Dmitry V. Levin
6a2f43ce64
There are no users of SYS_* macros provided by <sys/syscall.h>, and definitions of __NR_* macros could be obtained directly from <asm/unistd.h>. * defs.h: Include <asm/unistd.h> instead of <sys/syscall.h>. * test/seccomp.c: Likewise. * test/threaded_execve.c: Likewise. * test/x32_lseek.c: Likewise. * test/x32_mmap.c: Likewise. * tests/_newselect.c: Likewise. * tests/access.c: Likewise. * tests/acct.c: Likewise. * tests/aio.c: Likewise. * tests/alarm.c: Likewise. * tests/attach-f-p.c: Likewise. * tests/bpf.c: Likewise. * tests/brk.c: Likewise. * tests/chmod.c: Likewise. * tests/chown.c: Likewise. * tests/chown32.c: Likewise. * tests/chroot.c: Likewise. * tests/clock_adjtime.c: Likewise. * tests/clock_nanosleep.c: Likewise. * tests/clock_xettime.c: Likewise. * tests/copy_file_range.c: Likewise. * tests/creat.c: Likewise. * tests/dup2.c: Likewise. * tests/dup3.c: Likewise. * tests/epoll_create.c: Likewise. * tests/epoll_create1.c: Likewise. * tests/epoll_ctl.c: Likewise. * tests/epoll_pwait.c: Likewise. * tests/epoll_wait.c: Likewise. * tests/eventfd.c: Likewise. * tests/execveat.c: Likewise. * tests/faccessat.c: Likewise. * tests/fchdir.c: Likewise. * tests/fchmod.c: Likewise. * tests/fchmodat.c: Likewise. * tests/fchown.c: Likewise. * tests/fchown32.c: Likewise. * tests/fchownat.c: Likewise. * tests/fcntl.c: Likewise. * tests/fcntl64.c: Likewise. * tests/fdatasync.c: Likewise. * tests/flock.c: Likewise. * tests/fstat.c: Likewise. * tests/fstat64.c: Likewise. * tests/fstatat64.c: Likewise. * tests/fstatfs.c: Likewise. * tests/fstatfs64.c: Likewise. * tests/fsync.c: Likewise. * tests/ftruncate.c: Likewise. * tests/ftruncate64.c: Likewise. * tests/futimesat.c: Likewise. * tests/get_mempolicy.c: Likewise. * tests/getcwd.c: Likewise. * tests/getdents.c: Likewise. * tests/getdents64.c: Likewise. * tests/getegid.c: Likewise. * tests/getegid32.c: Likewise. * tests/geteuid.c: Likewise. * tests/geteuid32.c: Likewise. * tests/getgid.c: Likewise. * tests/getgid32.c: Likewise. * tests/getgroups.c: Likewise. * tests/getgroups32.c: Likewise. * tests/getpgrp.c: Likewise. * tests/getrandom.c: Likewise. * tests/getresgid.c: Likewise. * tests/getresgid32.c: Likewise. * tests/getresuid.c: Likewise. * tests/getresuid32.c: Likewise. * tests/getrlimit.c: Likewise. * tests/getrusage.c: Likewise. * tests/getuid.c: Likewise. * tests/getuid32.c: Likewise. * tests/getxxid.c: Likewise. * tests/ioctl_uffdio.c: Likewise. * tests/ioperm.c: Likewise. * tests/iopl.c: Likewise. * tests/ipc.c: Likewise. * tests/kill.c: Likewise. * tests/lchown.c: Likewise. * tests/lchown32.c: Likewise. * tests/libmmsg.c: Likewise. * tests/libsocketcall.c: Likewise. * tests/link.c: Likewise. * tests/linkat.c: Likewise. * tests/llseek.c: Likewise. * tests/lseek.c: Likewise. * tests/lstat.c: Likewise. * tests/lstat64.c: Likewise. * tests/mbind.c: Likewise. * tests/membarrier.c: Likewise. * tests/memfd_create.c: Likewise. * tests/migrate_pages.c: Likewise. * tests/mkdir.c: Likewise. * tests/mkdirat.c: Likewise. * tests/mknod.c: Likewise. * tests/mknodat.c: Likewise. * tests/mlock.c: Likewise. * tests/mlock2.c: Likewise. * tests/move_pages.c: Likewise. * tests/newfstatat.c: Likewise. * tests/nsyscalls.c: