ansilove

ANSI and ASCII art to PNG converter in C
Log | Files | Refs | README | LICENSE

seccomp.h (2337B)


      1 /*
      2  * seccomp.h
      3  * Ansilove 4.1.4
      4  * https://www.ansilove.org
      5  *
      6  * Copyright (c) 2019-2020, Frederic Cambus
      7  * All rights reserved.
      8  *
      9  * Ansilove is licensed under the BSD 2-Clause License.
     10  * See LICENSE file for details.
     11  */
     12 
     13 #ifndef SECCOMP_H
     14 #define SECCOMP_H
     15 
     16 #include <stddef.h>
     17 #include <sys/prctl.h>
     18 #include <sys/socket.h>
     19 #include <sys/syscall.h>
     20 #include <linux/audit.h>
     21 #include <linux/filter.h>
     22 #include <linux/seccomp.h>
     23 
     24 #if defined(__i386__)
     25 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_I386
     26 #elif defined(__x86_64__)
     27 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64
     28 #elif defined(__arm__)
     29 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARM
     30 #elif defined(__aarch64__)
     31 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_AARCH64
     32 #else
     33 #error "Seccomp is only supported on i386, x86_64, arm, and aarch64 architectures."
     34 #endif
     35 
     36 #define ANSILOVE_SYSCALL_ALLOW(syscall) \
     37 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##syscall, 0, 1), \
     38 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
     39 
     40 static struct sock_filter filter[] = {
     41 	/* Validate architecture */
     42 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, arch)),
     43 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
     44 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
     45 
     46 	/* Load syscall */
     47 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)),
     48 
     49 	ANSILOVE_SYSCALL_ALLOW(brk),
     50 	ANSILOVE_SYSCALL_ALLOW(clock_gettime),	/* i386 glibc */
     51 	ANSILOVE_SYSCALL_ALLOW(close),
     52 	ANSILOVE_SYSCALL_ALLOW(exit_group),
     53 	ANSILOVE_SYSCALL_ALLOW(fstat),
     54 #if defined(__NR_fstat64)
     55 	ANSILOVE_SYSCALL_ALLOW(fstat64),	/* i386 glibc */
     56 #endif
     57 	ANSILOVE_SYSCALL_ALLOW(ioctl),
     58 	ANSILOVE_SYSCALL_ALLOW(lseek),
     59 #if defined(__NR__llseek)
     60 	ANSILOVE_SYSCALL_ALLOW(_llseek),	/* i386 glibc */
     61 #endif
     62 #if defined(__NR_open)
     63 	ANSILOVE_SYSCALL_ALLOW(open),
     64 #endif
     65 	ANSILOVE_SYSCALL_ALLOW(openat),
     66 	ANSILOVE_SYSCALL_ALLOW(madvise),
     67 #if defined(__NR_mmap)
     68 	ANSILOVE_SYSCALL_ALLOW(mmap),
     69 #endif
     70 #if defined(__NR_mmap2)
     71 	ANSILOVE_SYSCALL_ALLOW(mmap2),		/* i386 glibc */
     72 #endif
     73 	ANSILOVE_SYSCALL_ALLOW(mremap),
     74 	ANSILOVE_SYSCALL_ALLOW(munmap),
     75 	ANSILOVE_SYSCALL_ALLOW(read),
     76 	ANSILOVE_SYSCALL_ALLOW(readv),
     77 	ANSILOVE_SYSCALL_ALLOW(write),
     78 	ANSILOVE_SYSCALL_ALLOW(writev),
     79 
     80 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
     81 };
     82 
     83 struct sock_fprog ansilove = {
     84 	.len = sizeof(filter)/sizeof(filter[0]),
     85 	.filter = filter
     86 };
     87 
     88 #endif /* SECCOMP_H */