logswan

Fast Web log analyzer using probabilistic data structures
Log | Files | Refs | README | LICENSE

seccomp.h (2425B)


      1 /*
      2  * Logswan 2.1.10
      3  * Copyright (c) 2015-2021, Frederic Cambus
      4  * https://www.logswan.org
      5  *
      6  * Created:      2015-05-31
      7  * Last Updated: 2020-09-17
      8  *
      9  * Logswan is released under the BSD 2-Clause license.
     10  * See LICENSE file for details.
     11  *
     12  * SPDX-License-Identifier: BSD-2-Clause
     13  */
     14 
     15 #ifndef SECCOMP_H
     16 #define SECCOMP_H
     17 
     18 #include <stddef.h>
     19 #include <sys/prctl.h>
     20 #include <sys/socket.h>
     21 #include <sys/syscall.h>
     22 #include <linux/audit.h>
     23 #include <linux/filter.h>
     24 #include <linux/seccomp.h>
     25 
     26 #if defined(__i386__)
     27 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_I386
     28 #elif defined(__x86_64__)
     29 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64
     30 #elif defined(__arm__)
     31 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARM
     32 #elif defined(__aarch64__)
     33 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_AARCH64
     34 #else
     35 #error "Seccomp is only supported on i386, x86_64, arm, and aarch64 architectures."
     36 #endif
     37 
     38 #define LOGSWAN_SYSCALL_ALLOW(syscall) \
     39 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##syscall, 0, 1), \
     40 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
     41 
     42 static struct sock_filter filter[] = {
     43 	/* Validate architecture */
     44 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, arch)),
     45 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
     46 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
     47 
     48 	/* Load syscall */
     49 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)),
     50 
     51 	LOGSWAN_SYSCALL_ALLOW(brk),
     52 	LOGSWAN_SYSCALL_ALLOW(clock_gettime),	/* i386 glibc */
     53 	LOGSWAN_SYSCALL_ALLOW(close),
     54 	LOGSWAN_SYSCALL_ALLOW(dup),
     55 	LOGSWAN_SYSCALL_ALLOW(exit_group),
     56 	LOGSWAN_SYSCALL_ALLOW(fcntl),
     57 #if defined(__NR_fcntl64)
     58 	LOGSWAN_SYSCALL_ALLOW(fcntl64),		/* i386 musl */
     59 #endif
     60 	LOGSWAN_SYSCALL_ALLOW(fstat),
     61 #if defined(__NR_fstat64)
     62 	LOGSWAN_SYSCALL_ALLOW(fstat64),		/* i386 glibc */
     63 #endif
     64 	LOGSWAN_SYSCALL_ALLOW(ioctl),
     65 	LOGSWAN_SYSCALL_ALLOW(lseek),
     66 #if defined(__NR__llseek)
     67 	LOGSWAN_SYSCALL_ALLOW(_llseek),		/* i386 glibc */
     68 #endif
     69 #if defined(__NR_open)
     70 	LOGSWAN_SYSCALL_ALLOW(open),
     71 #endif
     72 	LOGSWAN_SYSCALL_ALLOW(openat),
     73 #if defined(__NR_mmap)
     74 	LOGSWAN_SYSCALL_ALLOW(mmap),
     75 #endif
     76 #if defined(__NR_mmap2)
     77 	LOGSWAN_SYSCALL_ALLOW(mmap2),		/* i386 glibc */
     78 #endif
     79 	LOGSWAN_SYSCALL_ALLOW(munmap),
     80 	LOGSWAN_SYSCALL_ALLOW(read),
     81 	LOGSWAN_SYSCALL_ALLOW(write),
     82 	LOGSWAN_SYSCALL_ALLOW(writev),
     83 
     84 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
     85 };
     86 
     87 struct sock_fprog logswan = {
     88 	.len = sizeof(filter)/sizeof(filter[0]),
     89 	.filter = filter
     90 };
     91 
     92 #endif /* SECCOMP_H */