Likewise. * tests/old_mmap.c: Likewise. * tests/oldselect.c: Likewise. * tests/open.c: Likewise. * tests/openat.c: Likewise. * tests/pause.c: Likewise. * tests/poll.c: Likewise. * tests/prctl-seccomp-filter-v.c: Likewise. * tests/prctl-seccomp-strict.c: Likewise. * tests/preadv2-pwritev2.c: Likewise. * tests/prlimit64.c: Likewise. * tests/pselect6.c: Likewise. * tests/ptrace.c: Likewise. * tests/readdir.c: Likewise. * tests/readlink.c: Likewise. * tests/readlinkat.c: Likewise. * tests/reboot.c: Likewise. * tests/remap_file_pages.c: Likewise. * tests/rename.c: Likewise. * tests/renameat.c: Likewise. * tests/renameat2.c: Likewise. * tests/rmdir.c: Likewise. * tests/rt_sigpending.c: Likewise. * tests/rt_sigprocmask.c: Likewise. * tests/rt_sigsuspend.c: Likewise. * tests/rt_sigtimedwait.c: Likewise. * tests/rt_tgsigqueueinfo.c: Likewise. * tests/sched_get_priority_mxx.c: Likewise. * tests/sched_rr_get_interval.c: Likewise. * tests/sched_xetaffinity.c: Likewise. * tests/sched_xetattr.c: Likewise. * tests/sched_xetparam.c: Likewise. * tests/sched_xetscheduler.c: Likewise. * tests/sched_yield.c: Likewise. * tests/seccomp-filter-v.c: Likewise. * tests/seccomp-filter.c: Likewise. * tests/seccomp-strict.c: Likewise. * tests/select.c: Likewise. * tests/sendfile.c: Likewise. * tests/sendfile64.c: Likewise. * tests/set_mempolicy.c: Likewise. * tests/setdomainname.c: Likewise. * tests/setfsgid.c: Likewise. * tests/setfsgid32.c: Likewise. * tests/setfsuid.c: Likewise. * tests/setfsuid32.c: Likewise. * tests/setgid.c: Likewise. * tests/setgid32.c: Likewise. * tests/setgroups.c: Likewise. * tests/setgroups32.c: Likewise. * tests/sethostname.c: Likewise. * tests/setregid.c: Likewise. * tests/setregid32.c: Likewise. * tests/setresgid.c: Likewise. * tests/setresgid32.c: Likewise. * tests/setresuid.c: Likewise. * tests/setresuid32.c: Likewise. * tests/setreuid.c: Likewise. * tests/setreuid32.c: Likewise. * tests/setrlimit.c: Likewise. * tests/setuid.c: Likewise. * tests/setuid32.c: Likewise. * tests/signalfd4.c: Likewise. * tests/socketcall.c: Likewise. * tests/splice.c: Likewise. * tests/stat.c: Likewise. * tests/stat64.c: Likewise. * tests/statfs.c: Likewise. * tests/statfs64.c: Likewise. * tests/swap.c: Likewise. * tests/symlink.c: Likewise. * tests/symlinkat.c: Likewise. * tests/sync.c: Likewise. * tests/sync_file_range.c: Likewise. * tests/sync_file_range2.c: Likewise. * tests/syslog.c: Likewise. * tests/tee.c: Likewise. * tests/time.c: Likewise. * tests/timer_create.c: Likewise. * tests/timer_xettime.c: Likewise. * tests/timerfd_xettime.c: Likewise. * tests/times-fail.c: Likewise. * tests/times.c: Likewise. * tests/truncate.c: Likewise. * tests/truncate64.c: Likewise. * tests/ugetrlimit.c: Likewise. * tests/umount.c: Likewise. * tests/umount2.c: Likewise. * tests/uname.c: Likewise. * tests/unix-pair-send-recv.c: Likewise. * tests/unlink.c: Likewise. * tests/unlinkat.c: Likewise. * tests/userfaultfd.c: Likewise. * tests/utimes.c: Likewise. * tests/vhangup.c: Likewise. * tests/vmsplice.c: Likewise. * tests/waitid.c: Likewise. * tests/waitpid.c: Likewise. * tests/xet_robust_list.c: Likewise. * tests/xetpgid.c: Likewise. * tests/xetpriority.c: Likewise. * tests/xettimeofday.c: Likewise.
