1 // Copyright 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 // Seccomp BPF helper functions, modified from the Chromium OS version. The
16 // original notice is below.
17 //
18 // Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
19 // Author: Will Drewry <wad@chromium.org>
20 //
21 // The code may be used by anyone for any purpose,
22 // and can serve as a starting point for developing
23 // applications using prctl(PR_ATTACH_SECCOMP_FILTER).
24
25 #include "sandboxed_api/sandbox2/util/bpf_helper.h"
26
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30
bpf_resolve_jumps(struct bpf_labels * labels,struct sock_filter * filter,size_t count)31 int bpf_resolve_jumps(struct bpf_labels *labels, struct sock_filter *filter,
32 size_t count) {
33 if (count < 1 || count > BPF_MAXINSNS) {
34 return -1;
35 }
36 if (labels->count > BPF_LABELS_MAX) {
37 return -1;
38 }
39 /*
40 * Walk it once, backwards, to build the label table and do fixups.
41 * Since backward jumps are disallowed by BPF, this is easy.
42 */
43 for (size_t i = 0; i < count; ++i) {
44 size_t offset = count - i - 1;
45 struct sock_filter *instr = &filter[offset];
46 if (instr->code != (BPF_JMP + BPF_JA)) {
47 continue;
48 }
49 if (instr->k >= labels->count) {
50 fprintf(stderr, "Label index out of bounds: '%d'\n", instr->k);
51 return 1;
52 }
53 switch ((instr->jt << 8) | instr->jf) {
54 case (JUMP_JT << 8) | JUMP_JF:
55 if (labels->labels[instr->k].location == 0xffffffff) {
56 fprintf(stderr, "Unresolved label: '%s'\n",
57 labels->labels[instr->k].label);
58 return 1;
59 }
60 instr->k = labels->labels[instr->k].location - (offset + 1);
61 instr->jt = 0;
62 instr->jf = 0;
63 continue;
64 case (LABEL_JT << 8) | LABEL_JF:
65 if (labels->labels[instr->k].location != 0xffffffff) {
66 fprintf(stderr, "Duplicate label use: '%s'\n",
67 labels->labels[instr->k].label);
68 return 1;
69 }
70 labels->labels[instr->k].location = offset;
71 instr->k = 0; /* fall through */
72 instr->jt = 0;
73 instr->jf = 0;
74 continue;
75 }
76 }
77 return 0;
78 }
79
80 /* Simple lookup table for labels. */
seccomp_bpf_label(struct bpf_labels * labels,const char * label)81 __u32 seccomp_bpf_label(struct bpf_labels *labels, const char *label) {
82 struct __bpf_label *begin = labels->labels;
83 struct __bpf_label *end = begin + labels->count;
84
85 if (labels->count > BPF_LABELS_MAX) {
86 return labels->count;
87 }
88 for (int id = 0; begin < end; ++begin, ++id) {
89 if (!strcmp(label, begin->label)) {
90 return id;
91 }
92 }
93 if (labels->count == BPF_LABELS_MAX) {
94 fprintf(stderr, "Too many labels\n");
95 return labels->count++;
96 }
97 begin->label = label;
98 begin->location = 0xffffffff;
99 return labels->count++;
100 }
101
seccomp_bpf_print(struct sock_filter * filter,size_t count)102 void seccomp_bpf_print(struct sock_filter *filter, size_t count) {
103 struct sock_filter *end = filter + count;
104 for (; filter < end; ++filter)
105 printf("{ code=%u,jt=%u,jf=%u,k=%u },\n", filter->code, filter->jt,
106 filter->jf, filter->k);
107 }
108