1 /* $NetBSD: seccomp.c,v 1.1.1.3 2019/05/22 17:19:56 christos Exp $ */ 2 3 /* 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice immediately at the beginning of the file, without modification, 9 * this list of conditions, and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR 18 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 /* 27 * libseccomp hooks. 28 */ 29 #include "file.h" 30 31 #ifndef lint 32 #if 0 33 FILE_RCSID("@(#)$File: seccomp.c,v 1.8 2019/02/24 18:12:04 christos Exp $") 34 #else 35 __RCSID("$NetBSD: seccomp.c,v 1.1.1.3 2019/05/22 17:19:56 christos Exp $"); 36 #endif 37 #endif /* lint */ 38 39 #if HAVE_LIBSECCOMP 40 #include <seccomp.h> /* libseccomp */ 41 #include <sys/prctl.h> /* prctl */ 42 #include <sys/socket.h> 43 #include <fcntl.h> 44 #include <stdlib.h> 45 #include <errno.h> 46 47 #define DENY_RULE(call) \ 48 do \ 49 if (seccomp_rule_add (ctx, SCMP_ACT_KILL, SCMP_SYS(call), 0) == -1) \ 50 goto out; \ 51 while (/*CONSTCOND*/0) 52 #define ALLOW_RULE(call) \ 53 do \ 54 if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(call), 0) == -1) \ 55 goto out; \ 56 while (/*CONSTCOND*/0) 57 58 static scmp_filter_ctx ctx; 59 60 61 int 62 enable_sandbox_basic(void) 63 { 64 65 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) 66 return -1; 67 68 if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) == -1) 69 return -1; 70 71 // initialize the filter 72 ctx = seccomp_init(SCMP_ACT_ALLOW); 73 if (ctx == NULL) 74 return 1; 75 76 DENY_RULE(_sysctl); 77 DENY_RULE(acct); 78 DENY_RULE(add_key); 79 DENY_RULE(adjtimex); 80 DENY_RULE(chroot); 81 DENY_RULE(clock_adjtime); 82 DENY_RULE(create_module); 83 DENY_RULE(delete_module); 84 DENY_RULE(fanotify_init); 85 DENY_RULE(finit_module); 86 DENY_RULE(get_kernel_syms); 87 DENY_RULE(get_mempolicy); 88 DENY_RULE(init_module); 89 DENY_RULE(io_cancel); 90 DENY_RULE(io_destroy); 91 DENY_RULE(io_getevents); 92 DENY_RULE(io_setup); 93 DENY_RULE(io_submit); 94 DENY_RULE(ioperm); 95 DENY_RULE(iopl); 96 DENY_RULE(ioprio_set); 97 DENY_RULE(kcmp); 98 #ifdef __NR_kexec_file_load 99 DENY_RULE(kexec_file_load); 100 #endif 101 DENY_RULE(kexec_load); 102 DENY_RULE(keyctl); 103 DENY_RULE(lookup_dcookie); 104 DENY_RULE(mbind); 105 DENY_RULE(nfsservctl); 106 DENY_RULE(migrate_pages); 107 DENY_RULE(modify_ldt); 108 DENY_RULE(mount); 109 DENY_RULE(move_pages); 110 DENY_RULE(name_to_handle_at); 111 DENY_RULE(open_by_handle_at); 112 DENY_RULE(perf_event_open); 113 DENY_RULE(pivot_root); 114 DENY_RULE(process_vm_readv); 115 DENY_RULE(process_vm_writev); 116 DENY_RULE(ptrace); 117 DENY_RULE(reboot); 118 DENY_RULE(remap_file_pages); 119 DENY_RULE(request_key); 120 DENY_RULE(set_mempolicy); 121 DENY_RULE(swapoff); 122 DENY_RULE(swapon); 123 DENY_RULE(sysfs); 124 DENY_RULE(syslog); 125 DENY_RULE(tuxcall); 126 DENY_RULE(umount2); 127 DENY_RULE(uselib); 128 DENY_RULE(vmsplice); 129 130 // blocking dangerous syscalls that file should not need 131 DENY_RULE (execve); 132 DENY_RULE (socket); 133 // ... 134 135 136 // applying filter... 