1 dafb57b8 2021-01-15 op #include "gmid.h"
3 dafb57b8 2021-01-15 op #if defined(__FreeBSD__)
5 dafb57b8 2021-01-15 op #include <sys/capsicum.h>
6 dafb57b8 2021-01-15 op #include <err.h>
11 dafb57b8 2021-01-15 op if (cap_enter() == -1)
12 dafb57b8 2021-01-15 op err(1, "cap_enter");
15 dafb57b8 2021-01-15 op #elif defined(__linux__)
17 71b7eb2f 2021-01-17 op #include <sys/prctl.h>
18 71b7eb2f 2021-01-17 op #include <sys/syscall.h>
19 71b7eb2f 2021-01-17 op #include <sys/syscall.h>
20 71b7eb2f 2021-01-17 op #include <sys/types.h>
22 71b7eb2f 2021-01-17 op #include <linux/audit.h>
23 71b7eb2f 2021-01-17 op #include <linux/filter.h>
24 71b7eb2f 2021-01-17 op #include <linux/seccomp.h>
26 71b7eb2f 2021-01-17 op #include <errno.h>
27 3c0375e4 2021-01-20 op #include <fcntl.h>
28 71b7eb2f 2021-01-17 op #include <stddef.h>
29 71b7eb2f 2021-01-17 op #include <stdio.h>
30 71b7eb2f 2021-01-17 op #include <string.h>
32 71b7eb2f 2021-01-17 op /* thanks chromium' src/seccomp.c */
33 71b7eb2f 2021-01-17 op #if defined(__i386__)
34 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_I386
35 71b7eb2f 2021-01-17 op #elif defined(__x86_64__)
36 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64
37 71b7eb2f 2021-01-17 op #elif defined(__arm__)
38 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARM
39 71b7eb2f 2021-01-17 op #elif defined(__aarch64__)
40 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_AARCH64
41 71b7eb2f 2021-01-17 op #elif defined(__mips__)
42 71b7eb2f 2021-01-17 op # if defined(__mips64)
43 71b7eb2f 2021-01-17 op # if defined(__MIPSEB__)
44 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPS64
46 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPSEL64
49 71b7eb2f 2021-01-17 op # if defined(__MIPSEB__)
50 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPS
52 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPSEL
56 71b7eb2f 2021-01-17 op # error "Platform does not support seccomp filter yet"
59 71b7eb2f 2021-01-17 op /* uncomment to enable debugging. ONLY FOR DEVELOPMENT */
60 71b7eb2f 2021-01-17 op /* #define SC_DEBUG */
62 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
63 71b7eb2f 2021-01-17 op # define SC_FAIL SECCOMP_RET_TRAP
65 71b7eb2f 2021-01-17 op # define SC_FAIL SECCOMP_RET_KILL
68 71b7eb2f 2021-01-17 op /* make the filter more readable */
69 71b7eb2f 2021-01-17 op #define SC_ALLOW(nr) \
70 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_##nr, 0, 1), \
71 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
73 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
75 71b7eb2f 2021-01-17 op #include <signal.h>
76 71b7eb2f 2021-01-17 op #include <unistd.h>
79 71b7eb2f 2021-01-17 op sandbox_seccomp_violation(int signum, siginfo_t *info, void *ctx)
84 71b7eb2f 2021-01-17 op fprintf(stderr, "%s: unexpected system call (arch:0x%x,syscall:%d @ %p)\n",
85 71b7eb2f 2021-01-17 op __func__, info->si_arch, info->si_syscall, info->si_call_addr);
90 71b7eb2f 2021-01-17 op sandbox_seccomp_catch_sigsys(void)
92 71b7eb2f 2021-01-17 op struct sigaction act;
93 71b7eb2f 2021-01-17 op sigset_t mask;
95 71b7eb2f 2021-01-17 op memset(&act, 0, sizeof(act));
96 71b7eb2f 2021-01-17 op sigemptyset(&mask);
97 71b7eb2f 2021-01-17 op sigaddset(&mask, SIGSYS);
99 71b7eb2f 2021-01-17 op act.sa_sigaction = &sandbox_seccomp_violation;
100 71b7eb2f 2021-01-17 op act.sa_flags = SA_SIGINFO;
101 71b7eb2f 2021-01-17 op if (sigaction(SIGSYS, &act, NULL) == -1) {
102 71b7eb2f 2021-01-17 op fprintf(stderr, "%s: sigaction(SIGSYS): %s\n",
103 71b7eb2f 2021-01-17 op __func__, strerror(errno));
106 71b7eb2f 2021-01-17 op if (sigprocmask(SIG_UNBLOCK, &mask, NULL) == -1) {
107 71b7eb2f 2021-01-17 op fprintf(stderr, "%s: sigprocmask(SIGSYS): %s\n",
108 71b7eb2f 2021-01-17 op __func__, strerror(errno));
112 71b7eb2f 2021-01-17 op #endif /* SC_DEBUG */
117 71b7eb2f 2021-01-17 op struct sock_filter filter[] = {
118 71b7eb2f 2021-01-17 op /* load the *current* architecture */
119 71b7eb2f 2021-01-17 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
120 71b7eb2f 2021-01-17 op (offsetof(struct seccomp_data, arch))),
121 71b7eb2f 2021-01-17 op /* ensure it's the same that we've been compiled on */
122 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,
123 71b7eb2f 2021-01-17 op SECCOMP_AUDIT_ARCH, 1, 0),
124 71b7eb2f 2021-01-17 op /* if not, kill the program */
125 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
127 71b7eb2f 2021-01-17 op /* load the syscall number */
