Home | History | Annotate | Download | only in tests
      1 /*
      2  * Check verbose decoding of prctl PR_SET_SECCOMP SECCOMP_MODE_FILTER.
      3  *
      4  * Copyright (c) 2015-2016 Dmitry V. Levin <ldv (at) altlinux.org>
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. The name of the author may not be used to endorse or promote products
     16  *    derived from this software without specific prior written permission.
     17  *
     18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     28  */
     29 
     30 #include "tests.h"
     31 #include <stddef.h>
     32 #include <unistd.h>
     33 #include <stdio.h>
     34 #include <errno.h>
     35 #include <asm/unistd.h>
     36 
     37 #ifdef HAVE_PRCTL
     38 # include <sys/prctl.h>
     39 #endif
     40 #ifdef HAVE_LINUX_SECCOMP_H
     41 # include <linux/seccomp.h>
     42 #endif
     43 #ifdef HAVE_LINUX_FILTER_H
     44 # include <linux/filter.h>
     45 #endif
     46 
     47 #if defined HAVE_PRCTL \
     48  && defined PR_SET_NO_NEW_PRIVS \
     49  && defined PR_SET_SECCOMP \
     50  && defined SECCOMP_MODE_FILTER \
     51  && defined SECCOMP_RET_ERRNO \
     52  && defined BPF_JUMP \
     53  && defined BPF_STMT
     54 
     55 #define SOCK_FILTER_ALLOW_SYSCALL(nr) \
     56 		BPF_JUMP(BPF_JMP|BPF_K|BPF_JEQ, __NR_ ## nr, 0, 1), \
     57 		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW)
     58 
     59 #define SOCK_FILTER_DENY_SYSCALL(nr, err) \
     60 		BPF_JUMP(BPF_JMP|BPF_K|BPF_JEQ, __NR_ ## nr, 0, 1), \
     61 		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO|(SECCOMP_RET_DATA & (err)))
     62 
     63 #define SOCK_FILTER_KILL_PROCESS \
     64 		BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL)
     65 
     66 #define PRINT_ALLOW_SYSCALL(nr) \
     67 	printf("BPF_JUMP(BPF_JMP|BPF_K|BPF_JEQ, %#x, 0, 0x1), " \
     68 	       "BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), ", \
     69 	       __NR_ ## nr)
     70 
     71 #define PRINT_DENY_SYSCALL(nr, err) \
     72 	printf("BPF_JUMP(BPF_JMP|BPF_K|BPF_JEQ, %#x, 0, 0x1), " \
     73 	       "BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO|%#x), ", \
     74 	       __NR_ ## nr, err)
     75 
     76 static const struct sock_filter filter[] = {
     77 	/* load syscall number */
     78 	BPF_STMT(BPF_LD|BPF_W|BPF_ABS, offsetof(struct seccomp_data, nr)),
     79 
     80 	/* allow syscalls */
     81 	SOCK_FILTER_ALLOW_SYSCALL(close),
     82 	SOCK_FILTER_ALLOW_SYSCALL(exit),
     83 	SOCK_FILTER_ALLOW_SYSCALL(exit_group),
     84 
     85 	/* deny syscalls */
     86 	SOCK_FILTER_DENY_SYSCALL(sync, EBUSY),
     87 	SOCK_FILTER_DENY_SYSCALL(setsid, EPERM),
     88 
     89 	/* kill process */
     90 	SOCK_FILTER_KILL_PROCESS
     91 };
     92 
     93 static const struct sock_fprog prog = {
     94 	.len = ARRAY_SIZE(filter),
     95 	.filter = (struct sock_filter *) filter,
     96 };
     97 
     98 int
     99 main(void)
    100 {
    101 	int fds[2];
    102 
    103 	puts("prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)  = 0");
    104 
    105 	printf("prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=%u, filter=[",
    106 	       prog.len);
    107 
    108 	printf("BPF_STMT(BPF_LD|BPF_W|BPF_ABS, %#x), ",
    109 	       (unsigned) offsetof(struct seccomp_data, nr));
    110 
    111 	PRINT_ALLOW_SYSCALL(close);
    112 	PRINT_ALLOW_SYSCALL(exit);
    113 	PRINT_ALLOW_SYSCALL(exit_group);
    114 
    115 	PRINT_DENY_SYSCALL(sync, EBUSY),
    116 	PRINT_DENY_SYSCALL(setsid, EPERM),
    117 
    118 	printf("BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL)");
    119 
    120 	puts("]}) = 0");
    121 	puts("+++ exited with 0 +++");
    122 
    123 	fflush(stdout);
    124 	close(0);
    125 	close(1);
    126 
    127 	if (pipe(fds))
    128 		perror_msg_and_fail("pipe");
    129 	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
    130 		perror_msg_and_skip("PR_SET_NO_NEW_PRIVS");
    131 	if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
    132 		perror_msg_and_skip("PR_SET_SECCOMP");
    133 	if (close(0) || close(1))
    134 		_exit(77);
    135 
    136 	_exit(0);
    137 }
    138 
    139 #else
    140 
    141 SKIP_MAIN_UNDEFINED("HAVE_PRCTL && PR_SET_NO_NEW_PRIVS && PR_SET_SECCOMP"
    142 		    " && SECCOMP_MODE_FILTER && SECCOMP_RET_ERRNO"
    143 		    " && BPF_JUMP && BPF_STMT")
    144 
    145 #endif
    146