2 1a49166d 2021-01-23 op * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
4 e29dbd72 2021-01-23 op * Permission to use, copy, modify, and distribute this software for any
5 e29dbd72 2021-01-23 op * purpose with or without fee is hereby granted, provided that the above
6 e29dbd72 2021-01-23 op * copyright notice and this permission notice appear in all copies.
8 e29dbd72 2021-01-23 op * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 e29dbd72 2021-01-23 op * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 e29dbd72 2021-01-23 op * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 e29dbd72 2021-01-23 op * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 e29dbd72 2021-01-23 op * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 e29dbd72 2021-01-23 op * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 e29dbd72 2021-01-23 op * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 dafb57b8 2021-01-15 op #include "gmid.h"
19 dafb57b8 2021-01-15 op #if defined(__FreeBSD__)
21 dafb57b8 2021-01-15 op #include <sys/capsicum.h>
26 dafb57b8 2021-01-15 op if (cap_enter() == -1)
27 8e56d6ad 2021-02-11 op fatal("cap_enter");
30 dafb57b8 2021-01-15 op #elif defined(__linux__)
32 71b7eb2f 2021-01-17 op #include <sys/prctl.h>
33 71b7eb2f 2021-01-17 op #include <sys/syscall.h>
34 71b7eb2f 2021-01-17 op #include <sys/syscall.h>
35 71b7eb2f 2021-01-17 op #include <sys/types.h>
37 71b7eb2f 2021-01-17 op #include <linux/audit.h>
38 71b7eb2f 2021-01-17 op #include <linux/filter.h>
39 71b7eb2f 2021-01-17 op #include <linux/seccomp.h>
41 71b7eb2f 2021-01-17 op #include <errno.h>
42 3c0375e4 2021-01-20 op #include <fcntl.h>
43 71b7eb2f 2021-01-17 op #include <stddef.h>
44 71b7eb2f 2021-01-17 op #include <stdio.h>
45 71b7eb2f 2021-01-17 op #include <string.h>
47 71b7eb2f 2021-01-17 op /* thanks chromium' src/seccomp.c */
48 71b7eb2f 2021-01-17 op #if defined(__i386__)
49 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_I386
50 71b7eb2f 2021-01-17 op #elif defined(__x86_64__)
51 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64
52 71b7eb2f 2021-01-17 op #elif defined(__arm__)
53 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARM
54 71b7eb2f 2021-01-17 op #elif defined(__aarch64__)
55 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_AARCH64
56 71b7eb2f 2021-01-17 op #elif defined(__mips__)
57 71b7eb2f 2021-01-17 op # if defined(__mips64)
58 71b7eb2f 2021-01-17 op # if defined(__MIPSEB__)
59 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPS64
61 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPSEL64
64 71b7eb2f 2021-01-17 op # if defined(__MIPSEB__)
65 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPS
67 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPSEL
71 71b7eb2f 2021-01-17 op # error "Platform does not support seccomp filter yet"
74 71b7eb2f 2021-01-17 op /* uncomment to enable debugging. ONLY FOR DEVELOPMENT */
75 71b7eb2f 2021-01-17 op /* #define SC_DEBUG */
77 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
78 71b7eb2f 2021-01-17 op # define SC_FAIL SECCOMP_RET_TRAP
80 71b7eb2f 2021-01-17 op # define SC_FAIL SECCOMP_RET_KILL
83 71b7eb2f 2021-01-17 op /* make the filter more readable */
84 71b7eb2f 2021-01-17 op #define SC_ALLOW(nr) \
85 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_##nr, 0, 1), \
86 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
88 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
90 71b7eb2f 2021-01-17 op #include <signal.h>
