Seccomp.c 9.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325
  1. /* vim: set expandtab ts=4 sw=4: */
  2. /*
  3. * You may redistribute this program and/or modify it under the terms of
  4. * the GNU General Public License as published by the Free Software Foundation,
  5. * either version 3 of the License, or (at your option) any later version.
  6. *
  7. * This program is distributed in the hope that it will be useful,
  8. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. * GNU General Public License for more details.
  11. *
  12. * You should have received a copy of the GNU General Public License
  13. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  14. */
  15. // sigaction() siginfo_t SIG_UNBLOCK
  16. #define _POSIX_C_SOURCE 199309L
  17. #include "util/Seccomp.h"
  18. #include "util/Bits.h"
  19. #include "util/ArchInfo.h"
  20. // getpriority()
  21. #include <sys/resource.h>
  22. #include <signal.h>
  23. #include <sys/prctl.h>
  24. #include <errno.h>
  25. #include <linux/filter.h>
  26. #include <linux/seccomp.h>
  27. #include <linux/audit.h>
  28. #include <sys/syscall.h>
  29. #include <stddef.h>
  30. #include <stdio.h>
  31. #include <string.h>
  32. static void catchViolation(int sig, siginfo_t* si, void* threadContext)
  33. {
  34. printf("Attempted banned syscall number [%d] see doc/Seccomp.md for more information\n",
  35. si->si_value.sival_int);
  36. Assert_failure("Disallowed Syscall");
  37. }
  38. struct Filter {
  39. int label;
  40. int jt;
  41. int jf;
  42. struct sock_filter sf;
  43. };
  44. static struct sock_fprog* compile(struct Filter* input, int inputLen, struct Allocator* alloc)
  45. {
  46. // compute gotos
  47. int totalOut = 0;
  48. for (int i = inputLen-1; i >= 0; i--) {
  49. struct Filter* a = &input[i];
  50. if (a->label == 0) {
  51. // check for unresolved gotos...
  52. Assert_true(a->jt == 0 && a->jf == 0);
  53. totalOut++;
  54. continue;
  55. }
  56. int diff = 0;
  57. for (int j = i-1; j >= 0; j--) {
  58. struct Filter* b = &input[j];
  59. if (b->label != 0) { continue; }
  60. if (b->jt == a->label) {
  61. b->sf.jt = diff;
  62. b->jt = 0;
  63. }
  64. if (b->jf == a->label) {
  65. b->sf.jf = diff;
  66. b->jf = 0;
  67. }
  68. diff++;
  69. }
  70. }
  71. // copy into output filter array...
  72. struct sock_filter* sf = Allocator_calloc(alloc, sizeof(struct sock_filter), totalOut);
  73. int outI = 0;
  74. for (int i = 0; i < inputLen; i++) {
  75. if (input[i].label == 0) {
  76. Bits_memcpyConst(&sf[outI++], &input[i].sf, sizeof(struct sock_filter));
  77. }
  78. Assert_true(outI <= totalOut);
  79. Assert_true(i != inputLen-1 || outI == totalOut);
  80. }
  81. struct sock_fprog* out = Allocator_malloc(alloc, sizeof(struct sock_fprog));
  82. out->len = (unsigned short) totalOut;
  83. out->filter = sf;
  84. return out;
  85. }
  86. #define RET_TRAP 0x00030000u
  87. #define RET_ERRNO(x) (0x00050000u | ((x) & 0x0000ffffu))
  88. #define RET_SUCCESS 0x7fff0000u
  89. static struct sock_fprog* mkFilter(struct Allocator* alloc, struct Except* eh)
  90. {
  91. // Adding exceptions to the syscall filter:
  92. //
  93. // echo '#include <sys/syscall.h>' | gcc -E -dM - | grep 'define __NR_' | sort
  94. // for the full list of system calls with syscall numbers (different per ABI)
  95. //
  96. // If gdb traps out it will look like this:
  97. //
  98. // Program received signal SIGSYS, Bad system call.
  99. // [Switching to Thread 0x7ffff7fdd740 (LWP 14673)]
  100. // 0x00007ffff74d1caa in mmap64 () at ../sysdeps/unix/syscall-template.S:81
  101. // 81 ../sysdeps/unix/syscall-template.S: No such file or directory.
