libseccomp-0.1.0/0000755000000000000000000000000011764404661012337 5ustar rootrootlibseccomp-0.1.0/LICENSE0000644000000000000000000005755411740660643013362 0ustar rootroot GNU LESSER GENERAL PUBLIC LICENSE Version 2.1, February 1999 Copyright (C) 1991, 1999 Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. [This is the first released version of the Lesser GPL. It also counts as the successor of the GNU Library Public License, version 2, hence the version number 2.1.] Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This license, the Lesser General Public License, applies to some specially designated software packages--typically libraries--of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below. When we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things. To protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it. For example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights. We protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library. To protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others. Finally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license. Most GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs. When a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library. We call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances. For example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License. In other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system. Although the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library. The precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run. GNU LESSER GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you". A "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables. The "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".) "Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library. Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does. 1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) The modified work must itself be a software library. b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change. c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License. d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful. (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library. In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices. Once this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy. This option is useful when you wish to copy part of the code of the Library into a program that is not a library. 4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange. If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code. 5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License. However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables. When a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law. If such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.) Otherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself. 6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications. You must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things: a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.) b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with. c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution. d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place. e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy. For an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute. 7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things: a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above. b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work. 8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it. 10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License. 11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation. 14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. libseccomp-0.1.0/macros.mk0000644000000000000000000001134611763677723014173 0ustar rootroot# # Enhanced Seccomp Library Build Macros # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # SHELL = /bin/bash # # simple /bin/bash script to find the top of the tree # TOPDIR := $(shell \ ftd() { \ cd $$1; \ if [[ -r "macros.mk" ]]; then \ pwd; \ else \ ftd "../"; \ fi \ }; \ ftd .) # # build configuration # CPPFLAGS += -I$(TOPDIR) -I$(TOPDIR)/include LIBFLAGS = CFLAGS ?= -Wl,-z,relro -Wall -O0 -g CFLAGS += -fPIC LDFLAGS ?= -z relro -g # # build tools # LN ?= ln MV ?= mv CAT ?= cat ECHO ?= echo SED ?= sed AWK ?= awk # we require gcc specific functionality GCC ?= gcc INSTALL ?= install # # auto dependencies # MAKEDEP = @$(GCC) $(CPPFLAGS) -MM -MF $(patsubst %.o,%.d,$@) $<; MAKEDEP_EXEC = \ @$(GCC) $(CPPFLAGS) -MM -MT $(patsubst %.d,%,$@) \ -MF $@ $(patsubst %.d,%.c,$@); ADDDEP = \ @adddep_func() { \ $(MV) $$1 $$1.dtmp; \ $(CAT) $$1.dtmp | $(SED) -e 's/\([^\]\)$$/\1 \\/' | \ ( $(CAT) - && $(ECHO) " $$2" ) > $$1; \ $(RM) -f $@.dtmp; \ }; \ adddep_func # # build constants # VERSION_HDR = version.h # # build macros # ARCHIVE = @echo " AR $@ (add/update: $?)"; $(AR) -cru $@ $?; COMPILE = @echo " CC $@"; $(GCC) $(CFLAGS) $(CPPFLAGS) -o $@ -c $<; COMPILE_EXEC = @echo " CC $@"; $(GCC) $(CFLAGS) $(CPPFLAGS) -o $@ $< $(LDFLAGS); LINK_EXEC = @echo " LD $@"; $(GCC) $(LDFLAGS) -o $@ $^ $(LIBFLAGS); LINK_LIB = \ @link_lib_func() { \ name=$${1//.so.*/.so}.$(VERSION_MAJOR); \ echo " LD $@ ($$name)"; \ $(GCC) $(LDFLAGS) -o $@ $^ -shared -Wl,-soname=$$name; \ }; \ link_lib_func $@; # # install macros # INSTALL_MACRO = \ @install_func() { \ dir="$$1"; \ if [[ -n "$$3" ]]; then \ $(ECHO) " INSTALL $$3"; \ else \ $(ECHO) " INSTALL $$2 ($$dir/$$2)"; \ fi; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) \ -d "$$dir"; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) -m 0644 \ $$2 "$$dir"; \ }; \ install_func INSTALL_SBIN_MACRO = \ @install_sbin_func() { \ dir="$(INSTALL_SBIN_DIR)"; \ if [[ -n "$$2" ]]; then \ $(ECHO) " INSTALL $$2"; \ else \ $(ECHO) " INSTALL $^ ($$dir/$^)"; \ fi; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) \ -d "$$dir"; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) -m 0644 \ $^ "$$dir"; \ }; \ install_sbin_func INSTALL_BIN_MACRO = \ @install_bin_func() { \ dir="$(INSTALL_BIN_DIR)"; \ if [[ -n "$$2" ]]; then \ $(ECHO) " INSTALL $$2"; \ else \ $(ECHO) " INSTALL $^ ($$dir/$^)"; \ fi; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) \ -d "$$dir"; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) -m 0644 \ $^ "$$dir"; \ }; \ install_bin_func INSTALL_LIB_MACRO = \ @install_lib_func() { \ dir="$(INSTALL_LIB_DIR)"; \ if [[ -n "$$2" ]]; then \ $(ECHO) " INSTALL $$2"; \ else \ $(ECHO) " INSTALL $^ ($$dir/$^)"; \ fi; \ basename=$$(echo $^ | sed -e 's/.so.*$$/.so/'); \ soname=$$(objdump -p $^ | grep "SONAME" | awk '{print $$2}'); \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) \ -d "$$dir"; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) -m 0755 \ $^ "$$dir"; \ if [[ "$$soname" != "$^" ]]; then \ (cd "$$dir"; $(RM) -f $$soname); \ (cd "$$dir"; $(LN) -s $^ $$soname); \ fi; \ if [[ "$$basename" != "$^" ]]; then \ (cd "$$dir"; $(RM) -f $$basename); \ (cd "$$dir"; $(LN) -s $^ $$basename); \ fi; \ }; \ install_lib_func INSTALL_INC_MACRO = \ @install_inc_func() { \ dir="$(INSTALL_INC_DIR)"; \ if [[ -n "$$2" ]]; then \ $(ECHO) " INSTALL $$2"; \ else \ $(ECHO) " INSTALL $^ ($$dir/$^)"; \ fi; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) \ -d "$$dir"; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) -m 0644 \ $^ "$$dir"; \ }; \ install_inc_func INSTALL_MAN_MACRO = \ @install_man_func() { \ dir="$(INSTALL_MAN_DIR)"/"$$1"; \ if [[ -n "$$2" ]]; then \ $(ECHO) " INSTALL $$2"; \ else \ $(ECHO) " INSTALL $^ ($$dir/$^)"; \ fi; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) \ -d "$$dir"; \ $(INSTALL) -o $(INSTALL_OWNER) -g $(INSTALL_GROUP) -m 0644 \ $^ "$$dir"; \ }; \ install_man_func # # default build targets # %.o: %.c $(MAKEDEP) $(COMPILE) libseccomp-0.1.0/version_info0000644000000000000000000000020311764216001014742 0ustar rootroot# # version_info - version information for seccomp library # # version components VERSION_MAJOR=0 VERSION_MINOR=1 VERSION_MICRO=0 libseccomp-0.1.0/configure0000755000000000000000000001172011763725343014251 0ustar rootroot#!