137 if (seccomp_load (ctx) == -1) 138 goto out; 139 // free ctx after the filter has been loaded into the kernel 140 seccomp_release(ctx); 141 return 0; 142 143 out: 144 seccomp_release(ctx); 145 return -1; 146 } 147 148 149 int 150 enable_sandbox_full(void) 151 { 152 153 // prevent child processes from getting more priv e.g. via setuid, 154 // capabilities, ... 155 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) 156 return -1; 157 158 if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) == -1) 159 return -1; 160 161 // initialize the filter 162 ctx = seccomp_init(SCMP_ACT_KILL); 163 if (ctx == NULL) 164 return -1; 165 166 ALLOW_RULE(access); 167 ALLOW_RULE(brk); 168 ALLOW_RULE(close); 169 ALLOW_RULE(dup2); 170 ALLOW_RULE(exit); 171 ALLOW_RULE(exit_group); 172 ALLOW_RULE(fcntl); 173 ALLOW_RULE(fcntl64); 174 ALLOW_RULE(fstat); 175 ALLOW_RULE(fstat64); 176 ALLOW_RULE(getdents); 177 #ifdef __NR_getdents64 178 ALLOW_RULE(getdents64); 179 #endif 180 ALLOW_RULE(ioctl); 181 ALLOW_RULE(lseek); 182 ALLOW_RULE(_llseek); 183 ALLOW_RULE(lstat); 184 ALLOW_RULE(lstat64); 185 ALLOW_RULE(madvise); 186 ALLOW_RULE(mmap); 187 ALLOW_RULE(mmap2); 188 ALLOW_RULE(mprotect); 189 ALLOW_RULE(mremap); 190 ALLOW_RULE(munmap); 191 #ifdef __NR_newfstatat 192 ALLOW_RULE(newfstatat); 193 #endif 194 ALLOW_RULE(open); 195 ALLOW_RULE(openat); 196 ALLOW_RULE(pread64); 197 ALLOW_RULE(read); 198 ALLOW_RULE(readlink); 199 ALLOW_RULE(rt_sigaction); 200 ALLOW_RULE(rt_sigprocmask); 201 ALLOW_RULE(rt_sigreturn); 202 ALLOW_RULE(select); 203 ALLOW_RULE(stat); 204 ALLOW_RULE(stat64); 205 ALLOW_RULE(sysinfo); 206 ALLOW_RULE(unlink); 207 ALLOW_RULE(write); 208 209 210 #if 0 211 // needed by valgrind 212 ALLOW_RULE(gettid); 213 ALLOW_RULE(getpid); 214 ALLOW_RULE(rt_sigtimedwait); 215 #endif 216 217 #if 0 218 /* special restrictions for socket, only allow AF_UNIX/AF_LOCAL */ 219 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1, 220 SCMP_CMP(0, SCMP_CMP_EQ, AF_UNIX)) == -1) 221 goto out; 222 223 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1, 224 SCMP_CMP(0, SCMP_CMP_EQ, AF_LOCAL)) == -1) 225 goto out; 226 227 228 /* special restrictions for open, prevent opening files for writing */ 229 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1, 230 SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY | O_RDWR, 0)) == -1) 231 goto out; 232 233 if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open), 1, 234 SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) == -1) 235 goto out; 236 237 if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open), 1, 238 SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) == -1) 239 goto out; 240 241 242 /* allow stderr */ 243 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1, 244 SCMP_CMP(0, SCMP_CMP_EQ, 2)) == -1) 245 goto out; 246 #endif 247 248 // applying filter... 249 if (seccomp_load(ctx) == -1) 250 goto out; 251 // free ctx after the filter has been loaded into the kernel 252 seccomp_release(ctx); 253 return 0; 254 255 out: 256 // something went wrong 257 seccomp_release(ctx); 258 return -1; 259 } 260 #endif 261