logswan

commit 2f92e72b489b939a5b4a5e8ff2c30abda64892ac
parent 85a685d5e8b75bc5ea7b978fe7c2e53b6bad9709
Author: Frederic Cambus <fred@statdns.com>
Date:   Tue, 23 Jun 2020 19:39:54 +0200

Validate architectures for seccomp.

Seccomp support has only been tested on amd64 and aarch64 architectures.

Diffstat:
M
src/seccomp.h
 | 
14
++++++++++++++

1 file changed, 14 insertions(+), 0 deletions(-)
diff --git a/src/seccomp.h b/src/seccomp.h
@@ -25,7 +25,21 @@
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##syscall, 0, 1), \
 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 
+#if defined(__x86_64__)
+#define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64
+#elif defined(__aarch64__)
+#define SECCOMP_AUDIT_ARCH AUDIT_ARCH_AARCH64
+#else
+#error "Seccomp is only supported on amd64 and aarch64 architectures."
+#endif
+
 static struct sock_filter filter[] = {
+	/* Validate architecture */
+	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, arch)),
+	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
+	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
+
+	/* Load syscall */
 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)),
 
 	LOGSWAN_SYSCALL_ALLOW(brk),