/bin/bash # # Enhanced Seccomp Library Configure Script # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # # configuration defaults opt_prefix="/usr/local" opt_libdir="" opt_sysinc_seccomp="yes" # output files cnf_mk_file="configure.mk" cnf_h_file="configure.h" #### # functions function verify_deps() { [[ -z "$1" ]] && return if ! which "$1" >& /dev/null; then echo "error: install \"$1\" and include it in your \$PATH" exit 1 fi } function msg_usage() { cat << EOF Configure the enhanced seccomp library, libseccomp, for this system. Usage: ./configure Options: * general configuration -h, --help display this help and exit * installation configuration --prefix=PREFIX installation base [/usr/local] --libdir=DIR library directory [/usr/local/lib] EOF } function msg_summary() { cat << EOF CONFIGURATION SUMMARY libseccomp version: ${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_MICRO} installation base: $opt_prefix library directory: $opt_libdir use system includes: $opt_sysinc_seccomp EOF } function msg_error() { echo "error: $@" } function cnf_mk_header() { echo "# generated by configure on $(date -R)" >> $cnf_mk_file echo "# options: \"$opt_str\"" >> $cnf_mk_file echo "" >> $cnf_mk_file } function cnf_mk_footer() { echo "" >> $cnf_mk_file } function cnf_mk_entry() { [[ $# -ne 2 ]] && return case "$2" in no) echo "$1 = 0" >> $cnf_mk_file ;; yes) echo "$1 = 1" >> $cnf_mk_file ;; *) echo "$1 = \"$2\"" >> $cnf_mk_file esac } function cnf_h_header() { echo "/* generated by configure on $(date -R) */" >> $cnf_h_file echo "/* options: \"$opt_str\" */" >> $cnf_h_file echo "" >> $cnf_h_file echo "#ifndef _CONFIGURE_H" >> $cnf_h_file echo "#define _CONFIGURE_H" >> $cnf_h_file echo "" >> $cnf_h_file } function cnf_h_footer() { echo "" >> $cnf_h_file echo "#endif" >> $cnf_h_file echo "" >> $cnf_h_file } function cnf_h_entry() { [[ $# -ne 2 ]] && return case "$2" in no) echo "#undef $1" >> $cnf_h_file ;; yes) echo "#define $1 1" >> $cnf_h_file ;; *) echo "#define $1 $2" >> $cnf_h_file esac } function cnf_reset() { cat /dev/null > $cnf_mk_file cat /dev/null > $cnf_h_file } function cnf_header() { cnf_mk_header cnf_h_header } function cnf_entry() { cnf_mk_entry "$1" "$2" cnf_h_entry "$1" "$2" } function cnf_footer() { cnf_mk_footer cnf_h_footer } function tmpl_filter() { name="echo \$$1" val="$(eval $name)" cat - | sed -e 's/%%'"$1"'%%/'"${val//\//\\/}"'/g;' } #### # main # # setup # # verify script dependencies verify_deps getopt # parse the command line options opt_str="$@" opt=$(getopt -n "$0" --options "h" --longoptions "help,prefix:,libdir:" -- "$@") eval set -- "$opt" while [[ $# -gt 0 ]]; do case "$1" in --prefix) opt_prefix="$2" shift 2 ;; --libdir) opt_libdir="$2" shift 2 ;; -h|--help) msg_usage exit 0 ;; --) shift ;; *) msg_usage exit 1 esac done # validate the options if [[ ! -d $opt_prefix ]]; then msg_error "install prefix ($opt_prefix) is not a directory" exit 1 fi if [[ -z $opt_libdir ]]; then opt_libdir="$opt_prefix/lib" fi if [[ ! -d $opt_libdir ]]; then msg_error "libdir ($opt_libdir) is not a directory" exit 1 fi # # automatic configuration # # system seccomp includes if [[ -r "/usr/include/linux/seccomp.h" ]]; then opt_sysinc_seccomp="yes" else opt_sysinc_seccomp="no" fi # generate the version files . ./version_info VERSION_RELEASE="${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_MICRO}" rm -f ./version_info.mk echo "# generated by configure on $(date -R)" >> ./version_info.mk echo "VERSION_MAJOR=$VERSION_MAJOR" >> ./version_info.mk echo "VERSION_MINOR=$VERSION_MINOR" >> ./version_info.mk echo "VERSION_MICRO=$VERSION_MICRO" >> ./version_info.mk echo "VERSION_RELEASE=$VERSION_RELEASE" >> ./version_info.mk # generate the pkg-config metadata INSTALL_PREFIX="$opt_prefix" INSTALL_LIBDIR="$opt_libdir" rm -f ./libseccomp.pc cat ./libseccomp.pc.in | \ tmpl_filter INSTALL_PREFIX | \ tmpl_filter INSTALL_LIBDIR | \ tmpl_filter VERSION_RELEASE \ >> ./libseccomp.pc # # finish # # reset the configuration files cnf_reset cnf_header # output the configuration files cnf_mk_entry "CONF_INSTALL_PREFIX" "$opt_prefix" cnf_mk_entry "CONF_INSTALL_LIBDIR" "$opt_libdir" cnf_entry "CONF_SYSINC_SECCOMP" "$opt_sysinc_seccomp" # configuration footer cnf_footer # display a summary and exit msg_summary exit 0 libseccomp-0.1.0/README0000644000000000000000000000315411757000371013212 0ustar rootrootlibseccomp: An Enhanced Seccomp (mode 2) Helper Library =============================================================================== http://libseccomp.sf.net The libseccomp library provides and easy to use, platform independent, interface to the Linux Kernel's syscall filtering mechanism: seccomp. The libseccomp API is designed to abstract away the underlying BPF based syscall filter language and present a more conventional function-call based filtering interface that should be familiar to, and easily adopted by application developers. * Documentation The "doc/" directory contains all of the documentation aside from the README file (this file) and the LICENSE file which can be found in the top level directory. * Building and Installing the Library In order to build the library you should follow the familiar three step process used by most applications: # ./configure # make # make install As usual, running "./configure -h" will display a list of build-time configuration options. * Testing the Library There are a number of tests located in the "tests/" directory and a script which can be used to help automate their execution, "regression". If you want to run all of the tests you can simply run the script: # ./configure # make # cd tests # ./regression However, the script takes a number of options to customize its execution; the options can be displayed by running "./regression -h". * Other Useful Tools The "tools/" directory includes a number of tools which may be helpful in the development of the library, or applications using the library, but for various reasons are not installed by default. libseccomp-0.1.0/Makefile0000644000000000000000000000525411763743612014006 0ustar rootroot# # Enhanced Seccomp Library Makefile # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # # # macros # include macros.mk # # configuration # -include version_info.mk -include configure.mk include install.mk # # targets # CONFIGS = configure.mk configure.h version_info.mk libseccomp.pc SUBDIRS_BUILD = src tests tools SUBDIRS_INSTALL = src include doc .PHONY: tarball install ctags cstags clean dist-clean $(SUBDIRS_BUILD) all: $(SUBDIRS_BUILD) $(CONFIGS): version_info @echo "INFO: automatically generating configuration ..." @./configure tarball: clean @ver=$(VERSION_RELEASE); \ tarball=libseccomp-$$ver.tar.gz; \ echo "INFO: creating the tarball ../$$tarball"; \ tmp_dir=$$(mktemp -d /tmp/libseccomp.XXXXX); \ rel_dir=$$tmp_dir/libseccomp-$$ver; \ mkdir $$rel_dir; \ tar cf - --exclude=*~ --exclude=.git* --exclude=.stgit* . | \ (cd $$rel_dir; tar xf -); \ (cd $$tmp_dir; tar zcf $$tarball libseccomp-$$ver); \ mv $$tmp_dir/$$tarball ..; \ rm -rf $$tmp_dir; $(VERSION_HDR): version_info.mk @echo "INFO: creating the version header file" @hdr="$(VERSION_HDR)"; \ echo "/* automatically generated - do not edit */" > $$hdr; \ echo "#ifndef _VERSION_H" >> $$hdr; \ echo "#define _VERSION_H" >> $$hdr; \ echo "#define VERSION_RELEASE \"$(VERSION_RELEASE)\"" >> $$hdr; \ echo "#endif" >> $$hdr; $(SUBDIRS_BUILD): $(VERSION_HDR) $(CONFIGS) @echo "INFO: building in directory $@/ ..." @$(MAKE) -s -C $@ install: $(SUBDIRS_BUILD) @echo "INFO: installing in $(INSTALL_PREFIX) ..." @$(INSTALL_MACRO) $(INSTALL_LIB_DIR)/pkgconfig libseccomp.pc @for dir in $(SUBDIRS_INSTALL); do \ echo "INFO: installing from $$dir/"; \ $(MAKE) -s -C $$dir install; \ done ctags: @echo "INFO: generating ctags for the project ..." @ctags -R * cstags: @echo "INFO: generating cscope tags for the project ..." @find -iname *.[ch] > cscope.files @cscope -b -q -k clean: @for dir in $(SUBDIRS_BUILD); do \ echo "INFO: cleaning in $$dir/"; \ $(MAKE) -s -C $$dir clean; \ done dist-clean: clean @echo "INFO: removing the configuration files" @rm -f $(CONFIGS) libseccomp-0.1.0/tools/0000755000000000000000000000000011764404630013473 5ustar rootrootlibseccomp-0.1.0/tools/sys_inspector0000755000000000000000000000453711741105377016337 0ustar rootroot#!/bin/bash # # Runtime syscall inspector # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # #### # functions function verify_deps() { [[ -z "$1" ]] && return if ! which "$1" >& /dev/null; then echo "error: install \"$1\" and include it in your \$PATH" exit 1 fi } #### # main # verify script dependencies verify_deps strace verify_deps sed verify_deps sort verify_deps uniq # get the command line arguments opt_freq=0 opt_args=0 opt_out="/proc/self/fd/1" while getopts "afo:h" opt; do case $opt in a) opt_args=1 ;; f) opt_freq=1 ;; o) opt_out="$OPTARG" ;; h|*) echo "usage $0 [-f] [-a] [-o ] []" exit 1 esac done shift $(expr $OPTIND - 1) # generate a temporary output file raw=$(mktemp -t strace-raw_XXXXXX) out="$raw-out" # capture the strace output strace -o $raw -- $* # filter the raw strace if [[ $opt_args -eq 0 ]]; then if [[ $opt_freq -eq 0 ]]; then cat $raw | sed -e 's/(.*//' | sort -u > $out else cat $raw | sed -e 's/(.*//' | sort | uniq -c | sort -nr > $out fi else if [[ $opt_freq -eq 0 ]]; then cat $raw | sed -e 's/)[ \t]*=.*$/)/' \ | sed -e 's/".*,/"...",/g;s/\/\*.*\*\//.../g' \ | sed -e 's/0x[a-f0-9]\+/.../g' \ | sort -u > $out else cat $raw | sed -e 's/)[ \t]*=.*$/)/' \ | sed -e 's/".*,/"...",/g;s/\/\*.