  102. //
  103. // %eax should contain the system call number (on different ABIs YMMV)
  104. //
  105. // (gdb) print $eax
  106. // $1 = 9
  107. // (gdb)
  108. //
  109. // Consult your syscall table from the above gcc command...
  110. //
  111. // #define __NR_mmap 9
  112. //
  113. // Then add:
  114. //
  115. // IFEQ(__NR_mmap, success),
  116. //
  117. // And add a comment documenting where you needed that syscall :)
  118. #define STMT(code, val) { .sf = BPF_STMT(code, val) }
  119. #define JMPK(type, not, input, label) { \
  120. .sf = BPF_JUMP(BPF_JMP+(type)+BPF_K, (input), 0, 0), \
  121. .jt = (!(not) ? (label) : 0), \
  122. .jf = ((not) ? (label) : 0) \
  123. }
  124. // Create a label for jumps, the label must be represented by a non-zero integer.
  125. #define LABEL(lbl) { .label = (lbl) }
  126. // Load offset into the register
  127. #define LOAD(offset) STMT(BPF_LD+BPF_W+BPF_ABS, (offset))
  128. // Return constant value
  129. #define RET(val) STMT(BPF_RET+BPF_K, (val))
  130. // If-equal if the currently loaded value equals input, jump to label.
  131. #define IFEQ(input, label) JMPK(BPF_JEQ, 0, (input), (label))
  132. // If-not-equal if the currently loaded value is not equal to input, jump to label.
  133. #define IFNE(input, label) JMPK(BPF_JEQ, 1, (input), (label))
  134. // If-greater-than
  135. #define IFGT(input, label) JMPK(BPF_JGT, 0, (input), (label))
  136. // If-greater-than-or-equal-to
  137. #define IFGE(input, label) JMPK(BPF_JGE, 0, (input), (label))
  138. // If-less-than
  139. #define IFLT(input, label) JMPK(BPF_JGE, 1, (input), (label))
  140. // If-less-than-or-equal-to
  141. #define IFLE(input, label) JMPK(BPF_JGT, 1, (input), (label))
  142. // labels are integers so they must be predefined
  143. int success = 1;
  144. int fail = 2;
  145. int unmaskOnly = 3;
  146. int isworking = 4;
  147. enum ArchInfo ai = ArchInfo_detect();
  148. uint32_t auditArch = ArchInfo_toAuditArch(ai);
  149. if (auditArch == UINT32_MAX) {
  150. Except_throw(eh, "Could not detect system architecture");
  151. }
  152. struct Filter seccompFilter[] = {
  153. // verify the processor type is the same as what we're setup for.
  154. LOAD(offsetof(struct seccomp_data, arch)),
  155. IFNE(auditArch, fail),
  156. // Get the syscall num.
  157. LOAD(offsetof(struct seccomp_data, nr)),
  158. // udp
  159. #ifdef __NR_sendmsg
  160. IFEQ(__NR_sendmsg, success),
  161. #endif
  162. #ifdef __NR_recvmsg
  163. IFEQ(__NR_recvmsg, success),
  164. #endif
  165. // ETHInterface
  166. #ifdef __NR_sendto
  167. IFEQ(__NR_sendto, success),
  168. #endif
  169. #ifdef __NR_recvfrom
  170. IFEQ(__NR_recvfrom, success),
  171. #endif
  172. #ifdef __NR_socketcall
  173. // 32-bit: recvmsg is a socketcall
  174. IFEQ(__NR_socketcall, success),
  175. #endif
  176. // libuv
  177. IFEQ(__NR_epoll_ctl, success),
  178. IFEQ(__NR_epoll_wait, success),
  179. // TUN (and logging)
  180. IFEQ(__NR_write, success),
  181. IFEQ(__NR_read, success),
  182. // modern librt reads a read-only mapped section of kernel space which contains the time
  183. // older versions need system calls for getting the time.
