1 /*
2 * Copyright (c) 2015 Dmitry V. Levin <ldv@altlinux.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. The name of the author may not be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28 #ifdef HAVE_CONFIG_H
29 # include "config.h"
30 #endif
31
32 #include <stddef.h>
33 #include <unistd.h>
34 #include <stdio.h>
35 #include <errno.h>
36 #include <sys/syscall.h>
37
38 #ifdef HAVE_PRCTL
39 # include <sys/prctl.h>
40 #endif
41 #ifdef HAVE_LINUX_SECCOMP_H
42 # include <linux/seccomp.h>
43 #endif
44 #ifdef HAVE_LINUX_FILTER_H
45 # include <linux/filter.h>
46 #endif
47
48 #if defined HAVE_PRCTL \
49 && defined PR_SET_NO_NEW_PRIVS \
50 && defined PR_SET_SECCOMP \
51 && defined SECCOMP_MODE_FILTER \
52 && defined SECCOMP_RET_ERRNO \
53 && defined BPF_JUMP \
54 && defined BPF_STMT
55
56 #define SOCK_FILTER_ALLOW_SYSCALL(nr) \
57 BPF_JUMP(BPF_JMP | BPF_K | BPF_JEQ, __NR_ ## nr, 0, 1), \
58 BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
59
60 #define SOCK_FILTER_DENY_SYSCALL(nr, err) \
61 BPF_JUMP(BPF_JMP | BPF_K | BPF_JEQ, __NR_ ## nr, 0, 1), \
62 BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | (SECCOMP_RET_DATA & (err)))
63
64 #define SOCK_FILTER_KILL_PROCESS \
65 BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL)
66
67 #define PRINT_ALLOW_SYSCALL(nr) \
68 printf("BPF_JUMP(BPF_JMP | BPF_K | BPF_JEQ, %#x, 0, 0x1), " \
69 "BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW), ", \
70 __NR_ ## nr)
71
72 #define PRINT_DENY_SYSCALL(nr, err) \
73 printf("BPF_JUMP(BPF_JMP | BPF_K | BPF_JEQ, %#x, 0, 0x1), " \
74 "BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | %#x), ", \
75 __NR_ ## nr, err)
76
77 static const struct sock_filter filter[] = {
78 /* load syscall number */
79 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
80
81 /* allow syscalls */
82 SOCK_FILTER_ALLOW_SYSCALL(close),
83 SOCK_FILTER_ALLOW_SYSCALL(exit),
84 SOCK_FILTER_ALLOW_SYSCALL(exit_group),
85
86 /* deny syscalls */
87 SOCK_FILTER_DENY_SYSCALL(sync, EBUSY),
88 SOCK_FILTER_DENY_SYSCALL(setsid, EPERM),
89
90 /* kill process */
91 SOCK_FILTER_KILL_PROCESS
92 };
93
94 static const struct sock_fprog prog = {
95 .len = sizeof(filter) / sizeof(filter[0]),
96 .filter = (struct sock_filter *) filter,
97 };
98
99 int
main(void)100 main(void)
101 {
102 int fds[2];
103
104 puts("prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) = 0");
105
106 printf("prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, [");
107
108 printf("BPF_STMT(BPF_LD | BPF_W | BPF_ABS, %#x), ",
109 (unsigned) offsetof(struct seccomp_data, nr));
110
111 PRINT_ALLOW_SYSCALL(close);
112 PRINT_ALLOW_SYSCALL(exit);
113 PRINT_ALLOW_SYSCALL(exit_group);
114
115 PRINT_DENY_SYSCALL(sync, EBUSY),
116 PRINT_DENY_SYSCALL(setsid, EPERM),
117
118 printf("BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL)");
119
120 puts("]) = 0");
121 puts("+++ exited with 0 +++");
122
123 fflush(stdout);
124 close(0);
125 close(1);
126
127 if (pipe(fds) ||
128 prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) ||
129 prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) ||
130 close(0) || close(1))
131 _exit(77);
132
133 _exit(0);
134 }
135
136 #else
137
main(void)138 int main(void) { return 77; }
139
140 #endif
141