Attachment 130267 Details for Bug 100224 – improved libsec.cc

improved libsec.cc

libsec.cc (text/x-c++src), 5.04 KB, created by valo on 2017-03-16 17:53:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: valo

Created: 2017-03-16 17:53:25 UTC

Size: 5.04 KB

patch

obsolete

>#include "libsec.h"
>#include <stdio.h>
>
>#define HAVE_LIBSECCOMP
>#ifdef HAVE_LIBSECCOMP
>
>#include <seccomp.h> /* libseccomp */
>#include <sys/prctl.h> /* prctl */
>#include <sys/socket.h>
>#include <fcntl.h>
>#include <stdlib.h>
>#include <errno.h>
>
>#define ALLOW_RULE(call) { if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(call), 0) < 0) goto out; }
>
>scmp_filter_ctx ctx;
>
>void releaseFilter(void){
>
>    seccomp_release(ctx);
>}
>
>
>int syscallfilter(void){
>
>    // prevent child processes from getting more priv e.g. via setuid, capabilities, ...
>    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
>        perror("prctl SET_NO_NEW_PRIVS");
>        exit(EXIT_FAILURE);
>    }
>
>
>    // prevent escape via ptrace
>    if(prctl (PR_SET_DUMPABLE, 0, 0, 0, 0)){
>        perror("prctl PR_SET_DUMPABLE");
>        exit(EXIT_FAILURE);
>    }
>
>    // initialize the filter
>    ctx = seccomp_init(SCMP_ACT_KILL);
>    if (ctx == NULL)
>        return 1;
>
>    
>    ALLOW_RULE (access);
>    ALLOW_RULE (arch_prctl);
>    ALLOW_RULE (brk);
>    ALLOW_RULE (close);
>    ALLOW_RULE (execve);
>    ALLOW_RULE (exit);
>    ALLOW_RULE (exit_group);
>    ALLOW_RULE (fstat);
>    ALLOW_RULE (getdents);
>    ALLOW_RULE (lseek);
>    ALLOW_RULE (mmap);
>    ALLOW_RULE (mprotect);
>    ALLOW_RULE (mremap);
>    ALLOW_RULE (munmap);
>    ALLOW_RULE (open);
>    ALLOW_RULE (pread64);
>    ALLOW_RULE (read);
>    ALLOW_RULE (rt_sigaction);
>    ALLOW_RULE (rt_sigprocmask);
>    ALLOW_RULE (set_robust_list);
>    ALLOW_RULE (set_tid_address);
>    ALLOW_RULE (stat);
>    ALLOW_RULE (sysinfo);
>    ALLOW_RULE (write);
> 
>
>    
>    /* /\* special restrictions for socket, only allow AF_UNIX/AF_LOCAL *\/ */
>    /* if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1, */
>    /* 			  SCMP_CMP(0, SCMP_CMP_EQ, AF_UNIX)) < 0) */
>    /* 	goto out; */
>
>    /* if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 1, */
>    /* 			  SCMP_CMP(0, SCMP_CMP_EQ, AF_LOCAL)) < 0) */
>    /* 	goto out; */
>
>
>    /* /\* special restrictions for open, prevent opening files for writing *\/ */
>    /* if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1, */
>    /* 			  SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY | O_RDWR, 0)) < 0) */
>    /* 	goto out; */
>
>    /* if (seccomp_rule_add (ctx, SCMP_ACT_ERRNO (EACCES), SCMP_SYS(open), 1, */
>    /* 			  SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) < 0) */
>    /* 	goto out; */
>
>    /* if (seccomp_rule_add (ctx, SCMP_ACT_ERRNO (EACCES), SCMP_SYS(open), 1, */
>    /* 			  SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) < 0) */
>    /* 	goto out; */
>
>
>
>
>
>    // ------------ experimental filters ---------------
>
>
>
>
>    /* this filter is susceptible to TOCTOU race conditions, providing limited use */
>    /* allow opening only specified files identified by their file descriptors*/
>
>    // this requires either a list of all files to open (A LOT!!!)
>    // or needs to be applied only after initialisation, right before parsing
>    // if(seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 1,
>    //                         SCMP_CMP(SCMP_CMP_EQ, fd)) < 0) // or < 1 ???
>    //     goto out;
>
>
>    /* restricting write access */
>
>    /* allow stdin */
>    // if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
>    //                         SCMP_CMP(0, SCMP_CMP_EQ, 0)) < 0 )
>    //     goto out;
>
>    /* allow stdout */
>    // if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
>    //                             SCMP_CMP(0, SCMP_CMP_EQ, 1)) < 0 )
>    //     goto out;
>
>    /* /\* allow stderr *\/ */
>    /* if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1, */
>    /*                              SCMP_CMP(0, SCMP_CMP_EQ, 2)) < 0 ) */
>    /*     goto out; */
>
>
>    /* restrict writev (write a vector) access */
>    // this does not seem reliable but it surprisingly is. investigate more
>    //if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(writev), 1,
>    //                            SCMP_CMP(0, SCMP_CMP_EQ, 3)) < 0 )
>    //    goto out;
>
>    //test if repeating this after some time or denying it works
>
>
>    // firest attempt to filter poll requests
>    // if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(poll), 1,
>    // 	                      SCMP_CMP(0, SCMP_CMP_MASKED_EQ, POLLIN | POLL, 0)) < 0)
>    // 	goto out;
>
>
>    /* restrict fcntl calls */
>    // this syscall sets the file descriptor to read write
>    //if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl), 1,
>    //                            SCMP_CMP(0, SCMP_CMP_EQ, 3)) < 0 )
>    //    goto out;
>    // fcntl(3, F_GETFL)                       = 0x2 (flags O_RDWR)
>    // fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
>    // fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
>
>
>
>
>    // ------------------ end of experimental filters ------------------
>
>
>
>
>
>    //applying filter...
>   if (seccomp_load (ctx) >= 0)
>       return 0;
>
> out:
>    //something went wrong
>    seccomp_release(ctx);
>    return 1;
>}
>
>#else /* HAVE_LIBSECCOMP */
>
>
>int syscallfilter(void){
>
>    perror("No seccomp support compiled-in\n");
>    return 1;
>}
>
>
>void releaseFilter(void){
>
>    perror("No seccomp support compiled-in\n");
>}
>
>
>#endif /* HAVE_LIBSECCOMP */

Actions: View

Attachments on bug 100224: 130253 | 130267

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.