bpf-direct.c 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Seccomp filter example for x86 (32-bit and 64-bit) with BPF macros
  4. *
  5. * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
  6. * Author: Will Drewry <wad@chromium.org>
  7. *
  8. * The code may be used by anyone for any purpose,
  9. * and can serve as a starting point for developing
  10. * applications using prctl(PR_SET_SECCOMP, 2, ...).
  11. */
  12. #if defined(__i386__) || defined(__x86_64__)
  13. #define SUPPORTED_ARCH 1
  14. #endif
  15. #if defined(SUPPORTED_ARCH)
  16. #define __USE_GNU 1
  17. #define _GNU_SOURCE 1
  18. #include <linux/types.h>
  19. #include <linux/filter.h>
  20. #include <linux/seccomp.h>
  21. #include <linux/unistd.h>
  22. #include <signal.h>
  23. #include <stdio.h>
  24. #include <stddef.h>
  25. #include <string.h>
  26. #include <sys/prctl.h>
  27. #include <unistd.h>
  28. #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
  29. #define syscall_nr (offsetof(struct seccomp_data, nr))
  30. #if defined(__i386__)
  31. #define REG_RESULT REG_EAX
  32. #define REG_SYSCALL REG_EAX
  33. #define REG_ARG0 REG_EBX
  34. #define REG_ARG1 REG_ECX
  35. #define REG_ARG2 REG_EDX
  36. #define REG_ARG3 REG_ESI
  37. #define REG_ARG4 REG_EDI
  38. #define REG_ARG5 REG_EBP
  39. #elif defined(__x86_64__)
  40. #define REG_RESULT REG_RAX
  41. #define REG_SYSCALL REG_RAX
  42. #define REG_ARG0 REG_RDI
  43. #define REG_ARG1 REG_RSI
  44. #define REG_ARG2 REG_RDX
  45. #define REG_ARG3 REG_R10
  46. #define REG_ARG4 REG_R8
  47. #define REG_ARG5 REG_R9
  48. #endif
  49. #ifndef PR_SET_NO_NEW_PRIVS
  50. #define PR_SET_NO_NEW_PRIVS 38
  51. #endif
  52. #ifndef SYS_SECCOMP
  53. #define SYS_SECCOMP 1
  54. #endif
  55. static void emulator(int nr, siginfo_t *info, void *void_context)
  56. {
  57. ucontext_t *ctx = (ucontext_t *)(void_context);
  58. int syscall;
  59. char *buf;
  60. ssize_t bytes;
  61. size_t len;
  62. if (info->si_code != SYS_SECCOMP)
  63. return;
  64. if (!ctx)
  65. return;
  66. syscall = ctx->uc_mcontext.gregs[REG_SYSCALL];
  67. buf = (char *) ctx->uc_mcontext.gregs[REG_ARG1];
  68. len = (size_t) ctx->uc_mcontext.gregs[REG_ARG2];
  69. if (syscall != __NR_write)
  70. return;
  71. if (ctx->uc_mcontext.gregs[REG_ARG0] != STDERR_FILENO)
  72. return;
  73. /* Redirect stderr messages to stdout. Doesn't handle EINTR, etc */
  74. ctx->uc_mcontext.gregs[REG_RESULT] = -1;
  75. if (write(STDOUT_FILENO, "[ERR] ", 6) > 0) {
  76. bytes = write(STDOUT_FILENO, buf, len);
  77. ctx->uc_mcontext.gregs[REG_RESULT] = bytes;
  78. }
  79. return;
  80. }
  81. static int install_emulator(void)
  82. {
  83. struct sigaction act;
  84. sigset_t mask;
  85. memset(&act, 0, sizeof(act));
  86. sigemptyset(&mask);
  87. sigaddset(&mask, SIGSYS);
  88. act.sa_sigaction = &emulator;
  89. act.sa_flags = SA_SIGINFO;
  90. if (sigaction(SIGSYS, &act, NULL) < 0) {
  91. perror("sigaction");
  92. return -1;
  93. }
  94. if (sigprocmask(SIG_UNBLOCK, &mask, NULL)) {
  95. perror("sigprocmask");
  96. return -1;
  97. }
  98. return 0;
  99. }
  100. static int install_filter(void)
  101. {
  102. struct sock_filter filter[] = {
  103. /* Grab the system call number */
  104. BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_nr),
  105. /* Jump table for the allowed syscalls */
  106. BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_rt_sigreturn, 0, 1),
  107. BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
  108. #ifdef __NR_sigreturn
  109. BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_sigreturn, 0, 1),
  110. BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
  111. #endif
  112. BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_exit_group, 0, 1),
  113. BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
  114. BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_exit, 0, 1),
  115. BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
  116. BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_read, 1, 0),
  117. BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_write, 3, 2),
  118. /* Check that read is only using stdin. */
  119. BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_arg(0)),
  120. BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, STDIN_FILENO, 4, 0),
  121. BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
  122. /* Check that write is only using stdout */
  123. BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_arg(0)),
  124. BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, STDOUT_FILENO, 1, 0),
  125. /* Trap attempts to write to stderr */
  126. BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, STDERR_FILENO, 1, 2),
  127. BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
  128. BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP),
  129. BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
  130. };
  131. struct sock_fprog prog = {
  132. .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
  133. .filter = filter,
  134. };
  135. if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
  136. perror("prctl(NO_NEW_PRIVS)");
  137. return 1;
  138. }
  139. if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
  140. perror("prctl");
  141. return 1;
  142. }
  143. return 0;
  144. }
  145. #define payload(_c) (_c), sizeof((_c))
  146. int main(int argc, char **argv)
  147. {
  148. char buf[4096];
  149. ssize_t bytes = 0;
  150. if (install_emulator())
  151. return 1;
  152. if (install_filter())
  153. return 1;
  154. syscall(__NR_write, STDOUT_FILENO,
  155. payload("OHAI! WHAT IS YOUR NAME? "));
  156. bytes = syscall(__NR_read, STDIN_FILENO, buf, sizeof(buf));
  157. syscall(__NR_write, STDOUT_FILENO, payload("HELLO, "));
  158. syscall(__NR_write, STDOUT_FILENO, buf, bytes);
  159. syscall(__NR_write, STDERR_FILENO,
  160. payload("Error message going to STDERR\n"));
  161. return 0;
  162. }
  163. #else /* SUPPORTED_ARCH */
  164. /*
  165. * This sample is x86-only. Since kernel samples are compiled with the
  166. * host toolchain, a non-x86 host will result in using only the main()
  167. * below.
  168. */
  169. int main(void)
  170. {
  171. return 1;
  172. }
  173. #endif /* SUPPORTED_ARCH */