1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
/*
* ref. seccomp(2)
* also bpf(4), except I can't find it on Linux... check a BSD.
*/
#define _GNU_SOURCE
#include <sched.h>
#include <stdlib.h>
#include <stddef.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <sys/mman.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <fcntl.h>
#include <stdint.h>
#include <signal.h>
#include <assert.h>
#include "chaseccomp.h"
static void sigsys_handler_buffer(int sig, siginfo_t *info, void *ucontext)
{
(void)sig;
(void)ucontext;
fprintf(stderr, "Sandbox violation in buffer: syscall #%d\n",
info->si_syscall);
abort();
}
int cha_enter_buffer_sandbox(void)
{
struct sock_filter filter[] = {
#include "chasc_buffer.h"
};
#ifndef EXPECTED_COUNT
#error "buffer sandbox not built"
#endif
struct sock_fprog prog = { .len = COUNTOF(filter), .filter = filter };
struct sigaction act = {
.sa_flags = SA_SIGINFO,
.sa_sigaction = sigsys_handler_buffer,
};
static_assert(EXPECTED_COUNT == COUNTOF(filter),
"wrong buffer filter count");
if (sigaction(SIGSYS, &act, NULL) < 0)
return 0;
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
return 0;
if (syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog))
return 0;
return 1;
}
static void sigsys_handler_network(int sig, siginfo_t *info, void *ucontext)
{
(void)sig;
(void)ucontext;
fprintf(stderr, "Sandbox violation in network: syscall #%d\n",
info->si_syscall);
abort();
}
int cha_enter_network_sandbox(void)
{
#undef EXPECTED_COUNT
struct sock_filter filter[] = {
#include "chasc_network.h"
};
#ifndef EXPECTED_COUNT
#error "network sandbox not built"
#endif
struct sock_fprog prog = { .len = COUNTOF(filter), .filter = filter };
struct sigaction act = {
.sa_flags = SA_SIGINFO,
.sa_sigaction = sigsys_handler_network,
};
static_assert(EXPECTED_COUNT == COUNTOF(filter),
"wrong network filter count");
if (sigaction(SIGSYS, &act, NULL) < 0)
return 0;
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
return 0;
if (syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog))
return 0;
return 1;
}
|