91 71b7eb2f 2021-01-17 op #include <unistd.h>
94 71b7eb2f 2021-01-17 op sandbox_seccomp_violation(int signum, siginfo_t *info, void *ctx)
99 71b7eb2f 2021-01-17 op fprintf(stderr, "%s: unexpected system call (arch:0x%x,syscall:%d @ %p)\n",
100 71b7eb2f 2021-01-17 op __func__, info->si_arch, info->si_syscall, info->si_call_addr);
105 71b7eb2f 2021-01-17 op sandbox_seccomp_catch_sigsys(void)
107 71b7eb2f 2021-01-17 op struct sigaction act;
108 71b7eb2f 2021-01-17 op sigset_t mask;
110 71b7eb2f 2021-01-17 op memset(&act, 0, sizeof(act));
111 71b7eb2f 2021-01-17 op sigemptyset(&mask);
112 71b7eb2f 2021-01-17 op sigaddset(&mask, SIGSYS);
114 71b7eb2f 2021-01-17 op act.sa_sigaction = &sandbox_seccomp_violation;
115 71b7eb2f 2021-01-17 op act.sa_flags = SA_SIGINFO;
116 8e56d6ad 2021-02-11 op if (sigaction(SIGSYS, &act, NULL) == -1)
117 8e56d6ad 2021-02-11 op fatal("%s: sigaction(SIGSYS): %s",
118 71b7eb2f 2021-01-17 op __func__, strerror(errno));
120 8e56d6ad 2021-02-11 op if (sigprocmask(SIG_UNBLOCK, &mask, NULL) == -1)
121 8e56d6ad 2021-02-11 op fatal("%s: sigprocmask(SIGSYS): %s\n",
122 71b7eb2f 2021-01-17 op __func__, strerror(errno));
124 71b7eb2f 2021-01-17 op #endif /* SC_DEBUG */
129 71b7eb2f 2021-01-17 op struct sock_filter filter[] = {
130 71b7eb2f 2021-01-17 op /* load the *current* architecture */
131 71b7eb2f 2021-01-17 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
132 71b7eb2f 2021-01-17 op (offsetof(struct seccomp_data, arch))),
133 71b7eb2f 2021-01-17 op /* ensure it's the same that we've been compiled on */
134 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,
135 71b7eb2f 2021-01-17 op SECCOMP_AUDIT_ARCH, 1, 0),
136 71b7eb2f 2021-01-17 op /* if not, kill the program */
137 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
139 71b7eb2f 2021-01-17 op /* load the syscall number */
140 71b7eb2f 2021-01-17 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
141 71b7eb2f 2021-01-17 op (offsetof(struct seccomp_data, nr))),
143 71b7eb2f 2021-01-17 op /* allow logging on stdout */
144 71b7eb2f 2021-01-17 op SC_ALLOW(write),
145 71b7eb2f 2021-01-17 op SC_ALLOW(writev),
146 71b7eb2f 2021-01-17 op SC_ALLOW(readv),
148 71b7eb2f 2021-01-17 op /* these are used to serve the files. note how we
149 71b7eb2f 2021-01-17 op * allow openat but not open. */
150 4c857c0a 2021-02-10 op #ifdef __NR_epoll_wait
151 4c857c0a 2021-02-10 op /* epoll_wait(2) isn't present on aarch64, at least */
152 f6b9a079 2021-02-10 op SC_ALLOW(epoll_wait),
154 df58efff 2021-02-08 op SC_ALLOW(epoll_pwait),
155 df58efff 2021-02-08 op SC_ALLOW(epoll_ctl),
156 3cb3dd4d 2021-02-12 op SC_ALLOW(accept),
157 df58efff 2021-02-08 op SC_ALLOW(accept4),
158 71b7eb2f 2021-01-17 op SC_ALLOW(read),
159 71b7eb2f 2021-01-17 op SC_ALLOW(openat),
160 71b7eb2f 2021-01-17 op SC_ALLOW(fstat),
161 6827d278 2021-02-10 op SC_ALLOW(newfstatat),
162 71b7eb2f 2021-01-17 op SC_ALLOW(close),
163 71b7eb2f 2021-01-17 op SC_ALLOW(lseek),
164 71b7eb2f 2021-01-17 op SC_ALLOW(brk),
165 71b7eb2f 2021-01-17 op SC_ALLOW(mmap),
166 71b7eb2f 2021-01-17 op SC_ALLOW(munmap),
168 9899a837 2021-02-23 op /* for imsg */
169 9899a837 2021-02-23 op SC_ALLOW(sendmsg),
171 c214d1ab 2021-02-08 op /* needed for signal handling */
172 c214d1ab 2021-02-08 op SC_ALLOW(rt_sigreturn),
173 c214d1ab 2021-02-08 op SC_ALLOW(rt_sigaction),
175 71b7eb2f 2021-01-17 op /* we need recvmsg to receive fd */
176 71b7eb2f 2021-01-17 op SC_ALLOW(recvmsg),
178 71b7eb2f 2021-01-17 op /* XXX: ??? */
179 71b7eb2f 2021-01-17 op SC_ALLOW(getpid),
