seccomp.h (2425B)
1 /* 2 * Logswan 2.1.13 3 * Copyright (c) 2015-2022, Frederic Cambus 4 * https://www.logswan.org 5 * 6 * Created: 2015-05-31 7 * Last Updated: 2020-09-17 8 * 9 * Logswan is released under the BSD 2-Clause license. 10 * See LICENSE file for details. 11 * 12 * SPDX-License-Identifier: BSD-2-Clause 13 */ 14 15 #ifndef SECCOMP_H 16 #define SECCOMP_H 17 18 #include <stddef.h> 19 #include <sys/prctl.h> 20 #include <sys/socket.h> 21 #include <sys/syscall.h> 22 #include <linux/audit.h> 23 #include <linux/filter.h> 24 #include <linux/seccomp.h> 25 26 #if defined(__i386__) 27 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_I386 28 #elif defined(__x86_64__) 29 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64 30 #elif defined(__arm__) 31 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARM 32 #elif defined(__aarch64__) 33 #define SECCOMP_AUDIT_ARCH AUDIT_ARCH_AARCH64 34 #else 35 #error "Seccomp is only supported on i386, x86_64, arm, and aarch64 architectures." 36 #endif 37 38 #define LOGSWAN_SYSCALL_ALLOW(syscall) \ 39 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##syscall, 0, 1), \ 40 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) 41 42 static struct sock_filter filter[] = { 43 /* Validate architecture */ 44 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, arch)), 45 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0), 46 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL), 47 48 /* Load syscall */ 49 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)), 50 51 LOGSWAN_SYSCALL_ALLOW(brk), 52 LOGSWAN_SYSCALL_ALLOW(clock_gettime), /* i386 glibc */ 53 LOGSWAN_SYSCALL_ALLOW(close), 54 LOGSWAN_SYSCALL_ALLOW(dup), 55 LOGSWAN_SYSCALL_ALLOW(exit_group), 56 LOGSWAN_SYSCALL_ALLOW(fcntl), 57 #if defined(__NR_fcntl64) 58 LOGSWAN_SYSCALL_ALLOW(fcntl64), /* i386 musl */ 59 #endif 60 LOGSWAN_SYSCALL_ALLOW(fstat), 61 #if defined(__NR_fstat64) 62 LOGSWAN_SYSCALL_ALLOW(fstat64), /* i386 glibc */ 63 #endif 64 LOGSWAN_SYSCALL_ALLOW(ioctl), 65 LOGSWAN_SYSCALL_ALLOW(lseek), 66 #if defined(__NR__llseek) 67 LOGSWAN_SYSCALL_ALLOW(_llseek), /* i386 glibc */ 68 #endif 69 #if defined(__NR_open) 70 LOGSWAN_SYSCALL_ALLOW(open), 71 #endif 72 LOGSWAN_SYSCALL_ALLOW(openat), 73 #if defined(__NR_mmap) 74 LOGSWAN_SYSCALL_ALLOW(mmap), 75 #endif 76 #if defined(__NR_mmap2) 77 LOGSWAN_SYSCALL_ALLOW(mmap2), /* i386 glibc */ 78 #endif 79 LOGSWAN_SYSCALL_ALLOW(munmap), 80 LOGSWAN_SYSCALL_ALLOW(read), 81 LOGSWAN_SYSCALL_ALLOW(write), 82 LOGSWAN_SYSCALL_ALLOW(writev), 83 84 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) 85 }; 86 87 struct sock_fprog logswan = { 88 .len = sizeof(filter)/sizeof(filter[0]), 89 .filter = filter 90 }; 91 92 #endif /* SECCOMP_H */