1 /* 2 * Redistribution and use in source and binary forms, with or without 3 * modification, are permitted provided that the following conditions 4 * are met: 5 * 1. Redistributions of source code must retain the above copyright 6 * notice immediately at the beginning of the file, without modification, 7 * this list of conditions, and the following disclaimer. 8 * 2. Redistributions in binary form must reproduce the above copyright 9 * notice, this list of conditions and the following disclaimer in the 10 * documentation and/or other materials provided with the distribution. 11 * 12 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 13 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 14 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 15 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR 16 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 17 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 18 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 19 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 20 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 21 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 22 * SUCH DAMAGE. 23 */ 24 /* 25 * libseccomp hooks. 26 */ 27 #include "file.h" 28 29 #ifndef lint 30 FILE_RCSID("@(#)$File: seccomp.c,v 1.2 2017/11/04 01:14:25 christos Exp $") 31 #endif /* lint */ 32 33 #if HAVE_LIBSECCOMP 34 #include <seccomp.h> /* libseccomp */ 35 #include <sys/prctl.h> /* prctl */ 36 #include <sys/socket.h> 37 #include <fcntl.h> 38 #include <stdlib.h> 39 #include <errno.h> 40 41 #define DENY_RULE(call) \ 42 do \ 43 if (seccomp_rule_add (ctx, SCMP_ACT_KILL, SCMP_SYS(call), 0) == -1) \ 44 goto out; \ 45 while (/*CONSTCOND*/0) 46 #define ALLOW_RULE(call) \ 47 do \ 48 if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(call), 0) == -1) \ 49 goto out; \ 50 while (/*CONSTCOND*/0) 51 52 static scmp_filter_ctx ctx; 53 54 55 int 56 enable_sandbox_basic(void) 57 { 58 59 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) 60 return -1; 61 62 #if 0 63 // prevent escape via ptrace 64 prctl(PR_SET_DUMPABLE, 0); 65 #endif 66 67 if (prctl (PR_SET_DUMPABLE, 0, 0, 0, 0) == -1) 68 return -1; 69 70 // initialize the filter 71 ctx = seccomp_init(SCMP_ACT_ALLOW); 72 if (ctx == NULL) 73 return 1; 74 75 DENY_RULE(_sysctl); 76 DENY_RULE(acct); 77 DENY_RULE(add_key); 78 DENY_RULE(adjtimex); 79 DENY_RULE(chroot); 80 DENY_RULE(clock_adjtime); 81 DENY_RULE(create_module); 82 DENY_RULE(delete_module); 83 DENY_RULE(fanotify_init); 84 DENY_RULE(finit_module); 85 DENY_RULE(get_kernel_syms); 86 DENY_RULE(get_mempolicy); 87 DENY_RULE(init_module); 88 DENY_RULE(io_cancel); 89 DENY_RULE(io_destroy); 90 DENY_RULE(io_getevents); 91 DENY_RULE(io_setup); 92 DENY_RULE(io_submit); 93 DENY_RULE(ioperm); 94 DENY_RULE(iopl); 95 DENY_RULE(ioprio_set); 96 DENY_RULE(kcmp); 97 #ifdef __NR_kexec_file_load 98 DENY_RULE(kexec_file_load); 99 #endif 100 DENY_RULE(kexec_load); 101 DENY_RULE(keyctl); 102 DENY_RULE(lookup_dcookie); 103 DENY_RULE(mbind); 104 DENY_RULE(nfsservctl); 105 DENY_RULE(migrate_pages); 106 DENY_RULE(modify_ldt); 107 DENY_RULE(mount); 108 DENY_RULE(move_pages); 109 DENY_RULE(name_to_handle_at); 110 DENY_RULE(open_by_handle_at); 111 DENY_RULE(perf_event_open); 112 DENY_RULE(pivot_root); 113 DENY_RULE(process_vm_readv); 114 DENY_RULE(process_vm_writev); 115 DENY_RULE(ptrace); 116 DENY_RULE(reboot); 117 DENY_RULE(remap_file_pages); 118 DENY_RULE(request_key); 119 DENY_RULE(set_mempolicy); 120 DENY_RULE(swapoff); 121 DENY_RULE(swapon); 122 DENY_RULE(sysfs); 123 DENY_RULE(syslog); 124 DENY_RULE(tuxcall); 125 DENY_RULE(umount2); 126 DENY_RULE(uselib); 127 DENY_RULE(vmsplice); 128 129 // blocking dangerous syscalls that file should not need 130 DENY_RULE (execve); 131 DENY_RULE (socket); 132 // ... 