128 71b7eb2f 2021-01-17 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
129 71b7eb2f 2021-01-17 op (offsetof(struct seccomp_data, nr))),
131 71b7eb2f 2021-01-17 op /* allow logging on stdout */
132 71b7eb2f 2021-01-17 op SC_ALLOW(write),
133 71b7eb2f 2021-01-17 op SC_ALLOW(writev),
134 71b7eb2f 2021-01-17 op SC_ALLOW(readv),
136 71b7eb2f 2021-01-17 op /* these are used to serve the files. note how we
137 71b7eb2f 2021-01-17 op * allow openat but not open. */
139 298e4b96 2021-01-20 op #ifdef __aarch64__
140 298e4b96 2021-01-20 op /* it seems that on aarch64 there isn't a poll(2)
141 298e4b96 2021-01-20 op * syscall, but instead it's implemented on top of
142 298e4b96 2021-01-20 op * ppoll(2). */
143 298e4b96 2021-01-20 op SC_ALLOW(ppoll),
145 65fba1d5 2021-01-17 op SC_ALLOW(poll),
147 71b7eb2f 2021-01-17 op SC_ALLOW(accept),
148 71b7eb2f 2021-01-17 op SC_ALLOW(read),
149 71b7eb2f 2021-01-17 op SC_ALLOW(openat),
150 71b7eb2f 2021-01-17 op SC_ALLOW(fstat),
151 71b7eb2f 2021-01-17 op SC_ALLOW(close),
152 71b7eb2f 2021-01-17 op SC_ALLOW(lseek),
153 71b7eb2f 2021-01-17 op SC_ALLOW(brk),
154 71b7eb2f 2021-01-17 op SC_ALLOW(mmap),
155 71b7eb2f 2021-01-17 op SC_ALLOW(munmap),
157 71b7eb2f 2021-01-17 op /* we need recvmsg to receive fd */
158 71b7eb2f 2021-01-17 op SC_ALLOW(recvmsg),
160 71b7eb2f 2021-01-17 op /* XXX: ??? */
161 71b7eb2f 2021-01-17 op SC_ALLOW(getpid),
163 f2b3a519 2021-01-20 op /* alpine on amd64 does a clock_gettime(2) */
164 f2b3a519 2021-01-20 op SC_ALLOW(clock_gettime),
166 71b7eb2f 2021-01-17 op SC_ALLOW(exit),
167 71b7eb2f 2021-01-17 op SC_ALLOW(exit_group),
169 f2b3a519 2021-01-20 op /* allow only F_GETFL and F_SETFL fcntl */
170 3c0375e4 2021-01-20 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 6),
171 de4f7131 2021-01-20 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
172 3c0375e4 2021-01-20 op (offsetof(struct seccomp_data, args[1]))),
173 3c0375e4 2021-01-20 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_GETFL, 0, 1),
174 3c0375e4 2021-01-20 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
175 3c0375e4 2021-01-20 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETFL, 0, 1),
176 3c0375e4 2021-01-20 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
177 3c0375e4 2021-01-20 op BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
179 f2b3a519 2021-01-20 op /* re-load the syscall number */
180 de4f7131 2021-01-20 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
181 de4f7131 2021-01-20 op (offsetof(struct seccomp_data, nr))),
183 71b7eb2f 2021-01-17 op /* allow ioctl but only on fd 1, glibc doing stuff? */
184 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ioctl, 0, 3),
185 71b7eb2f 2021-01-17 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
186 71b7eb2f 2021-01-17 op (offsetof(struct seccomp_data, args[0]))),
187 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 1, 0, 1),
188 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
190 71b7eb2f 2021-01-17 op /* disallow enything else */
191 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
194 71b7eb2f 2021-01-17 op struct sock_fprog prog = {
195 71b7eb2f 2021-01-17 op .len = (unsigned short) (sizeof(filter) / sizeof(filter[0])),
196 71b7eb2f 2021-01-17 op .filter = filter,
199 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
200 71b7eb2f 2021-01-17 op sandbox_seccomp_catch_sigsys();
203 71b7eb2f 2021-01-17 op if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
204 71b7eb2f 2021-01-17 op fprintf(stderr, "%s: prctl(PR_SET_NO_NEW_PRIVS): %s\n",
205 71b7eb2f 2021-01-17 op __func__, strerror(errno));
209 71b7eb2f 2021-01-17 op if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) == -1) {
210 71b7eb2f 2021-01-17 op fprintf(stderr, "%s: prctl(PR_SET_SECCOMP): %s\n",
211 71b7eb2f 2021-01-17 op __func__, strerror(errno));
216 dafb57b8 2021-01-15 op #elif defined(__OpenBSD__)
218 dafb57b8 2021-01-15 op #include <err.h>
219 dafb57b8 2021-01-15 op #include <unistd.h>
224 dafb57b8 2021-01-15 op struct vhost *h;
226 dafb57b8 2021-01-15 op for (h = hosts; h->domain != NULL; ++h) {
227 dafb57b8 2021-01-15 op if (unveil(h->dir, "rx") == -1)
228 dafb57b8 2021-01-15 op err(1, "unveil %s for domain %s", h->dir, h->domain);
231 881a9dd9 2021-01-16 op if (pledge("stdio recvfd rpath inet", NULL) == -1)
232 dafb57b8 2021-01-15 op err(1, "pledge");
240 dafb57b8 2021-01-15 op LOGN(NULL, "%s", "no sandbox method known for this OS");