1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_SETS_H_ 6 #define SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_SETS_H_ 7 8 #include "base/basictypes.h" 9 #include "build/build_config.h" 10 #include "sandbox/sandbox_export.h" 11 12 // These are helpers to build seccomp-bpf policies, i.e. policies for a 13 // sandbox that reduces the Linux kernel's attack surface. Given their 14 // nature, they don't have any clear semantics and are completely 15 // "implementation-defined". 16 17 namespace sandbox { 18 19 class SANDBOX_EXPORT SyscallSets { 20 public: 21 static bool IsKill(int sysno); 22 static bool IsAllowedGettime(int sysno); 23 static bool IsCurrentDirectory(int sysno); 24 static bool IsUmask(int sysno); 25 // System calls that directly access the file system. They might acquire 26 // a new file descriptor or otherwise perform an operation directly 27 // via a path. 28 static bool IsFileSystem(int sysno); 29 static bool IsAllowedFileSystemAccessViaFd(int sysno); 30 static bool IsDeniedFileSystemAccessViaFd(int sysno); 31 static bool IsGetSimpleId(int sysno); 32 static bool IsProcessPrivilegeChange(int sysno); 33 static bool IsProcessGroupOrSession(int sysno); 34 static bool IsAllowedSignalHandling(int sysno); 35 static bool IsAllowedOperationOnFd(int sysno); 36 static bool IsKernelInternalApi(int sysno); 37 // This should be thought through in conjunction with IsFutex(). 38 static bool IsAllowedProcessStartOrDeath(int sysno); 39 // It's difficult to restrict those, but there is attack surface here. 40 static bool IsAllowedFutex(int sysno); 41 static bool IsAllowedEpoll(int sysno); 42 static bool IsAllowedGetOrModifySocket(int sysno); 43 static bool IsDeniedGetOrModifySocket(int sysno); 44 45 #if defined(__i386__) || defined(__mips__) 46 // Big multiplexing system call for sockets. 47 static bool IsSocketCall(int sysno); 48 #endif 49 50 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__) || \ 51 defined(__aarch64__) 52 static bool IsNetworkSocketInformation(int sysno); 53 #endif 54 55 static bool IsAllowedAddressSpaceAccess(int sysno); 56 static bool IsAllowedGeneralIo(int sysno); 57 static bool IsPrctl(int sysno); 58 static bool IsSeccomp(int sysno); 59 static bool IsAllowedBasicScheduler(int sysno); 60 static bool IsAdminOperation(int sysno); 61 static bool IsKernelModule(int sysno); 62 static bool IsGlobalFSViewChange(int sysno); 63 static bool IsFsControl(int sysno); 64 static bool IsNuma(int sysno); 65 static bool IsMessageQueue(int sysno); 66 static bool IsGlobalProcessEnvironment(int sysno); 67 static bool IsDebug(int sysno); 68 static bool IsGlobalSystemStatus(int sysno); 69 static bool IsEventFd(int sysno); 70 // Asynchronous I/O API. 71 static bool IsAsyncIo(int sysno); 72 static bool IsKeyManagement(int sysno); 73 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) 74 static bool IsSystemVSemaphores(int sysno); 75 #endif 76 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) 77 // These give a lot of ambient authority and bypass the setuid sandbox. 78 static bool IsSystemVSharedMemory(int sysno); 79 #endif 80 81 #if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) 82 static bool IsSystemVMessageQueue(int sysno); 83 #endif 84 85 #if defined(__i386__) || defined(__mips__) 86 // Big system V multiplexing system call. 87 static bool IsSystemVIpc(int sysno); 88 #endif 89 90 static bool IsAnySystemV(int sysno); 91 static bool IsAdvancedScheduler(int sysno); 92 static bool IsInotify(int sysno); 93 static bool IsFaNotify(int sysno); 94 static bool IsTimer(int sysno); 95 static bool IsAdvancedTimer(int sysno); 96 static bool IsExtendedAttributes(int sysno); 97 static bool IsMisc(int sysno); 98 #if defined(__arm__) 99 static bool IsArmPciConfig(int sysno); 100 static bool IsArmPrivate(int sysno); 101 #endif // defined(__arm__) 102 #if defined(__mips__) 103 static bool IsMipsPrivate(int sysno); 104 static bool IsMipsMisc(int sysno); 105 #endif // defined(__mips__) 106 private: 107 DISALLOW_IMPLICIT_CONSTRUCTORS(SyscallSets); 108 }; 109 110 } // namespace sandbox. 111 112 #endif // SANDBOX_LINUX_SECCOMP_BPF_HELPERS_SYSCALL_SETS_H_ 113
