|
||||
#include "syscall-to-name.h"
|
||||
#include "syscall-from-name.h"
|
||||
|
||||
const char *syscall_to_name(int id) {
|
||||
id = SYSCALL_TO_INDEX(id);
|
||||
if (id < 0 || id >= (int) ELEMENTSOF(syscall_names))
|
||||
return NULL;
|
||||
|
||||
return syscall_names[id];
|
||||
}
|
||||
|
||||
int syscall_from_name(const char *name) {
|
||||
const struct syscall_name *sc;
|
||||
|
||||
assert(name);
|
||||
|
||||
sc = lookup_syscall(name, strlen(name));
|
||||
if (!sc)
|
||||
return -1;
|
||||
|
||||
return sc->id;
|
||||
}
|
||||
|
||||
int syscall_max(void) {
|
||||
return ELEMENTSOF(syscall_names);
|
||||
}
|
||||
@@ -1,41 +0,0 @@
|
||||
/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
|
||||
|
||||
#pragma once
|
||||
|
||||
/***
|
||||
This file is part of systemd.
|
||||
|
||||
Copyright 2012 Lennart Poettering
|
||||
|
||||
systemd is free software; you can redistribute it and/or modify it
|
||||
under the terms of the GNU Lesser General Public License as published by
|
||||
the Free Software Foundation; either version 2.1 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
systemd is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public License
|
||||
along with systemd; If not, see <http://www.gnu.org/licenses/>.
|
||||
***/
|
||||
|
||||
#if defined __x86_64__ && defined __ILP32__
|
||||
/* The x32 ABI defines all of its syscalls with bit 30 set, which causes
|
||||
issues when attempting to use syscalls as simple indices into an array.
|
||||
Instead, use the syscall id & ~SYSCALL_MASK as the index, and | the
|
||||
internal id with the syscall mask as needed.
|
||||
*/
|
||||
#include <asm/unistd.h>
|
||||
#define SYSCALL_TO_INDEX(x) ((x) & ~__X32_SYSCALL_BIT)
|
||||
#define INDEX_TO_SYSCALL(x) ((x) | __X32_SYSCALL_BIT)
|
||||
#else
|
||||
#define SYSCALL_TO_INDEX(x) (x)
|
||||
#define INDEX_TO_SYSCALL(x) (x)
|
||||
#endif
|
||||
|
||||
const char *syscall_to_name(int id);
|
||||
int syscall_from_name(const char *name);
|
||||
|
||||
int syscall_max(void);
|
||||
Reference in New Issue
Block a user