*\*\//.../g' \ | sed -e 's/0x[a-f0-9]\+/.../g' \ | sort | uniq -c | sort -nr > $out fi fi # display the output echo "============================================================" > $opt_out echo "Syscall Report (\"$*\")" >> $opt_out [[ $opt_freq -eq 1 ]] && echo " freq syscall" >> $opt_out echo "============================================================" >> $opt_out cat $out >> $opt_out # cleanup and exit rm -f $raw $out exit 0 libseccomp-0.1.0/tools/Makefile0000644000000000000000000000200311763744117015134 0ustar rootroot# # Enhanced Seccomp Library Makefile # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # # # macros # include ../macros.mk # # configuration # include $(TOPDIR)/configure.mk TOOLS = bpf_disasm \ bpf_sim DEPS = $(TOOLS:%=%.d) # # targets # .PHONY: clean all: $(TOOLS) -include $(DEPS) $(DEPS): $(MAKEDEP_EXEC) $(TOOLS): $(COMPILE_EXEC) clean: $(RM) -f $(DEPS) $(TOOLS) libseccomp-0.1.0/tools/bpf.h0000644000000000000000000000605011741315243014410 0ustar rootroot/** * BPF Language Definitions * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _BPF_H #define _BPF_H #include #include /* most of these structures and values are designed to match the Linux Kernel's * BPF interface (see /usr/include/linux/{filter,seccomp}.h), but we define our * own here so that we can function independent of the host OS */ /* XXX - need to verify these values */ #define BPF_SCRATCH_SIZE 6 /** * Syscall record data format used by seccomp */ #define BPF_SYS_ARG_MAX 6 struct seccomp_data { int32_t nr; uint32_t arch; uint64_t instruction_pointer; uint64_t args[BPF_SYS_ARG_MAX]; }; #define BPF_SYSCALL_MAX (sizeof(struct seccomp_data)) /** * BPF instruction format */ struct sock_filter { uint16_t code; uint8_t jt; uint8_t jf; uint32_t k; } __attribute__ ((packed)); typedef struct sock_filter bpf_instr_raw; /* seccomp return masks */ #define SECCOMP_RET_ACTION 0x7fff0000U #define SECCOMP_RET_DATA 0x0000ffffU /* seccomp action values */ #define SECCOMP_RET_KILL 0x00000000U #define SECCOMP_RET_TRAP 0x00030000U #define SECCOMP_RET_ERRNO 0x00050000U #define SECCOMP_RET_TRACE 0x7ff00000U #define SECCOMP_RET_ALLOW 0x7fff0000U /* bpf command classes */ #define BPF_CLASS(code) ((code) & 0x07) #define BPF_LD 0x00 #define BPF_LDX 0x01 #define BPF_ST 0x02 #define BPF_STX 0x03 #define BPF_ALU 0x04 #define BPF_JMP 0x05 #define BPF_RET 0x06 #define BPF_MISC 0x07 /* BPF_LD and BPF_LDX */ #define BPF_SIZE(code) ((code) & 0x18) #define BPF_W 0x00 #define BPF_H 0x08 #define BPF_B 0x10 #define BPF_MODE(code) ((code) & 0xe0) #define BPF_IMM 0x00 #define BPF_ABS 0x20 #define BPF_IND 0x40 #define BPF_MEM 0x60 #define BPF_LEN 0x80 #define BPF_MSH 0xa0 #define BPF_OP(code) ((code) & 0xf0) /* BPF_ALU */ #define BPF_ADD 0x00 #define BPF_SUB 0x10 #define BPF_MUL 0x20 #define BPF_DIV 0x30 #define BPF_OR 0x40 #define BPF_AND 0x50 #define BPF_LSH 0x60 #define BPF_RSH 0x70 #define BPF_NEG 0x80 /* BPF_JMP */ #define BPF_JA 0x00 #define BPF_JEQ 0x10 #define BPF_JGT 0x20 #define BPF_JGE 0x30 #define BPF_JSET 0x40 #define BPF_SRC(code) ((code) & 0x08) #define BPF_K 0x00 #define BPF_X 0x08 /* BPF_RET (BPF_K and BPF_X also apply) */ #define BPF_RVAL(code) ((code) & 0x18) #define BPF_A 0x10 /* BPF_MISC */ #define BPF_MISCOP(code) ((code) & 0xf8) #define BPF_TAX 0x00 #define BPF_TXA 0x80 #endif libseccomp-0.1.0/tools/bpf_sim.c0000644000000000000000000001607511741315243015263 0ustar rootroot/** * BPF Simulator * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include #include #include #include #include #include #include #include "bpf.h" #define BPF_PRG_MAX_LEN 4096 /** * BPF simulator machine state */ struct sim_state { uint32_t acc; uint32_t temp[BPF_SCRATCH_SIZE]; }; struct bpf_program { size_t i_cnt; bpf_instr_raw *i; }; static unsigned int opt_verbose = 0; /** * Print the usage information to stderr and exit * @param program the name of the current program being invoked * * Print the usage information and exit with EINVAL. * */ static void exit_usage(const char *program) { fprintf(stderr, "usage: %s -f [-v]" " -a -s [-0 ] ... [-5 ]\n", program); exit(EINVAL); } /** * Handle a simulator fault * @param rc the error or return code * * Print a "FAULT" to stderr to indicate a simulator fault, and an errno value * if the simulator is running in verbose mode, then exit with EFAULT. * */ static void exit_fault(unsigned int rc) { if (opt_verbose) fprintf(stderr, "FAULT: errno = %d\n", rc); else fprintf(stderr, "FAULT\n"); exit(EFAULT); } /** * Handle a BPF program error * @param rc the error or return code * @param line the line number * * Print an "ERROR" to stderr to indicate a program error, and an errno value * if the simulator is running in verbose mode, then exit with ENOEXEC. * */ static void exit_error(unsigned int rc, unsigned int line) { if (opt_verbose) fprintf(stderr, "ERROR: errno = %d, line = %d\n", rc, line); else fprintf(stderr, "ERROR\n"); exit(ENOEXEC); } /** * Handle a simulator return/action * @param action the return value * @param line the line number * * Display the action to stdout and exit with 0. * */ static void end_action(uint32_t action, unsigned int line) { uint32_t act = action & SECCOMP_RET_ACTION; uint32_t data = action & SECCOMP_RET_DATA; switch (act) { case SECCOMP_RET_KILL: fprintf(stdout, "KILL\n"); break; case SECCOMP_RET_TRAP: fprintf(stdout, "TRAP\n"); break; case SECCOMP_RET_ERRNO: fprintf(stdout, "ERRNO(%u)\n", data); break; case SECCOMP_RET_TRACE: fprintf(stdout, "TRACE(%u)\n", data); break; case SECCOMP_RET_ALLOW: fprintf(stdout, "ALLOW\n"); break; default: exit_error(EDOM, line); } exit(0); } /** * Execute a BPF program * @param prg the loaded BPF program * @param sys_data the syscall record being tested * * Simulate the BPF program with the given syscall record. * */ static void bpf_execute(const struct bpf_program *prg, const struct seccomp_data *sys_data) { unsigned int ip, ip_c; struct sim_state state; bpf_instr_raw *bpf; unsigned char *sys_data_b = (unsigned char *)sys_data; /* initialize the machine state */ ip_c = 0; ip = 0; memset(&state, 0, sizeof(state)); while (ip < prg->i_cnt) { /* get the instruction and bump the ip */ ip_c = ip; bpf = &prg->i[ip++]; switch (bpf->code) { case BPF_LD+BPF_W+BPF_ABS: if (bpf->k < BPF_SYSCALL_MAX) state.acc = *((uint32_t *)&sys_data_b[bpf->k]); else exit_error(ERANGE, ip_c); break; case BPF_ALU+BPF_OR+BPF_K: state.acc |= bpf->k; break; case BPF_ALU+BPF_AND+BPF_K: state.acc &= bpf->k; break; case BPF_JMP+BPF_JA: ip += bpf->k; break; case BPF_JMP+BPF_JEQ+BPF_K: if (state.acc == bpf->k) ip += bpf->jt; else ip += bpf->jf; break; case BPF_JMP+BPF_JGT+BPF_K: if (state.acc > bpf->k) ip += bpf->jt; else ip += bpf->jf; break; case BPF_JMP+BPF_JGE+BPF_K: if (state.acc >= bpf->k) ip += bpf->jt; else ip += bpf->jf; break; case BPF_RET+BPF_K: end_action(bpf->k, ip_c); break; default: /* since we don't support the full bpf language just * yet, this could be either a fault or an error, we'll * treat it as a fault until we provide full support */ exit_fault(EOPNOTSUPP); } } /* if we've reached here there is a problem with the program */ exit_error(ERANGE, ip_c); } /** * main */ int main(int argc, char *argv[]) { int opt; char *opt_file = NULL; FILE *file; size_t file_read_len; struct seccomp_data sys_data; struct bpf_program bpf_prg; /* clear the syscall record */ memset(&sys_data, 0, sizeof(sys_data)); /* parse the command line */ while ((opt = getopt(argc, argv, "a:f:h:s:v0:1:2:3:4:5:")) > 0) { switch (opt) { case 'a': if (strcmp(optarg, "x86") == 0) sys_data.arch = AUDIT_ARCH_I386; else if (strcmp(optarg, "x86_64") == 0) sys_data.arch = AUDIT_ARCH_X86_64; else if (strcmp(optarg, "ia64") == 0) sys_data.arch = AUDIT_ARCH_IA64; else if (strcmp(optarg, "ppc") == 0) sys_data.arch = AUDIT_ARCH_PPC; else if (strcmp(optarg, "ppc64") == 0) sys_data.arch = AUDIT_ARCH_PPC64; else if (strcmp(optarg, "s390") == 0) sys_data.arch = AUDIT_ARCH_S390; else if (strcmp(optarg, "s390x") == 0) sys_data.arch = AUDIT_ARCH_S390X; else exit_fault(EINVAL); break; case 'f': opt_file = strdup(optarg); if (opt_file == NULL) exit_fault(ENOMEM); break; case 's': sys_data.nr = strtol(optarg, NULL, 0); break; case 'v': opt_verbose = 1; break; case '0': sys_data.args[0] = strtoull(optarg, NULL, 0); break; case '1': sys_data.args[1] = strtoull(optarg, NULL, 0); break; case '2': sys_data.args[2] = strtoull(optarg, NULL, 0); break; case '3': sys_data.args[3] = strtoull(optarg, NULL, 0); break; case '4': sys_data.args[4] = strtoull(optarg, NULL, 0); break; case '5': sys_data.args[5] = strtoull(optarg, NULL, 0); break; case 'h': default: /* usage information */ exit_usage(argv[0]); } } /* allocate space for the bpf program */ /* XXX - we should make this dynamic */ bpf_prg.i_cnt = 0; bpf_prg.i = calloc(BPF_PRG_MAX_LEN, sizeof(*bpf_prg.i)); if (bpf_prg.i == NULL) exit_fault(ENOMEM); /* load the bpf program */ file = fopen(opt_file, "r"); if (file == NULL) exit_fault(errno); do { file_read_len = fread(&(bpf_prg.i[bpf_prg.i_cnt]), sizeof(*bpf_prg.i), 1, file); if (file_read_len == 1) bpf_prg.i_cnt++; /* check the size */ if (bpf_prg.i_cnt == BPF_PRG_MAX_LEN) exit_fault(E2BIG); } while (file_read_len > 0); fclose(file); /* execute the bpf program */ bpf_execute(&bpf_prg, &sys_data); /* we should never reach here */ exit_fault(EFAULT); return 0; } libseccomp-0.1.0/tools/sys_resolver0000755000000000000000000000331611741105413016153 0ustar rootroot#!