1 /*
2 * Check verbose decoding of prctl PR_SET_SECCOMP SECCOMP_MODE_FILTER.
3 *
4 * Copyright (c) 2015-2016 Dmitry V. Levin <ldv@altlinux.org>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. The name of the author may not be used to endorse or promote products
16 * derived from this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30 #include "tests.h"
31 #include <stddef.h>
32 #include <unistd.h>
33 #include <stdio.h>
34 #include <errno.h>
35 #include <asm/unistd.h>
36
37 #ifdef HAVE_PRCTL
38 # include <sys/prctl.h>
39 #endif
40 #ifdef HAVE_LINUX_SECCOMP_H
41 # include <linux/seccomp.h>
42 #endif
43 #ifdef HAVE_LINUX_FILTER_H
44 # include <linux/filter.h>
45 #endif
46
47 #if defined HAVE_PRCTL \
48 && defined PR_SET_NO_NEW_PRIVS \
49 && defined PR_SET_SECCOMP \
50 && defined SECCOMP_MODE_FILTER \
51 && defined SECCOMP_RET_ERRNO \
52 && defined BPF_JUMP \
53 && defined BPF_STMT
54
55 #define SOCK_FILTER_ALLOW_SYSCALL(nr) \
56 BPF_JUMP(BPF_JMP|BPF_K|BPF_JEQ, __NR_ ## nr, 0, 1), \
57 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW)
58
59 #define SOCK_FILTER_DENY_SYSCALL(nr, err) \
60 BPF_JUMP(BPF_JMP|BPF_K|BPF_JEQ, __NR_ ## nr, 0, 1), \
61 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO|(SECCOMP_RET_DATA & (err)))
62
63 #define SOCK_FILTER_KILL_PROCESS \
64 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL)
65
66 #define PRINT_ALLOW_SYSCALL(nr) \
67 printf("BPF_JUMP(BPF_JMP|BPF_K|BPF_JEQ, %#x, 0, 0x1), " \
68 "BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), ", \
69 __NR_ ## nr)
70
71 #define PRINT_DENY_SYSCALL(nr, err) \
72 printf("BPF_JUMP(BPF_JMP|BPF_K|BPF_JEQ, %#x, 0, 0x1), " \
73 "BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO|%#x), ", \
74 __NR_ ## nr, err)
75
76 static const struct sock_filter filter[] = {
77 /* load syscall number */
78 BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, nr)),
79
80 /* allow syscalls */
81 SOCK_FILTER_ALLOW_SYSCALL(close),
82 SOCK_FILTER_ALLOW_SYSCALL(exit),
83 SOCK_FILTER_ALLOW_SYSCALL(exit_group),
84
85 /* deny syscalls */
86 SOCK_FILTER_DENY_SYSCALL(sync, EBUSY),
87 SOCK_FILTER_DENY_SYSCALL(setsid, EPERM),
88
89 /* kill process */
90 SOCK_FILTER_KILL_PROCESS
91 };
92
93 static const struct sock_fprog prog = {
94 .len = ARRAY_SIZE(filter),
95 .filter = (struct sock_filter *) filter,
96 };
97
98 int
main(void)99 main(void)
100 {
101 int fds[2];
102
103 puts("prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) = 0");
104
105 printf("prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=%u, filter=[",
106 prog.len);
107
108 printf("BPF_STMT(BPF_LD|BPF_W|BPF_ABS, %#x), ",
109 (unsigned) offsetof(struct seccomp_data, nr));
110
111 PRINT_ALLOW_SYSCALL(close);
112 PRINT_ALLOW_SYSCALL(exit);
113 PRINT_ALLOW_SYSCALL(exit_group);
114
115 PRINT_DENY_SYSCALL(sync, EBUSY),
116 PRINT_DENY_SYSCALL(setsid, EPERM),
117
118 printf("BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL)");
119
120 puts("]}) = 0");
121 puts("+++ exited with 0 +++");
122
123 fflush(stdout);
124 close(0);
125 close(1);
126
127 if (pipe(fds))
128 perror_msg_and_fail("pipe");
129 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
130 perror_msg_and_skip("PR_SET_NO_NEW_PRIVS");
131 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
132 perror_msg_and_skip("PR_SET_SECCOMP");
133 if (close(0) || close(1))
134 _exit(77);
135
136 _exit(0);
137 }
138
139 #else
140
141 SKIP_MAIN_UNDEFINED("HAVE_PRCTL && PR_SET_NO_NEW_PRIVS && PR_SET_SECCOMP"
142 " && SECCOMP_MODE_FILTER && SECCOMP_RET_ERRNO"
143 " && BPF_JUMP && BPF_STMT")
144
145 #endif
146