about summary refs log tree commit diff stats
path: root/lib/chaseccomp/chaseccomp.c
blob: 20fc486150c98d8613e5f9e597b955567eccd1b8 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
/*
 * ref. seccomp(2)
 * also bpf(4), except I can't find it on Linux... check a BSD.
 */

#define _GNU_SOURCE
#include <sched.h>
#include <stdlib.h>
#include <stddef.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <sys/mman.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <fcntl.h>
#include <stdint.h>
#include <signal.h>
#include <assert.h>

#include "chaseccomp.h"

static void sigsys_handler_buffer(int sig, siginfo_t *info, void *ucontext)
{
	(void)sig;
	(void)ucontext;
	fprintf(stderr, "Sandbox violation in buffer: syscall #%d\n",
		info->si_syscall);
	abort();
}

int cha_enter_buffer_sandbox(void)
{
	struct sock_filter filter[] = {
#include "chasc_buffer.h"
	};
#ifndef EXPECTED_COUNT
#error "buffer sandbox not built"
#endif
	struct sock_fprog prog = { .len = COUNTOF(filter), .filter = filter };
	struct sigaction act = {
		.sa_flags = SA_SIGINFO,
		.sa_sigaction = sigsys_handler_buffer,
	};

	static_assert(EXPECTED_COUNT == COUNTOF(filter),
		"wrong buffer filter count");
	if (sigaction(SIGSYS, &act, NULL) < 0)
		return 0;
	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
		return 0;
	if (syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog))
		return 0;
	return 1;
}

static void sigsys_handler_network(int sig, siginfo_t *info, void *ucontext)
{
	(void)sig;
	(void)ucontext;
	fprintf(stderr, "Sandbox violation in network: syscall #%d\n",
		info->si_syscall);
	abort();
}

int cha_enter_network_sandbox(void)
{
#undef EXPECTED_COUNT
	struct sock_filter filter[] = {
#include "chasc_network.h"
	};
#ifndef EXPECTED_COUNT
#error "network sandbox not built"
#endif
	struct sock_fprog prog = { .len = COUNTOF(filter), .filter = filter };
	struct sigaction act = {
		.sa_flags = SA_SIGINFO,
		.sa_sigaction = sigsys_handler_network,
	};

	static_assert(EXPECTED_COUNT == COUNTOF(filter),
		"wrong network filter count");
	if (sigaction(SIGSYS, &act, NULL) < 0)
		return 0;
	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
		return 0;
	if (syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog))
		return 0;
	return 1;
}