syscall_sets.h 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130
  1. // Copyright (c) 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_SETS_H_
  5. #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_SETS_H_
  6. #include "build/build_config.h"
  7. #include "sandbox/sandbox_export.h"
  8. // These are helpers to build seccomp-bpf policies, i.e. policies for a
  9. // sandbox that reduces the Linux kernel's attack surface. Given their
  10. // nature, they don't have any clear semantics and are completely
  11. // "implementation-defined".
  12. namespace sandbox {
  13. class SANDBOX_EXPORT SyscallSets {
  14. public:
  15. SyscallSets() = delete;
  16. SyscallSets(const SyscallSets&) = delete;
  17. SyscallSets& operator=(const SyscallSets&) = delete;
  18. static bool IsKill(int sysno);
  19. static bool IsAllowedGettime(int sysno);
  20. static bool IsCurrentDirectory(int sysno);
  21. static bool IsUmask(int sysno);
  22. // System calls that directly access the file system. They might acquire
  23. // a new file descriptor or otherwise perform an operation directly
  24. // via a path.
  25. static bool IsFileSystem(int sysno);
  26. static bool IsAllowedFileSystemAccessViaFd(int sysno);
  27. static bool IsDeniedFileSystemAccessViaFd(int sysno);
  28. static bool IsGetSimpleId(int sysno);
  29. static bool IsProcessPrivilegeChange(int sysno);
  30. static bool IsProcessGroupOrSession(int sysno);
  31. static bool IsAllowedSignalHandling(int sysno);
  32. static bool IsAllowedOperationOnFd(int sysno);
  33. static bool IsKernelInternalApi(int sysno);
  34. // This should be thought through in conjunction with IsFutex().
  35. static bool IsAllowedProcessStartOrDeath(int sysno);
  36. // It's difficult to restrict those, but there is attack surface here.
  37. static bool IsAllowedFutex(int sysno);
  38. static bool IsAllowedEpoll(int sysno);
  39. static bool IsAllowedGetOrModifySocket(int sysno);
  40. static bool IsDeniedGetOrModifySocket(int sysno);
  41. #if defined(__i386__) || \
  42. (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS))
  43. // Big multiplexing system call for sockets.
  44. static bool IsSocketCall(int sysno);
  45. #endif
  46. #if defined(__x86_64__) || defined(__arm__) || defined(__mips__) || \
  47. defined(__aarch64__) || defined(__riscv)
  48. static bool IsNetworkSocketInformation(int sysno);
  49. #endif
  50. static bool IsAllowedAddressSpaceAccess(int sysno);
  51. static bool IsAllowedGeneralIo(int sysno);
  52. static bool IsPrctl(int sysno);
  53. static bool IsSeccomp(int sysno);
  54. static bool IsAllowedBasicScheduler(int sysno);
  55. static bool IsAdminOperation(int sysno);
  56. static bool IsKernelModule(int sysno);
  57. static bool IsGlobalFSViewChange(int sysno);
  58. static bool IsFsControl(int sysno);
  59. static bool IsSendfile(int sysno);
  60. static bool IsNuma(int sysno);
  61. static bool IsMessageQueue(int sysno);
  62. static bool IsGlobalProcessEnvironment(int sysno);
  63. static bool IsDebug(int sysno);
  64. static bool IsGlobalSystemStatus(int sysno);
  65. static bool IsEventFd(int sysno);
  66. // System calls used for dlopen(), which loads shared libraries. May overlap
  67. // with other syscall sets.
  68. static bool IsDlopen(int sysno);
  69. // Asynchronous I/O API.
  70. static bool IsAsyncIo(int sysno);
  71. static bool IsKeyManagement(int sysno);
  72. #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
  73. (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS)) || \
  74. defined(__riscv)
  75. static bool IsSystemVSemaphores(int sysno);
  76. #endif
  77. #if defined(__i386__) || defined(__x86_64__) || defined(__arm__) || \
  78. defined(__aarch64__) || \
  79. (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS)) || \
  80. defined(__riscv)
  81. // These give a lot of ambient authority and bypass the setuid sandbox.
  82. static bool IsSystemVSharedMemory(int sysno);
  83. #endif
  84. #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
  85. (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS)) || \
  86. defined(__riscv)
  87. static bool IsSystemVMessageQueue(int sysno);
  88. #endif
  89. #if defined(__i386__) || \
  90. (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_32_BITS))
  91. // Big system V multiplexing system call.
  92. static bool IsSystemVIpc(int sysno);
  93. #endif
  94. static bool IsAnySystemV(int sysno);
  95. static bool IsAdvancedScheduler(int sysno);
  96. static bool IsInotify(int sysno);
  97. static bool IsFaNotify(int sysno);
  98. static bool IsTimer(int sysno);
  99. static bool IsAdvancedTimer(int sysno);
  100. static bool IsClockApi(int sysno);
  101. static bool IsExtendedAttributes(int sysno);
  102. static bool IsMisc(int sysno);
  103. #if defined(__arm__)
  104. static bool IsArmPciConfig(int sysno);
  105. static bool IsArmPrivate(int sysno);
  106. #endif // defined(__arm__)
  107. #if defined(__mips__)
  108. static bool IsMipsPrivate(int sysno);
  109. static bool IsMipsMisc(int sysno);
  110. #endif // defined(__mips__)
  111. #if defined(__riscv)
  112. static bool IsRiscvPrivate(int sysno);
  113. #endif
  114. };
  115. } // namespace sandbox.
  116. #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_SETS_H_