seccomp.h (1941B)
1 /* 2 * bdf2sfd 1.1.3 3 * Copyright (c) 2019-2020, Frederic Cambus 4 * https://github.com/fcambus/bdf2sfd 5 * 6 * Created: 2019-11-21 7 * Last Updated: 2020-06-25 8 * 9 * bdf2sfd is released under the BSD 2-Clause license 10 * See LICENSE file for details 11 */ 12 13 #ifndef SECCOMP_H 14 #define SECCOMP_H 15 16 #include <stddef.h> 17 #include <sys/prctl.h> 18 #include <sys/socket.h> 19 #include <sys/syscall.h> 20 #include <linux/audit.h> 21 #include <linux/filter.h> 22 #include <linux/seccomp.h> 23 24 #if defined(__i386__) 25 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_I386 26 #elif defined(__x86_64__) 27 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64 28 #elif defined(__aarch64__) 29 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_AARCH64 30 #else 31 #error "Seccomp is only supported on i386, amd64, and arm64 architectures." 32 #endif 33 34 #define BDF2SFD_SYSCALL_ALLOW(syscall) \ 35 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##syscall, 0, 1), \ 36 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) 37 38 static struct sock_filter filter[] = { 39 /* Validate architecture */ 40 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, arch)), 41 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0), 42 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL), 43 44 /* Load syscall */ 45 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)), 46 47 BDF2SFD_SYSCALL_ALLOW(brk), 48 BDF2SFD_SYSCALL_ALLOW(clock_gettime), /* i386 glibc */ 49 BDF2SFD_SYSCALL_ALLOW(close), 50 BDF2SFD_SYSCALL_ALLOW(exit_group), 51 BDF2SFD_SYSCALL_ALLOW(fstat), 52 #if defined(__NR_fstat64) 53 BDF2SFD_SYSCALL_ALLOW(fstat64), /* i386 glibc */ 54 #endif 55 BDF2SFD_SYSCALL_ALLOW(gettimeofday), /* i386 glibc */ 56 BDF2SFD_SYSCALL_ALLOW(ioctl), 57 #if defined(__NR_open) 58 BDF2SFD_SYSCALL_ALLOW(open), 59 #endif 60 BDF2SFD_SYSCALL_ALLOW(openat), 61 BDF2SFD_SYSCALL_ALLOW(read), 62 BDF2SFD_SYSCALL_ALLOW(write), 63 BDF2SFD_SYSCALL_ALLOW(writev), 64 65 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) 66 }; 67 68 struct sock_fprog bdf2sfd = { 69 .len = sizeof(filter)/sizeof(filter[0]), 70 .filter = filter 71 }; 72 73 #endif /* SECCOMP_H */