  184. // i686 glibc-2.18's time() uses __NR_time
  185. // Raspberry Pi and BeagleBone Black don't provide __NR_time
  186. IFEQ(__NR_clock_gettime, success),
  187. #ifdef __NR_time
  188. IFEQ(__NR_time, success),
  189. #endif
  190. // malloc()
  191. IFEQ(__NR_brk, success),
  192. // abort()
  193. IFEQ(__NR_gettid, success),
  194. IFEQ(__NR_tgkill, success),
  195. IFEQ(__NR_rt_sigprocmask, unmaskOnly),
  196. // exit()
  197. IFEQ(__NR_exit_group, success),
  198. // Seccomp_isWorking()
  199. IFEQ(__NR_getpriority, isworking),
  200. // Securiy_checkPermissions() -> canOpenFiles()
  201. IFEQ(__NR_dup, success),
  202. IFEQ(__NR_close, success),
  203. // Security_checkPermissions() -> getMaxMem()
  204. // x86/ARM use ugetrlimit and mmap2
  205. // ARM does not even have __NR_getrlimit or __NR_mmap defined
  206. // and AMD64 does not have __NR_ugetrlimit or __NR_mmap2 defined
  207. #ifdef __NR_getrlimit
  208. IFEQ(__NR_getrlimit, success),
  209. #endif
  210. #ifdef __NR_ugetrlimit
  211. IFEQ(__NR_ugetrlimit, success),
  212. #endif
  213. #ifdef __NR_mmap
  214. IFEQ(__NR_mmap, success),
  215. #endif
  216. #ifdef __NR_mmap2
  217. IFEQ(__NR_mmap2, success),
  218. #endif
  219. // printf()
  220. IFEQ(__NR_fstat, success),
  221. RET(SECCOMP_RET_TRAP),
  222. // We allow sigprocmask to *unmask* signals but we don't allow it to mask them.
  223. LABEL(unmaskOnly),
  224. LOAD(offsetof(struct seccomp_data, args[0])),
  225. IFEQ(SIG_UNBLOCK, success),
  226. RET(SECCOMP_RET_TRAP),
  227. LABEL(isworking),
  228. RET(RET_ERRNO(9000)),
  229. LABEL(fail),
  230. RET(SECCOMP_RET_TRAP),
  231. LABEL(success),
  232. RET(SECCOMP_RET_ALLOW),
  233. };
  234. return compile(seccompFilter, sizeof(seccompFilter)/sizeof(seccompFilter[0]), alloc);
  235. }
  236. static void installFilter(struct sock_fprog* filter, struct Log* logger, struct Except* eh)
  237. {
  238. struct sigaction sa = { .sa_sigaction = catchViolation, .sa_flags = SA_SIGINFO };
  239. if (sigaction(SIGSYS, &sa, NULL)) {
  240. Log_warn(logger, "sigaction(SIGSYS) -> [%s]\n", strerror(errno));
  241. }
  242. if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
  243. // don't worry about it.
  244. Log_warn(logger, "prctl(PR_SET_NO_NEW_PRIVS) -> [%s]\n", strerror(errno));
  245. }
  246. if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, filter) == -1) {
  247. Except_throw(eh, "prctl(PR_SET_SECCOMP) -> [%s]\n", strerror(errno));
  248. }
  249. }
  250. void Seccomp_dropPermissions(struct Allocator* tempAlloc, struct Log* logger, struct Except* eh)
  251. {
  252. struct sock_fprog* filter = mkFilter(tempAlloc, eh);
  253. installFilter(filter, logger, eh);
  254. if (!Seccomp_isWorking()) {
  255. Except_throw(eh, "Seccomp filter not installed properly, Seccomp_isWorking() -> false");
  256. }
  257. }
  258. int Seccomp_isWorking()
  259. {
  260. errno = 0;
  261. // If seccomp is not working, this will fail setting errno to EINVAL
  262. long ret = getpriority(1000, 1);
  263. // Inside of the kernel, it seems to check whether the errno return is sane
  264. // and if it is not, it treates it as a return value, 9000 is very unique so
  265. // we'll check for either case just in case this changes.
  266. return (ret == -1 && errno == 9000) || (ret == -9000 && errno == 0);
  267. }
  268. int Seccomp_exists()
  269. {
  270. return 1;
  271. }