/bin/bash # # Syscall resolver # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # syscall_h="/usr/include/asm/unistd.h" #### # functions function verify_deps() { [[ -z "$1" ]] && return if ! which "$1" >& /dev/null; then echo "error: install \"$1\" and include it in your \$PATH" exit 1 fi } #### # main # verify script dependencies verify_deps gcc verify_deps grep verify_deps awk verify_deps sed # verify the command line if [[ "$#" -ne 1 || -z "$1" ]]; then echo "usage: $0 " exit 1 fi # inspect the syscall header file and do the resolution sys_def="$(gcc $CFLAGS -E -dM "$syscall_h" | grep " __NR_$1 ")" if [[ -n "$sys_def" ]]; then if [[ $sys_def =~ .*__NR_[a-zA-Z_]+" "*\+" "*[0-9]+ ]]; then # the value is calculated using an offset from another syscall base="$(echo $sys_def | sed -e 's/\(.*\)__NR_\([a-zA-Z_]\+\)\(.*\)/\2/;')" offset="$(echo $sys_def | sed -e 's/\(.*+ *\)\([0-9]*\)\(.*\)/\2/;')" echo $(($($0 $base) + $offset)) else echo "$sys_def" | awk '{ print $3 }' fi else echo "error: unknown syscall \"$1\"" exit 1 fi exit 0 libseccomp-0.1.0/tools/bpf_disasm.c0000644000000000000000000001605711741105535015754 0ustar rootroot/** * BPF Disassembler * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include #include #include #include #include #include #include #include "bpf.h" #define _OP_FMT "%-3s" /** * Decode the BPF operand * @param bpf the BPF instruction * * Decode the BPF operand and print it to stdout. * */ static void bpf_decode_op(const bpf_instr_raw *bpf) { switch (bpf->code) { case BPF_LD+BPF_W+BPF_IMM: case BPF_LD+BPF_W+BPF_ABS: case BPF_LD+BPF_W+BPF_IND: case BPF_LD+BPF_W+BPF_MEM: case BPF_LD+BPF_W+BPF_LEN: case BPF_LD+BPF_W+BPF_MSH: printf(_OP_FMT, "ld"); break; case BPF_LD+BPF_H+BPF_IMM: case BPF_LD+BPF_H+BPF_ABS: case BPF_LD+BPF_H+BPF_IND: case BPF_LD+BPF_H+BPF_MEM: case BPF_LD+BPF_H+BPF_LEN: case BPF_LD+BPF_H+BPF_MSH: printf(_OP_FMT, "ldh"); break; case BPF_LD+BPF_B+BPF_IMM: case BPF_LD+BPF_B+BPF_ABS: case BPF_LD+BPF_B+BPF_IND: case BPF_LD+BPF_B+BPF_MEM: case BPF_LD+BPF_B+BPF_LEN: case BPF_LD+BPF_B+BPF_MSH: printf(_OP_FMT, "ldb"); break; case BPF_LDX+BPF_W+BPF_IMM: case BPF_LDX+BPF_W+BPF_ABS: case BPF_LDX+BPF_W+BPF_IND: case BPF_LDX+BPF_W+BPF_MEM: case BPF_LDX+BPF_W+BPF_LEN: case BPF_LDX+BPF_W+BPF_MSH: case BPF_LDX+BPF_H+BPF_IMM: case BPF_LDX+BPF_H+BPF_ABS: case BPF_LDX+BPF_H+BPF_IND: case BPF_LDX+BPF_H+BPF_MEM: case BPF_LDX+BPF_H+BPF_LEN: case BPF_LDX+BPF_H+BPF_MSH: case BPF_LDX+BPF_B+BPF_IMM: case BPF_LDX+BPF_B+BPF_ABS: case BPF_LDX+BPF_B+BPF_IND: case BPF_LDX+BPF_B+BPF_MEM: case BPF_LDX+BPF_B+BPF_LEN: case BPF_LDX+BPF_B+BPF_MSH: printf(_OP_FMT, "ldx"); break; case BPF_ST: printf(_OP_FMT, "st"); break; case BPF_STX: printf(_OP_FMT, "stx"); break; case BPF_ALU+BPF_ADD+BPF_K: case BPF_ALU+BPF_ADD+BPF_X: printf(_OP_FMT, "add"); break; case BPF_ALU+BPF_SUB+BPF_K: case BPF_ALU+BPF_SUB+BPF_X: printf(_OP_FMT, "sub"); break; case BPF_ALU+BPF_MUL+BPF_K: case BPF_ALU+BPF_MUL+BPF_X: printf(_OP_FMT, "mul"); break; case BPF_ALU+BPF_DIV+BPF_K: case BPF_ALU+BPF_DIV+BPF_X: printf(_OP_FMT, "div"); break; case BPF_ALU+BPF_OR+BPF_K: case BPF_ALU+BPF_OR+BPF_X: printf(_OP_FMT, "or"); break; case BPF_ALU+BPF_AND+BPF_K: case BPF_ALU+BPF_AND+BPF_X: printf(_OP_FMT, "and"); break; case BPF_ALU+BPF_LSH+BPF_K: case BPF_ALU+BPF_LSH+BPF_X: printf(_OP_FMT, "lsh"); break; case BPF_ALU+BPF_RSH+BPF_K: case BPF_ALU+BPF_RSH+BPF_X: printf(_OP_FMT, "rsh"); break; case BPF_ALU+BPF_NEG+BPF_K: case BPF_ALU+BPF_NEG+BPF_X: printf(_OP_FMT, "neg"); break; case BPF_JMP+BPF_JA+BPF_K: case BPF_JMP+BPF_JA+BPF_X: printf(_OP_FMT, "jmp"); break; case BPF_JMP+BPF_JEQ+BPF_K: case BPF_JMP+BPF_JEQ+BPF_X: printf(_OP_FMT, "jeq"); break; case BPF_JMP+BPF_JGT+BPF_K: case BPF_JMP+BPF_JGT+BPF_X: printf(_OP_FMT, "jgt"); break; case BPF_JMP+BPF_JGE+BPF_K: case BPF_JMP+BPF_JGE+BPF_X: printf(_OP_FMT, "jge"); break; case BPF_JMP+BPF_JSET+BPF_K: case BPF_JMP+BPF_JSET+BPF_X: printf(_OP_FMT, "jset"); break; case BPF_RET+BPF_K: case BPF_RET+BPF_X: case BPF_RET+BPF_A: printf(_OP_FMT, "ret"); break; case BPF_MISC+BPF_TAX: printf(_OP_FMT, "tax"); break; case BPF_MISC+BPF_TXA: printf(_OP_FMT, "txa"); break; default: printf(_OP_FMT, "???"); } } /** * Decode the BPF arguments (JT, JF, and K) * @param bpf the BPF instruction * @param line the current line number * * Decode the BPF arguments (JT, JF, and K) and print the relevant information * to stdout based on the operand. * */ static void bpf_decode_args(const bpf_instr_raw *bpf, unsigned int line) { switch (BPF_CLASS(bpf->code)) { case BPF_LD: case BPF_LDX: switch (BPF_MODE(bpf->code)) { case BPF_ABS: printf("$data[%u]", bpf->k); break; case BPF_MEM: printf("$temp[%u]", bpf->k); break; } break; case BPF_ST: case BPF_STX: printf("$temp[%u]", bpf->k); break; case BPF_ALU: if (BPF_SRC(bpf->code) == BPF_K) { switch (BPF_OP(bpf->code)) { case BPF_OR: case BPF_AND: printf("0x%.8x", bpf->k); break; default: printf("%u", bpf->k); } } else printf("%u", bpf->k); break; case BPF_JMP: if (BPF_OP(bpf->code) == BPF_JA) { printf("%.4u", (line + 1) + bpf->k); } else { printf("%-4u true:%.4u false:%.4u", bpf->k, (line + 1) + bpf->jt, (line + 1) + bpf->jf); } break; case BPF_RET: if (BPF_RVAL(bpf->code) == BPF_A) { /* XXX - accumulator? */ printf("$acc"); } else if (BPF_SRC(bpf->code) == BPF_K) { uint32_t act = bpf->k & SECCOMP_RET_ACTION; uint32_t data = bpf->k & SECCOMP_RET_DATA; switch (act) { case SECCOMP_RET_KILL: printf("KILL"); break; case SECCOMP_RET_TRAP: printf("TRAP"); break; case SECCOMP_RET_ERRNO: printf("ERRNO(%u)", data); break; case SECCOMP_RET_TRACE: printf("TRACE(%u)", data); break; case SECCOMP_RET_ALLOW: printf("ALLOW"); break; default: printf("0x%.8x", bpf->k); } } else if (BPF_SRC(bpf->code) == BPF_X) { /* XXX - any idea? */ printf("???"); } break; case BPF_MISC: break; default: printf("???"); } } /** * Perform a simple decoding of the BPF program * @param file the BPF program * * Read the BPF program and display the instructions. Returns zero on success, * negative values on failure. * */ static int bpf_decode(FILE *file) { unsigned int line = 0; size_t len; bpf_instr_raw bpf; /* header */ printf(" line OP JT JF K\n"); printf("=================================\n"); while ((len = fread(&bpf, sizeof(bpf), 1, file))) { printf(" %.4u: 0x%.2x 0x%.2x 0x%.2x 0x%.8x", line, bpf.code, bpf.jt, bpf.jf, bpf.k); printf(" "); bpf_decode_op(&bpf); printf(" "); bpf_decode_args(&bpf, line); printf("\n"); line++; } if (ferror(file)) return errno; return 0; } /** * main */ int main(int argc, char *argv[]) { int rc; FILE *file; if (argc > 2) { fprintf(stderr, "usage: %s []\n", argv[0]); return EINVAL; } if (argc == 2) { file = fopen(argv[1], "r"); if (file == NULL) { fprintf(stderr, "error: unable to open \"%s\" (%s)\n", argv[1], strerror(errno)); return errno; } } else file = stdin; rc = bpf_decode(file); fclose(file); return rc; } libseccomp-0.1.0/tests/0000755000000000000000000000000011764404630013475 5ustar rootrootlibseccomp-0.1.0/tests/08-subtree-checks.tests0000644000000000000000000000300311744067662017721 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 08-subtree-checks all 1000 0-10 1 N N N N ALLOW 08-subtree-checks all 1000 0-10 0 N N N N KILL 08-subtree-checks all 1001 0-10 1 N N N N ALLOW 08-subtree-checks all 1001 0-10 0 N N N N KILL 08-subtree-checks all 1002 0-5 1 2 0-5 N N ALLOW 08-subtree-checks all 1002 0-5 2 1 0-5 N N KILL 08-subtree-checks all 1003 0-5 1 2 0-5 N N ALLOW 08-subtree-checks all 1003 0-5 2 1 0-5 N N KILL 08-subtree-checks all 1004 0 11 5-10 10 10 1-5 ALLOW 08-subtree-checks all 1004 0 1 2 0-5 N N KILL 08-subtree-checks all 1004 1-5 1 2 0-5 N N ALLOW 08-subtree-checks all 1004 1-5 1 2 30-35 N N ALLOW 08-subtree-checks all 1004 1-5 2 1 30-35 N N KILL 08-subtree-checks all 1005 0 11 5-10 10 10 1-5 ALLOW 08-subtree-checks all 1005 0 1 2 0-5 N N KILL 08-subtree-checks all 1005 1-5 1 2 0-5 N N ALLOW 08-subtree-checks all 1005 1-5 1 2 30-35 N N ALLOW 08-subtree-checks all 1005 1-5 2 1 30-35 N N KILL 08-subtree-checks all 1006 0-10 1 2 N N N ALLOW 08-subtree-checks all 1006 0-10 1 3 N N N KILL 08-subtree-checks all 1006 10 2-100 2 N N N ALLOW 08-subtree-checks all 1007 0 0 1 3 N N TRAP 08-subtree-checks all 1007 1 1 1 0-2 1 1 KILL 08-subtree-checks all 1007 1 1 2 0-2 1 1 ALLOW 08-subtree-checks all 1007 1 1 2 4-6 1 1 ALLOW 08-subtree-checks all 1007 1 1 0 3 1 1 KILL test type: bpf-sim-fuzz # Testname StressCount 08-subtree-checks 150 libseccomp-0.1.0/tests/13-attrs.tests0000644000000000000000000000025411745604753016147 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: basic # Test command 13-attrs libseccomp-0.1.0/tests/10-syscall-priority-post.c0000644000000000000000000000327711742125426020403 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; /* the syscall and argument numbers are all fake to make the test * simpler */ rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 2, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1001, 1, SCMP_A0(SCMP_CMP_EQ, 0)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1002, 0); if (rc != 0) goto out; rc = seccomp_syscall_priority(1000, 3); if (rc != 0) goto out; rc = seccomp_syscall_priority(1001, 2); if (rc != 0) goto out; rc = seccomp_syscall_priority(1002, 1); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/06-actions.tests0000644000000000000000000000111611744067662016453 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 06-actions all read 4 0x856B008 80 N N N ALLOW 06-actions all write 1 0x856B008 N N N N ERRNO(1) 06-actions all close 4 N N N N N TRAP 06-actions all open 0x856B008 4 N N N N TRACE(1234) 06-actions x86 0-2 N N N N N N KILL 06-actions x86 7-350 N N N N N N KILL 06-actions x86_64 4-350 N N N N N N KILL test type: bpf-sim-fuzz # Testname StressCount 06-actions 150 libseccomp-0.1.0/tests/01-allow.c0000644000000000000000000000214111742125114015164 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_ALLOW); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/09-syscall-priority-pre.tests0000644000000000000000000000114211744067662021132 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 09-syscall-priority-pre all 999 N N N N N N KILL 09-syscall-priority-pre all 1000-1002 0 1 N N N N ALLOW 09-syscall-priority-pre all 1000 0 2 N N N N KILL 09-syscall-priority-pre all 1001-1002 0 2 N N N N ALLOW 09-syscall-priority-pre all 1000-1001 1 1 N N N N KILL 09-syscall-priority-pre all 1003 N N N N N N KILL test type: bpf-sim-fuzz # Testname StressCount 09-syscall-priority-pre 150 libseccomp-0.1.0/tests/04-multilevel-chains.tests0000644000000000000000000000331011744067662020434 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 04-multilevel-chains all open 0x856B008 4 N N N N ALLOW 04-multilevel-chains all close 4 N N N N N ALLOW 04-multilevel-chains x86 read 0 0x856B008 0x7FFFFFFE N N N ALLOW 04-multilevel-chains x86_64 read 0 0x856B008 0x7FFFFFFFFFFFFFFE N N N ALLOW 04-multilevel-chains x86 read 0 0x856B008 0x7FFFFFFF N N N KILL 04-multilevel-chains x86_64 read 0 0x856B008 0x7FFFFFFFFFFFFFFF N N N KILL 04-multilevel-chains x86 read 0 0 0x7FFFFFFE N N N KILL 04-multilevel-chains x86_64 read 0 0 0x7FFFFFFFFFFFFFFE N N N KILL 04-multilevel-chains all read 1-10 0x856B008 0x7FFFFFFE N N N KILL 04-multilevel-chains x86 write 1-2 0x856B008 0x7FFFFFFE N N N ALLOW 04-multilevel-chains x86_64 write 1-2 0x856B008 0x7FFFFFFFFFFFFFFE N N N ALLOW 04-multilevel-chains x86 write 1-2 0 0x7FFFFFFE N N N KILL 04-multilevel-chains x86_64 write 1-2 0 0x7FFFFFFFFFFFFFFE N N N KILL 04-multilevel-chains x86 write 1-2 0x856B008 0x7FFFFFFF N N N KILL 04-multilevel-chains x86_64 write 1-2 0x856B008 0x7FFFFFFFFFFFFFFF N N N KILL 04-multilevel-chains all write 3-10 0x856B008 0x7FFFFFFE N N N KILL 04-multilevel-chains all rt_sigreturn N N N N N N ALLOW 04-multilevel-chains x86 0-2 N N N N N N KILL 04-multilevel-chains x86 7-172 N N N N N N KILL 04-multilevel-chains x86 174-350 N N N N N N KILL 04-multilevel-chains x86_64 4-14 N N N N N N KILL 04-multilevel-chains x86_64 16-350 N N N N N N KILL test type: bpf-sim-fuzz # Testname StressCount 04-multilevel-chains 150 libseccomp-0.1.0/tests/03-basic-chains.tests0000644000000000000000000000157711744067662017347 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 03-basic-chains all read 0 0x856B008 10 N N N ALLOW 03-basic-chains all read 1-10 0x856B008 10 N N N KILL 03-basic-chains all write 1-2 0x856B008 10 N N N ALLOW 03-basic-chains all write 3-10 0x856B008 10 N N N KILL 03-basic-chains all close N N N N N N ALLOW 03-basic-chains all rt_sigreturn N N N N N N ALLOW 03-basic-chains all open 0x856B008 4 N N N N KILL 03-basic-chains x86 0-2 N N N N N N KILL 03-basic-chains x86 7-172 N N N N N N KILL 03-basic-chains x86 174-350 N N N N N N KILL 03-basic-chains x86_64 4-14 N N N N N N KILL 03-basic-chains x86_64 16-350 N N N N N N KILL test type: bpf-sim-fuzz # Testname StressCount 03-basic-chains 150 libseccomp-0.1.0/tests/12-basic-masked-ops.c0000644000000000000000000000402611742125442017202 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 3, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 3, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_MASKED_EQ, 0x00ff, 1), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 3, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_MASKED_EQ, 0xffff, 11), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 3, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_MASKED_EQ, 0xffff, 111), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 3, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_MASKED_EQ, 0xff00, 1000), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/07-db-bug-looping.tests0000644000000000000000000000067311744067662017630 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 07-db-bug-looping all read 1 0x856B008 10 N N N ALLOW 07-db-bug-looping all read 2-10 0 10 N N N ALLOW 07-db-bug-looping all read 0 0x856B008 10 N N N ALLOW test type: bpf-sim-fuzz # Testname StressCount 07-db-bug-looping 150 libseccomp-0.1.0/tests/02-basic.tests0000644000000000000000000000127711744067662016100 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 02-basic all read 0 0x856B008 40 N N N ALLOW 02-basic all write 1 0x856B008 40 N N N ALLOW 02-basic all close 4 N N N N N ALLOW 02-basic all rt_sigreturn N N N N N N ALLOW 02-basic all open 0x856B008 4 N N N N KILL 02-basic x86 0-2 N N N N N N KILL 02-basic x86 7-172 N N N N N N KILL 02-basic x86 174-350 N N N N N N KILL 02-basic x86_64 4-14 N N N N N N KILL 02-basic x86_64 16-350 N N N N N N KILL test type: bpf-sim-fuzz # Testname StressCount 02-basic 150 libseccomp-0.1.0/tests/08-subtree-checks.c0000644000000000000000000001112311742125364016773 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; /* the syscall and argument numbers are all fake to make the test * simpler */ rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 2, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 1, SCMP_A1(SCMP_CMP_EQ, 1)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1001, 1, SCMP_A1(SCMP_CMP_EQ, 1)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1001, 2, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1002, 4, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2), SCMP_A3(SCMP_CMP_EQ, 3)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1002, 2, SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1003, 2, SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1003, 4, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2), SCMP_A3(SCMP_CMP_EQ, 3)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1004, 4, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2), SCMP_A3(SCMP_CMP_EQ, 3)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1004, 2, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 11)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1004, 4, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2), SCMP_A3(SCMP_CMP_EQ, 33)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1004, 2, SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1005, 2, SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1005, 4, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2), SCMP_A3(SCMP_CMP_EQ, 3)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1005, 2, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 11)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1005, 4, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2), SCMP_A3(SCMP_CMP_EQ, 33)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1006, 2, SCMP_A1(SCMP_CMP_NE, 1), SCMP_A2(SCMP_CMP_EQ, 0)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1006, 2, SCMP_A1(SCMP_CMP_EQ, 1), SCMP_A2(SCMP_CMP_EQ, 2)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1006, 1, SCMP_A1(SCMP_CMP_NE, 1)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_TRAP, 1007, 2, SCMP_A2(SCMP_CMP_EQ, 1), SCMP_A3(SCMP_CMP_EQ, 3)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1007, 2, SCMP_A2(SCMP_CMP_EQ, 1), SCMP_A3(SCMP_CMP_NE, 3)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1007, 1, SCMP_A3(SCMP_CMP_NE, 3)); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/regression0000755000000000000000000004535311744067662015625 0ustar rootroot#!