181 df58efff 2021-02-08 op /* alpine on amd64 */
182 f2b3a519 2021-01-20 op SC_ALLOW(clock_gettime),
183 df58efff 2021-02-08 op SC_ALLOW(madvise),
185 2d3f837a 2021-01-25 op /* void on aarch64 does a gettrandom */
186 2d3f837a 2021-01-25 op SC_ALLOW(getrandom),
188 6827d278 2021-02-10 op /* arch on amd64 */
189 6827d278 2021-02-10 op SC_ALLOW(gettimeofday),
191 f88311e5 2021-01-24 op /* for directory listing */
192 f88311e5 2021-01-24 op SC_ALLOW(getdents64),
194 71b7eb2f 2021-01-17 op SC_ALLOW(exit),
195 71b7eb2f 2021-01-17 op SC_ALLOW(exit_group),
197 c214d1ab 2021-02-08 op /* allow only F_GETFL, F_SETFL & F_SETFD fcntl */
198 f88311e5 2021-01-24 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 8),
199 de4f7131 2021-01-20 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
200 3c0375e4 2021-01-20 op (offsetof(struct seccomp_data, args[1]))),
201 3c0375e4 2021-01-20 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_GETFL, 0, 1),
202 3c0375e4 2021-01-20 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
203 3c0375e4 2021-01-20 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETFL, 0, 1),
204 3c0375e4 2021-01-20 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
205 f88311e5 2021-01-24 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETFD, 0, 1),
206 f88311e5 2021-01-24 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
207 3c0375e4 2021-01-20 op BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
209 f2b3a519 2021-01-20 op /* re-load the syscall number */
210 de4f7131 2021-01-20 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
211 de4f7131 2021-01-20 op (offsetof(struct seccomp_data, nr))),
213 71b7eb2f 2021-01-17 op /* allow ioctl but only on fd 1, glibc doing stuff? */
214 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ioctl, 0, 3),
215 71b7eb2f 2021-01-17 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
216 71b7eb2f 2021-01-17 op (offsetof(struct seccomp_data, args[0]))),
217 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 1, 0, 1),
218 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
220 71b7eb2f 2021-01-17 op /* disallow enything else */
221 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
224 71b7eb2f 2021-01-17 op struct sock_fprog prog = {
225 71b7eb2f 2021-01-17 op .len = (unsigned short) (sizeof(filter) / sizeof(filter[0])),
226 71b7eb2f 2021-01-17 op .filter = filter,
229 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
230 71b7eb2f 2021-01-17 op sandbox_seccomp_catch_sigsys();
233 8e56d6ad 2021-02-11 op if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
234 8e56d6ad 2021-02-11 op fatal("%s: prctl(PR_SET_NO_NEW_PRIVS): %s",
235 71b7eb2f 2021-01-17 op __func__, strerror(errno));
237 8e56d6ad 2021-02-11 op if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) == -1)
238 8e56d6ad 2021-02-11 op fatal("%s: prctl(PR_SET_SECCOMP): %s\n",
239 71b7eb2f 2021-01-17 op __func__, strerror(errno));
242 dafb57b8 2021-01-15 op #elif defined(__OpenBSD__)
244 dafb57b8 2021-01-15 op #include <unistd.h>
249 dafb57b8 2021-01-15 op struct vhost *h;
251 dafb57b8 2021-01-15 op for (h = hosts; h->domain != NULL; ++h) {
252 2d3cc76f 2021-01-25 op if (unveil(h->dir, "r") == -1)
253 8e56d6ad 2021-02-11 op fatal("unveil %s for domain %s", h->dir, h->domain);
256 881a9dd9 2021-01-16 op if (pledge("stdio recvfd rpath inet", NULL) == -1)
257 8e56d6ad 2021-02-11 op fatal("pledge");
265 2a911637 2021-02-11 op log_notice(NULL, "no sandbox method known for this OS");