133 134 135 // applying filter... 136 if (seccomp_load (ctx) == -1) 137 goto out; 138 // free ctx after the filter has been loaded into the kernel 139 seccomp_release(ctx); 140 return 0; 141 142 out: 143 seccomp_release(ctx); 144 return -1; 145 } 146 147 148 int 149 enable_sandbox_full(void) 150 { 151 152 // prevent child processes from getting more priv e.g. via setuid, 153 // capabilities, ... 154 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) 155 return -1; 156 157 if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) == -1) 158 return -1; 159 160 // initialize the filter 161 ctx = seccomp_init(SCMP_ACT_KILL); 162 if (ctx == NULL) 163 return -1; 164 165 ALLOW_RULE(access); 166 ALLOW_RULE(brk); 167 ALLOW_RULE(close); 168 ALLOW_RULE(dup2); 169 ALLOW_RULE(exit); 170 ALLOW_RULE(exit_group); 171 ALLOW_RULE(fcntl); 172 ALLOW_RULE(fstat); 173 ALLOW_RULE(getdents); 174 ALLOW_RULE(ioctl); 175 ALLOW_RULE(lseek); 176 ALLOW_RULE(lstat); 177 ALLOW_RULE(mmap); 178 ALLOW_RULE(mprotect); 179 ALLOW_RULE(mremap); 180 ALLOW_RULE(munmap); 181 ALLOW_RULE(open); 182 ALLOW_RULE(openat); 183 ALLOW_RULE(pread64); 184 ALLOW_RULE(read); 185 ALLOW_RULE(readlink); 186 ALLOW_RULE(rt_sigaction); 187 ALLOW_RULE(rt_sigprocmask); 188 ALLOW_RULE(rt_sigreturn); 189 ALLOW_RULE(select); 190 ALLOW_RULE(stat); 191 ALLOW_RULE(sysinfo); 192 ALLOW_RULE(unlink); 193 ALLOW_RULE(write); 194 195 196 #if 0 197 // needed by valgrind 198 ALLOW_RULE(gettid); 199 ALLOW_RULE(getpid); 200 ALLOW_RULE(rt_sigtimedwait); 201 #endif 202 203 #if 0 204 /* special restrictions for socket, only allow AF_UNIX/AF_LOCAL */ 205 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1, 206 SCMP_CMP(0, SCMP_CMP_EQ, AF_UNIX)) == -1) 207 goto out; 208 209 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1, 210 SCMP_CMP(0, SCMP_CMP_EQ, AF_LOCAL)) == -1) 211 goto out; 212 213 214 /* special restrictions for open, prevent opening files for writing */ 215 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1, 216 SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY | O_RDWR, 0)) == -1) 217 goto out; 218 219 if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open), 1, 220 SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) == -1) 221 goto out; 222 223 if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open), 1, 224 SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) == -1) 225 goto out; 226 227 228 /* allow stderr */ 229 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1, 230 SCMP_CMP(0, SCMP_CMP_EQ, 2)) == -1) 231 goto out; 232 #endif 233 234 // applying filter... 235 if (seccomp_load(ctx) == -1) 236 goto out; 237 // free ctx after the filter has been loaded into the kernel 238 seccomp_release(ctx); 239 return 0; 240 241 out: 242 // something went wrong 243 seccomp_release(ctx); 244 return -1; 245 } 246 #endif 247