/bin/bash # # libseccomp regression test automation script # # Copyright IBM Corp. 2012 # Author: Corey Bryant # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # #### # functions # # Dependency verification # # Arguments: # 1 Dependency to check for # function verify_deps() { [[ -z "$1" ]] && return if ! which "$1" >& /dev/null; then echo "error: install \"$1\" and include it in your \$PATH" exit 1 fi } # # Print out script usage details # function usage() { cat << EOF usage: regression [-h] [-a] [-b BATCH_NAME] [-g] [-l [LOG]] [-s SINGLE_TEST] [-t [TEMP_DIR]] [-v] libseccomp regression test automation script optional arguments: -h show this help message and exit -a specifies all tests are to be run -b BATCH_NAME specifies batch of tests to be run -g specifies that tests are to be run with valgrind -l [LOG] specifies log file to write test results to -s SINGLE_TEST specifies individual test number to be run -t [TEMP_DIR] specifies directory to create temporary files in -v specifies that verbose output be provided EOF } # # Generate a string representing the test number # # Arguments: # 1 value of the test number from the input test data file # 2 value of the subtest number that corresponds to argument 1 # # The actual test number from the input test data file is 1 for the first # test found in the file, 2 for the second, etc. # # The subtest number is useful for batches that generate multiple tests based # on a single line of input from the test data file. The subtest number # should be set to zero if the corresponding test data is actual test data # that was read from the input file, and should be set to a value greater than # zero if the corresponding test data is generated. # function generate_test_num() { local testnumstr=$(printf '%03d-%05d' $1 $2) echo "$testnumstr" } # # Print the test data to the log file # # Arguments: # 1 string containing generated test number # 2 string containing line of test data # function print_data() { if $verbose; then printf "Test %s data: %s\n" "$1" "$2" >&$logfd fi } # # Print the test result to the log file # # Arguments: # 1 string containing generated test number # 2 string containing the test result (INFO, SUCCESS, ERROR, or FAILURE) # 3 string containing addition details # function print_result() { if [[ $2 == "INFO" ]] && ! $verbose; then return fi if [[ $3 == "" ]]; then printf "Test %s result: %s\n" "$1" "$2" >&$logfd else printf "Test %s result: %s %s\n" "$1" "$2" "$3" >&$logfd fi } # # Print the valgrind header to the log file # # Arguments: # 1 string containing generated test number # function print_valgrind() { if $verbose; then printf "Test %s valgrind results:\n" "$1" >&$logfd fi } # # Get the low or high range value from a range specification # # Arguments: # 1 value specifying range value to retrieve: low (1) or high (2) # 2 string containing dash-separated range or a single value # function get_range() { if [[ $2 =~ ^[0-9a-fA-Fx]+-[0-9a-fA-Fx]+$ ]]; then # If there's a dash, get the low or high range value range_val=`echo "$2" | cut -d'-' -f "$1"` else # Otherwise there should just be a single value range_val="$2" fi echo "$range_val" } # # Run the specified test command (with valgrind if requested) # # Arguments: # 1 string containing generated test number # 2 string containing command to run # function run_test_command() { local cmd if $use_valgrind && $verbose; then print_valgrind $1 if [[ $logfd -eq 3 ]]; then cmd="/usr/bin/valgrind --log-fd=$logfd ./$2" else cmd="/usr/bin/valgrind ./$2" fi elif $use_valgrind; then # With -q, valgrind will only print error messages if [[ $logfd -eq 3 ]]; then cmd="/usr/bin/valgrind -q --log-fd=$logfd ./$2" else cmd="/usr/bin/valgrind -q ./$2" fi else cmd="./$2" fi #Run the command eval $cmd #Return the command's return code return $? } # # Generate pseudo-random string of alphanumeric characters # # The generated string will be no larger than the corresponding # architecture's register size. # function generate_random_data() { local rcount local rdata if [[ $arch == "x86_64" ]]; then rcount=$[ ($RANDOM % 16) + 1 ] else rcount=$[ ($RANDOM % 8) + 1 ] fi rdata=$(echo ` $tmpfile" if [[ $? -ne 0 ]]; then print_result $testnumstr "ERROR" "$testname rc=$?" return fi # Simulate the fuzzed syscall data against the BPF filter. We # don't verify the resulting action since we're just testing for # stability. allow=`../tools/bpf_sim -a $arch -f $tmpfile -s $sys \ ${arg[0]} ${arg[1]} ${arg[2]} ${arg[3]} ${arg[4]} ${arg[5]}` if [[ $? -ne 0 ]]; then print_result $testnumstr "ERROR" "bpf_sim rc=$?" else print_result $testnumstr "SUCCESS" "" fi subtestnum=$(($subtestnum+1)) done } # # Run the specified "bpf-sim" test # # Tests that belong to the "bpf-sim" test type generate a BPF filter and then # run a simulated system call test to validate the filter. Tests that belong to # this test type provide the following data on a single line in the input batch # file: # # Testname - The executable test name (e.g. 01-allow, 02-basic, etc.) # Arch - The architecture that the test should be run on (all, x86, x86_64) # Syscall - The syscall to simulate against the generated filter # Arg0-5 - The syscall arguments to simulate against the generated filter # Result - The expected simulation result (ALLOW, KILL, etc.) # # If a range of syscall or argument values are specified (e.g. 1-9), a test is # generated for every combination of range values. Otherwise, the individual # test is run. # # Arguments: # 1 value of test number from batch file # 2 string containing line of test data from batch file # function run_test_bpf_sim() { local LOW=1 local HIGH=2 local -a COL_WIDTH=(26 08 14 11 17 21 09 06 06) local rangetest=false local subtestnum=1 local testdata="" local -a arg_empty=(false false false false false false) local -a data #Begin splitting the test data from the line into individual variables local line=($2) local testname=${line[0]} local testarch=${line[1]} local low_syscall #line[2] local high_syscall #line[2] local -a low_arg #line[3-8] local -a high_arg #line[3-8] local result=${line[9]} # Generate the test number string for the line of batch test data local testnumstr=$(generate_test_num $1 0) # Set up log file test data line for the input test data. Spacing is # added to align the output in the correct columns. for i in {0..9}; do if [[ $i -le 9 ]]; then data[$i]=$(printf "%-${COL_WIDTH[$i]}s" ${line[$i]}) else data[$i]=$(printf "%s" ${line[$i]}) fi testdata=("$testdata${data[$i]}") done # Print out the input test data to the log file print_data "$testnumstr" "$testdata" # Only run tests that match the current architecture if [[ "$testarch" != "all" ]] && [[ "$testarch" != "$arch" ]]; then print_result $testnumstr "INFO" \ "Test skipped due to test/system architecture difference" return fi # Get low and high range syscall values and convert them to numbers if # either were specified by name. low_syscall=$(get_range $LOW "${line[2]}") if [[ ! $low_syscall =~ ^[0-9]+$ ]]; then low_syscall=`../tools/sys_resolver $low_syscall` if [[ $? -ne 0 ]]; then print_result $testnumstr "ERROR" "sys_resolver rc=$?" return fi fi high_syscall=$(get_range $HIGH "${line[2]}") if [[ ! $high_syscall =~ ^[0-9]+$ ]]; then high_syscall=`../tools/sys_resolver $high_syscall` if [[ $? -ne 0 ]]; then print_result $testnumstr "ERROR" "sys_resolver rc=$?" return fi fi if [[ "$low_syscall" != "$high_syscall" ]]; then rangetest=true fi # Get low and high range arg values line_i=3 for arg_i in {0..5}; do low_arg[$arg_i]=$(get_range $LOW "${line[$line_i]}") high_arg[$arg_i]=$(get_range $HIGH "${line[$line_i]}") if [[ "${low_arg[$arg_i]}" != "${high_arg[$arg_i]}" ]]; then rangetest=true fi # Fix up empty arg values so the nested loops below work if [[ ${low_arg[$arg_i]} == "N" ]]; then arg_empty[$arg_i]=true low_arg[$arg_i]=0 high_arg[$arg_i]=0 fi line_i=$(($line_i+1)) done # If ranges exist, the following will loop through all syscall and arg # ranges and generate/run every combination of requested tests. If no # ranges were specifed, then the single test is run. for sys in `seq -f "%1.0f" $low_syscall $high_syscall`; do for arg0 in `seq -f "%1.0f" ${low_arg[0]} ${high_arg[0]}`; do for arg1 in `seq -f "%1.0f" ${low_arg[1]} ${high_arg[1]}`; do for arg2 in `seq -f "%1.0f" ${low_arg[2]} ${high_arg[2]}`; do for arg3 in `seq -f "%1.0f" ${low_arg[3]} ${high_arg[3]}`; do for arg4 in `seq -f "%1.0f" ${low_arg[4]} ${high_arg[4]}`; do for arg5 in `seq -f "%1.0f" ${low_arg[5]} ${high_arg[5]}`; do local -a arg=($arg0 $arg1 $arg2 $arg3 $arg4 $arg5) data=() testdata="" if $rangetest; then # Get the generated sub-test num string testnumstr=$(generate_test_num $1 $subtestnum) # Format any empty arg vals to print to log file for i in {0..5}; do if ${arg_empty[$i]}; then arg[$i]="N" fi done # Set up log file test data line for this individual # test. Spacing is added to align the output in the # correct columns. data[0]=$(printf "%-${COL_WIDTH[0]}s" $testname) data[1]=$(printf "%-${COL_WIDTH[1]}s" $testarch) data[2]=$(printf "%-${COL_WIDTH[2]}s" $sys) data[3]=$(printf "%-${COL_WIDTH[3]}s" ${arg[0]}) data[4]=$(printf "%-${COL_WIDTH[4]}s" ${arg[1]}) data[5]=$(printf "%-${COL_WIDTH[5]}s" ${arg[2]}) data[6]=$(printf "%-${COL_WIDTH[6]}s" ${arg[3]}) data[7]=$(printf "%-${COL_WIDTH[7]}s" ${arg[4]}) data[8]=$(printf "%-${COL_WIDTH[8]}s" ${arg[5]}) data[9]=$(printf "%-${COL_WIDTH[9]}s" $result) for i in {0..9}; do testdata=("$testdata${data[$i]}") done # Print out the generated test data to the log file print_data "$testnumstr" "$testdata" fi # Set up the syscall argument values to be passed to bpf_sim for i in {0..5}; do if ${arg_empty[$i]}; then arg[$i]="" else arg[$i]=" -$i ${arg[$i]} " fi done # Run the test command and put the BPF filter in a