2 * seccomp example with syscall reporting
4 * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
6 * Kees Cook <keescook@chromium.org>
7 * Will Drewry <wad@chromium.org>
9 * Use of this source code is governed by a BSD-style license that can be
10 * found in the LICENSE file.
19 #include <libubox/utils.h>
20 #include <libubox/blobmsg.h>
21 #include <libubox/blobmsg_json.h>
23 #include "seccomp-bpf.h"
25 #include "../syscall-names.h"
27 static int max_syscall
= ARRAY_SIZE(syscall_names
);
29 static int find_syscall(const char *name
)
33 for (i
= 0; i
< max_syscall
; i
++)
34 if (syscall_names
[i
] && !strcmp(syscall_names
[i
], name
))
40 static void set_filter(struct sock_filter
*filter
, __u16 code
, __u8 jt
, __u8 jf
, __u32 k
)
48 int install_syscall_filter(const char *argv
, const char *file
)
55 static const struct blobmsg_policy policy
[__SECCOMP_MAX
] = {
56 [SECCOMP_WHITELIST
] = { .name
= "whitelist", .type
= BLOBMSG_TYPE_ARRAY
},
57 [SECCOMP_POLICY
] = { .name
= "policy", .type
= BLOBMSG_TYPE_INT32
},
59 struct blob_buf b
= { 0 };
60 struct blob_attr
*tb
[__SECCOMP_MAX
];
61 struct blob_attr
*cur
;
64 struct sock_filter
*filter
;
65 struct sock_fprog prog
= { 0 };
66 int sz
= 5, idx
= 0, default_policy
= 0;
68 INFO("%s: setting up syscall filter\n", argv
);
71 if (!blobmsg_add_json_from_file(&b
, file
)) {
72 INFO("%s: failed to load %s\n", argv
, file
);
76 blobmsg_parse(policy
, __SECCOMP_MAX
, tb
, blob_data(b
.head
), blob_len(b
.head
));
77 if (!tb
[SECCOMP_WHITELIST
]) {
78 INFO("%s: %s is missing the syscall table\n", argv
, file
);
82 if (tb
[SECCOMP_POLICY
])
83 default_policy
= blobmsg_get_u32(tb
[SECCOMP_POLICY
]);
85 blobmsg_for_each_attr(cur
, tb
[SECCOMP_WHITELIST
], rem
)
88 filter
= calloc(sz
, sizeof(struct sock_filter
));
90 INFO("failed to allocate filter memory\n");
95 set_filter(&filter
[idx
++], BPF_LD
+ BPF_W
+ BPF_ABS
, 0, 0, arch_nr
);
96 set_filter(&filter
[idx
++], BPF_JMP
+ BPF_JEQ
+ BPF_K
, 1, 0, ARCH_NR
);
97 set_filter(&filter
[idx
++], BPF_RET
+ BPF_K
, 0, 0, SECCOMP_RET_KILL
);
100 set_filter(&filter
[idx
++], BPF_LD
+ BPF_W
+ BPF_ABS
, 0, 0, syscall_nr
);
102 blobmsg_for_each_attr(cur
, tb
[SECCOMP_WHITELIST
], rem
) {
103 char *name
= blobmsg_get_string(cur
);
107 INFO("%s: invalid syscall name\n", argv
);
111 nr
= find_syscall(name
);
113 INFO("%s: unknown syscall %s\n", argv
, name
);
118 set_filter(&filter
[idx
++], BPF_JMP
+ BPF_JEQ
+ BPF_K
, 0, 1, nr
);
119 set_filter(&filter
[idx
++], BPF_RET
+ BPF_K
, 0, 0, SECCOMP_RET_ALLOW
);
123 /* return -1 and set errno */
124 set_filter(&filter
[idx
], BPF_RET
+ BPF_K
, 0, 0, SECCOMP_RET_LOGGER(default_policy
));
126 /* kill the process */
127 set_filter(&filter
[idx
], BPF_RET
+ BPF_K
, 0, 0, SECCOMP_RET_KILL
);
129 if (prctl(PR_SET_NO_NEW_PRIVS
, 1, 0, 0, 0)) {
130 INFO("%s: prctl(PR_SET_NO_NEW_PRIVS) failed: %s\n", argv
, strerror(errno
));
134 prog
.len
= (unsigned short) idx
+ 1;
135 prog
.filter
= filter
;
137 if (prctl(PR_SET_SECCOMP
, SECCOMP_MODE_FILTER
, &prog
)) {
138 INFO("%s: prctl(PR_SET_SECCOMP) failed: %s\n", argv
, strerror(errno
));