94 lines
2.4 KiB
C
94 lines
2.4 KiB
C
#include <stddef.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
#include <sys/prctl.h>
|
|
#include <asm/unistd.h>
|
|
#include <linux/audit.h>
|
|
#include <linux/filter.h>
|
|
#include <linux/seccomp.h>
|
|
|
|
#if defined __i386__
|
|
# define SECCOMP_ARCH AUDIT_ARCH_I386
|
|
#elif defined __x86_64__
|
|
# define SECCOMP_ARCH AUDIT_ARCH_X86_64
|
|
#elif defined __arm__
|
|
# define SECCOMP_ARCH AUDIT_ARCH_ARM
|
|
#elif defined __arm64__ || defined __aarch64__
|
|
# define SECCOMP_ARCH AUDIT_ARCH_AARCH64
|
|
#else
|
|
# error unsupported architecture
|
|
#endif
|
|
|
|
#define SOCK_FILTER_KILL_PROCESS \
|
|
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL)
|
|
|
|
#define SOCK_FILTER_DENY_SYSCALL(nr, err) \
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ ## nr, 0, 1), \
|
|
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | (SECCOMP_RET_DATA & (err)))
|
|
|
|
#define SOCK_FILTER_ALLOW_SYSCALL(nr) \
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ ## nr, 0, 1), \
|
|
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
|
|
|
|
static const struct sock_filter filter[] = {
|
|
/* load architecture */
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (offsetof (struct seccomp_data, arch))),
|
|
/* jump forward 1 instruction if architecture matches */
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SECCOMP_ARCH, 1, 0),
|
|
/* kill process */
|
|
SOCK_FILTER_KILL_PROCESS,
|
|
|
|
/* load syscall number */
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
|
|
|
|
/* allow syscalls */
|
|
SOCK_FILTER_ALLOW_SYSCALL(close),
|
|
SOCK_FILTER_ALLOW_SYSCALL(exit),
|
|
SOCK_FILTER_ALLOW_SYSCALL(exit_group),
|
|
|
|
/* deny syscalls */
|
|
SOCK_FILTER_DENY_SYSCALL(sync, EBUSY),
|
|
SOCK_FILTER_DENY_SYSCALL(setsid, EACCES),
|
|
SOCK_FILTER_DENY_SYSCALL(getpid, EPERM),
|
|
SOCK_FILTER_DENY_SYSCALL(munlockall, SECCOMP_RET_DATA),
|
|
|
|
/* kill process */
|
|
SOCK_FILTER_KILL_PROCESS
|
|
};
|
|
|
|
static const struct sock_fprog prog = {
|
|
.len = sizeof(filter) / sizeof(filter[0]),
|
|
.filter = (struct sock_filter *) filter,
|
|
};
|
|
|
|
int
|
|
main(void)
|
|
{
|
|
int fds[2];
|
|
|
|
close(0);
|
|
close(1);
|
|
if (pipe(fds))
|
|
return 77;
|
|
|
|
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
|
|
return 77;
|
|
|
|
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
|
|
return 77;
|
|
|
|
if (close(0) || close(1))
|
|
_exit(1);
|
|
|
|
#define TEST_DENIED_SYSCALL(nr, err, fail) \
|
|
if (errno = 0, syscall(__NR_ ## nr, 0xbad, 0xf00d, 0xdead, 0xbeef, err, fail) != -1 || err != errno) \
|
|
close(-fail)
|
|
|
|
TEST_DENIED_SYSCALL(sync, EBUSY, 2);
|
|
TEST_DENIED_SYSCALL(setsid, EACCES, 3);
|
|
TEST_DENIED_SYSCALL(getpid, EPERM, 4);
|
|
TEST_DENIED_SYSCALL(munlockall, SECCOMP_RET_DATA, 5);
|
|
|
|
_exit(0);
|
|
}
|