temp file run_test_command "$testnumstr" "$testname -b > $tmpfile" if [[ $? -ne 0 ]]; then print_result $testnumstr "ERROR" "$testname rc=$?" return fi # Simulate the specifed syscall against the BPF filter and # verify the results. action=`../tools/bpf_sim -a $arch -f $tmpfile -s $sys \ ${arg[0]} ${arg[1]} ${arg[2]} ${arg[3]} ${arg[4]} ${arg[5]}` if [[ $? -ne 0 ]]; then print_result $testnumstr "ERROR" "bpf_sim rc=$?" elif [[ "$action" != "$result" ]]; then print_result $testnumstr "FAILURE" \ "bpf_sim resulted in $action" else print_result $testnumstr "SUCCESS" "" fi subtestnum=$(($subtestnum+1)) done done done done done done done } # # Run the specified "basic" test # # Tests that belong to the "basic" test type will simply have the command # specified in the input batch file. The command must return zero for success # and non-zero for failure. # # Arguments: # 1 value of test number from batch file # 2 string containing line of test data from batch file # function run_test_basic() { # Print out the input test data to the log file print_data "$1" "$2" # Run the command run_test_command "$1" "$2" if [[ $? -ne 0 ]]; then print_result $1 "FAILURE" "$2 rc=$?" else print_result $1 "SUCCESS" "" fi } # # Run a single test from the specified batch # # Arguments: # 1 value of test number from batch file # 2 string containing line of test data from batch file # 3 string containing test type that this test belongs to # function run_test() { # Generate the test number string for the line of batch test data local testnumstr=$(generate_test_num $1 0) # Execute the function corresponding to the test type if [[ "$3" == "basic" ]]; then run_test_basic "$testnumstr" "$2" elif [[ "$3" == "bpf-sim" ]]; then run_test_bpf_sim $1 "$2" elif [[ "$3" == "bpf-sim-fuzz" ]]; then run_test_bpf_sim_fuzz $1 "$2" else print_result $testnumstr "ERROR" "test type $3 not supported" fi } # # Run the requested tests # function run_tests() { # Loop through all test files for file in *.tests; do local testnum=1 local batch_requested=false local batch_name="" # Extract the batch name from the file name batch_name=$(basename $file .tests) # Check if this batch was requested if [[ ${batch_list[@]} ]]; then for b in ${batch_list[@]}; do if [[ $b == $batch_name ]]; then batch_requested=true break fi done if ! $batch_requested; then continue fi fi # Print batch name to log file echo "batch name: $batch_name" >&$logfd # Loop through each line of the file and run the requested tests while read line; do # Strip leading and trailing blanks and skip comments # and blank lines. line=`echo "$line" | sed -e 's/^[\t ]*//;s/[\t ]*$//;' | sed -e '/^[#].*$/d;/^$/d'` if [[ -z $line ]]; then continue fi if [[ $line =~ ^"test type": ]]; then test_type=`echo "$line" | sed -e 's/^test type: //;'` # Print test type to log file echo "test type: $test_type" >&$logfd continue elif [[ ${single_list[@]} ]]; then for i in ${single_list[@]}; do if [ $i -eq $testnum ]; then # If we're here, we're running a # requested individual test. run_test $testnum "$line" \ "$test_type" fi done else # If we're here, we're running a test from a # requested batch or from all tests. run_test $testnum "$line" "$test_type" fi testnum=$(($testnum+1)) done < "$file" done } #### # main # Verify general script dependencies verify_deps sed # Global variables declare -a batch_list declare -a single_list arch= batch_count=0 logfile= logfd= runall=false singlecount=0 tmpfile="" tmpdir="" use_valgrind=false verbose=false while getopts "ab:gl:s:t:vh" opt; do case $opt in a) runall=true ;; b) batch_list[batch_count]="$OPTARG" batch_count=$(($batch_count+1)) ;; g) verify_deps valgrind use_valgrind=true ;; l) logfile="$OPTARG" ;; s) single_list[single_count]=$OPTARG single_count=$(($single_count+1)) ;; t) tmpdir="$OPTARG" ;; v) verbose=true ;; h|*) usage exit 1 ;; esac done # Default to all tests if batch or single tests not requested if [[ -z $batch_list ]] && [[ -z $single_list ]]; then runall=true fi # Drop any requested batch and single tests if all tests were requested if $runall; then batch_list=() single_list=() fi # Open log file for append (default to stdout) if [[ -n $logfile ]]; then logfd=3 exec 3>>"$logfile" else logfd=1 fi # Open temporary file if [[ -n $tmpdir ]]; then tmpfile=$(mktemp -t regression_XXXXXX --tmpdir=$tmpdir) else tmpfile=$(mktemp -t regression_XXXXXX) fi # Determine the current system's architecture arch=`uname -m` if [[ $arch != "x86_64" ]]; then arch="x86" fi # Display the test output and run the requested tests echo "=============== `date` ===============" >&$logfd echo "Regression Test Report (\"regression $*\")" >&$logfd run_tests echo "============================================================" >&$logfd # cleanup and exit rm -f $tmpfile exit 0 libseccomp-0.1.0/tests/util.h0000644000000000000000000000170411742122451014617 0ustar rootroot/** * Seccomp Library utility code for tests * * Copyright IBM Corp. 2012 * Author: Corey Bryant */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _UTIL_TEST_H #define _UTIL_TEST_H struct util_options { int bpf_flg; }; int util_getopt(int argc, char *argv[], struct util_options *opts); int util_filter_output(const struct util_options *opts); #endif libseccomp-0.1.0/tests/11-basic-errors.tests0000644000000000000000000000026311742114700017364 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: basic # Test command 11-basic-errors libseccomp-0.1.0/tests/Makefile0000644000000000000000000000272211763744013015141 0ustar rootroot# # Enhanced Seccomp Library Makefile # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # # # macros # include ../macros.mk # # configuration # include $(TOPDIR)/version_info.mk include $(TOPDIR)/configure.mk OBJS = util.o LDFLAGS := ../src/libseccomp.a $(OBJS) TESTS = 01-allow \ 02-basic \ 03-basic-chains \ 04-multilevel-chains \ 05-long-jumps \ 06-actions \ 07-db-bug-looping \ 08-subtree-checks \ 09-syscall-priority-pre \ 10-syscall-priority-post \ 11-basic-errors \ 12-basic-masked-ops \ 13-attrs DEPS_OBJS = $(OBJS:%.o=%.d) DEPS_TESTS = $(TESTS:%=%.d) # # targets # .PHONY: clean all: $(TESTS) $(OBJS) -include $(DEPS_TESTS) $(DEPS_OBJS) $(DEPS_TESTS): $(MAKEDEP_EXEC) $(ADDDEP) $@ ../src/libseccomp.a $(ADDDEP) $@ $(OBJS) $(TESTS): $(COMPILE_EXEC) clean: $(RM) -f $(DEPS_TESTS) $(DEPS_OBJS) $(TESTS) $(OBJS) libseccomp-0.1.0/tests/11-basic-errors.c0000644000000000000000000000727211746233754016472 0ustar rootroot/** * Seccomp Library test program * * Copyright IBM Corp. 2012 * Author: Corey Bryant */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include int main(int argc, char *argv[]) { int rc; /* seccomp_init errors */ rc = seccomp_init(SCMP_ACT_ALLOW+1); if (rc != -EINVAL) return -1; rc = seccomp_init(SCMP_ACT_ALLOW); if (rc != 0) return rc; else { rc = seccomp_init(SCMP_ACT_KILL); if (rc != -EEXIST) return -1; } seccomp_release(); /* seccomp_reset error */ rc = seccomp_reset(SCMP_ACT_KILL+1); if (rc != -EINVAL) return -1; /* seccomp_load error */ rc = seccomp_load(); if (rc != -EFAULT) return -1; /* seccomp_syscall_priority errors */ rc = seccomp_syscall_priority(SCMP_SYS(read), 1); if (rc != -EFAULT) return -1; rc = seccomp_init(SCMP_ACT_ALLOW); if (rc != 0) return rc; else { rc = seccomp_syscall_priority(-1000, 1); #if __i386__ if (rc != -EINVAL) return -1; #else if (rc != -EDOM) return -1; #endif } seccomp_release(); /* seccomp_rule_add errors */ rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(read), 1, SCMP_A0(SCMP_CMP_EQ, 0)); if (rc != -EFAULT) return -1; rc = seccomp_init(SCMP_ACT_ALLOW); if (rc != 0) return rc; else { rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(read), 0); if (rc != -EPERM) return -1; rc = seccomp_rule_add(SCMP_ACT_KILL-1, SCMP_SYS(read), 0); if (rc != -EINVAL) return -1; rc = seccomp_rule_add(SCMP_ACT_KILL, SCMP_SYS(read), 6); if (rc != -EINVAL) return -1; rc = seccomp_rule_add(SCMP_ACT_KILL, SCMP_SYS(read), 7, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 0), SCMP_A2(SCMP_CMP_EQ, 0), SCMP_A3(SCMP_CMP_EQ, 0), SCMP_A4(SCMP_CMP_EQ, 0), SCMP_A5(SCMP_CMP_EQ, 0), SCMP_CMP(6, SCMP_CMP_EQ, 0)); if (rc != -EINVAL) return -1; rc = seccomp_rule_add(SCMP_ACT_KILL, SCMP_SYS(read), 1, SCMP_A0(_SCMP_CMP_MIN, 0)); if (rc != -EINVAL) return -1; rc = seccomp_rule_add(SCMP_ACT_KILL, SCMP_SYS(read), 1, SCMP_A0(_SCMP_CMP_MAX, 0)); if (rc != -EINVAL) return -1; #if __i386__ rc = seccomp_rule_add(SCMP_ACT_KILL, -1001, 0); if (rc != -EINVAL) return -1; #endif } seccomp_release(); /* seccomp_rule_add_exact error */ rc = seccomp_init(SCMP_ACT_ALLOW); if (rc != 0) return rc; else { #if __i386__ rc = seccomp_rule_add_exact(SCMP_ACT_KILL, SCMP_SYS(socket), 1, SCMP_A0(SCMP_CMP_EQ, 2)); if (rc != -EINVAL) return -1; #endif } seccomp_release(); /* seccomp_export_pfc errors */ rc = seccomp_export_pfc(STDOUT_FILENO); if (rc != -EFAULT) return -1; rc = seccomp_init(SCMP_ACT_ALLOW); if (rc != 0) return rc; else { rc = seccomp_export_pfc(sysconf(_SC_OPEN_MAX)-1); if (rc != EBADF) return -1; } seccomp_release(); /* seccomp_export_bpf errors */ rc = seccomp_export_bpf(STDOUT_FILENO); if (rc != -EFAULT) return -1; rc = seccomp_init(SCMP_ACT_ALLOW); if (rc != 0) return rc; else { rc = seccomp_export_bpf(sysconf(_SC_OPEN_MAX)-1); if (rc != -EBADF) return -1; } seccomp_release(); return 0; } libseccomp-0.1.0/tests/util.c0000644000000000000000000000454611746233754014636 0ustar rootroot/** * Seccomp Library utility code for tests * * Copyright (c) 2012 Red Hat * Author: Eric Paris */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include #include #include #include "util.h" /** * Parse the arguments passed to main * @param argc the argument count * @param argv the argument pointer * @param opts the options structure * * This function parses the arguments passed to the test from the command line. * Returns zero on success and negative values on failure. * */ int util_getopt(int argc, char *argv[], struct util_options *opts) { int rc = 0; if (opts == NULL) return -EFAULT; memset(opts, 0, sizeof(*opts)); while (1) { int c, option_index = 0; const struct option long_options[] = { {"bpf", no_argument, &(opts->bpf_flg), 1}, {"pfc", no_argument, &(opts->bpf_flg), 0}, {0, 0, 0, 0}, }; c = getopt_long(argc, argv, "bp", long_options, &option_index); if (c == -1) break; switch (c) { case 0: break; case 'b': opts->bpf_flg = 1; break; case 'p': opts->bpf_flg = 0; break; default: rc = -EINVAL; break; } } if (rc == -EINVAL || optind < argc) { fprintf(stderr, "usage %s: [--bpf,-b] [--pfc,-p]\n", argv[0]); rc = -EINVAL; } return rc; } /** * Output the filter in either BPF or PFC * @param opts the options structure * * This function outputs the seccomp filter to in either BPF or PFC format * depending on the test paramaeters supplied by @opts. * */ int util_filter_output(const struct util_options *opts) { int rc; if (opts == NULL) return -EFAULT; if (opts->bpf_flg) rc = seccomp_export_bpf(STDOUT_FILENO); else rc = seccomp_export_pfc(STDOUT_FILENO); return rc; } libseccomp-0.1.0/tests/03-basic-chains.c0000644000000000000000000000327511742125267016416 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 1, SCMP_A0(SCMP_CMP_EQ, STDIN_FILENO)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(write), 1, SCMP_A0(SCMP_CMP_EQ, STDOUT_FILENO)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(write), 1, SCMP_A0(SCMP_CMP_EQ, STDERR_FILENO)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(close), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(rt_sigreturn), 0); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/09-syscall-priority-pre.c0000644000000000000000000000327711742125413020210 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; /* the syscall and argument numbers are all fake to make the test * simpler */ rc = seccomp_syscall_priority(1000, 3); if (rc != 0) goto out; rc = seccomp_syscall_priority(1001, 2); if (rc != 0) goto out; rc = seccomp_syscall_priority(1002, 1); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 2, SCMP_A0(SCMP_CMP_EQ, 0), SCMP_A1(SCMP_CMP_EQ, 1)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1001, 1, SCMP_A0(SCMP_CMP_EQ, 0)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1002, 0); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/07-db-bug-looping.c0000644000000000000000000000312611742125342016670 0ustar rootroot/** * Seccomp Library test program * * Copyright IBM Corp. 2012 * Author: Ashley Lai */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; /* The next three seccomp_rule_add_exact() calls for read must * go together in this order to catch an infinite loop. */ rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 1, SCMP_A0(SCMP_CMP_EQ, STDOUT_FILENO)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 1, SCMP_A1(SCMP_CMP_EQ, 0x0)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 1, SCMP_A0(SCMP_CMP_EQ, STDIN_FILENO)); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/01-allow.tests0000644000000000000000000000046611744067662016133 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 01-allow all 0-350 N N N N N N ALLOW test type: bpf-sim-fuzz # Testname StressCount 01-allow 150 libseccomp-0.1.0/tests/10-syscall-priority-post.tests0000644000000000000000000000115311744067662021323 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 10-syscall-priority-post all 999 N N N N N N KILL 10-syscall-priority-post all 1000-1002 0 1 N N N N ALLOW 10-syscall-priority-post all 1000 0 2 N N N N KILL 10-syscall-priority-post all 1001-1002 0 2 N N N N ALLOW 10-syscall-priority-post all 1000-1001 1 1 N N N N KILL 10-syscall-priority-post all 1003 N N N N N N KILL test type: bpf-sim-fuzz # Testname StressCount 10-syscall-priority-post 150 libseccomp-0.1.0/tests/02-basic.c0000644000000000000000000000304611742125255015143 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ /* * Just like mode 1 seccomp we allow 4 syscalls: * read, write, exit, and rt_sigreturn */ #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(write), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(close), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(rt_sigreturn), 0); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/06-actions.c0000644000000000000000000000273511742125317015531 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ERRNO(EPERM), SCMP_SYS(write), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_TRAP, SCMP_SYS(close), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_TRACE(1234), SCMP_SYS(open), 0); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/05-long-jumps.tests0000644000000000000000000000217511744067662017113 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 05-long-jumps all 1 1 2 3 4 5 6 ALLOW 05-long-jumps all 2 N N N N N N KILL 05-long-jumps all 999 N N N N N N KILL 05-long-jumps x86 1000 0-5 0x856B008 0x7FFFFFFE N N N ALLOW 05-long-jumps x86_64 1000 0-5 0x856B008 0x7FFFFFFFFFFFFFFE N N N ALLOW 05-long-jumps x86 1000 595-599 0x856B008 0x7FFFFFFE N N N ALLOW 05-long-jumps x86_64 1000 595-599 0x856B008 0x7FFFFFFFFFFFFFFE N N N ALLOW 05-long-jumps x86 1000 600 0x856B008 0x7FFFFFFE N N N KILL 05-long-jumps x86_64 1000 600 0x856B008 0x7FFFFFFFFFFFFFFE N N N KILL 05-long-jumps all 1001 N N N N N N KILL 05-long-jumps all 99 1 N N N N N KILL 05-long-jumps all 100-105 1 N N N N N ALLOW 05-long-jumps all 695-699 1 N N N N N ALLOW 05-long-jumps all 700 1 N N N N N KILL 05-long-jumps all 3 N N N N N N KILL 05-long-jumps all 4 1 2 3 4 5 6 ALLOW 05-long-jumps all 5 N N N N N N KILL test type: bpf-sim-fuzz # Testname StressCount 05-long-jumps 150 libseccomp-0.1.0/tests/04-multilevel-chains.c0000644000000000000000000000415511742125277017517 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include "util.h" int main(int argc, char *argv[]) { int rc; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(open), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(close), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(read), 3, SCMP_A0(SCMP_CMP_EQ, STDIN_FILENO), SCMP_A1(SCMP_CMP_NE, 0x0), SCMP_A2(SCMP_CMP_LT, SSIZE_MAX)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(write), 3, SCMP_A0(SCMP_CMP_EQ, STDOUT_FILENO), SCMP_A1(SCMP_CMP_NE, 0x0), SCMP_A2(SCMP_CMP_LT, SSIZE_MAX)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(write), 3, SCMP_A0(SCMP_CMP_EQ, STDERR_FILENO), SCMP_A1(SCMP_CMP_NE, 0x0), SCMP_A2(SCMP_CMP_LT, SSIZE_MAX)); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(close), 0); if (rc != 0) goto out; rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, SCMP_SYS(rt_sigreturn), 0); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/12-basic-masked-ops.tests0000644000000000000000000000267111744067662020141 0ustar rootroot# # libseccomp regression test automation data # # Copyright IBM Corp. 2012 # Author: Corey Bryant # test type: bpf-sim # Testname Arch Syscall Arg0 Arg1 Arg2 Arg3 Arg4 Arg5 Result 12-basic-masked-ops all 1000 0 1 2 N N N ALLOW 12-basic-masked-ops all 1000 0 0x01 2 N N N ALLOW 12-basic-masked-ops all 1000 0 0x02-0x0A 2 N N N KILL 12-basic-masked-ops all 1000 0 0x101 2 N N N ALLOW 12-basic-masked-ops all 1000 0 11 2 N N N ALLOW 12-basic-masked-ops all 1000 0 0x0B 2 N N N ALLOW 12-basic-masked-ops all 1000 0 0x0C-0x6E 2 N N N KILL 12-basic-masked-ops all 1000 0 0x1000B 2 N N N ALLOW 12-basic-masked-ops all 1000 0 111 2 N N N ALLOW 12-basic-masked-ops all 1000 0 0x6F 2 N N N ALLOW 12-basic-masked-ops all 1000 0 0x70-0x100 2 N N N KILL 12-basic-masked-ops all 1000 0 0x102-0x200 2 N N N KILL 12-basic-masked-ops all 1000 0 0x10002-0x1000A 2 N N N KILL 12-basic-masked-ops all 1000 0 0x1000C-0x1006E 2 N N N KILL 12-basic-masked-ops all 1000 0 0x1006F 2 N N N ALLOW 12-basic-masked-ops all 1000 0 1000 2 N N N ALLOW 12-basic-masked-ops all 1000 0 0x3E8 2 N N N ALLOW 12-basic-masked-ops all 1000 0 0x2FF 2 N N N KILL 12-basic-masked-ops all 1000 0 0x300-0x3FF 2 N N N ALLOW 12-basic-masked-ops all 1000 0 0x400 2 N N N KILL 12-basic-masked-ops all 1000 0 0x402-0x4FF 2 N N N KILL 12-basic-masked-ops all 1000 0 0x10300-0x103FF 2 N N N ALLOW test type: bpf-sim-fuzz # Testname StressCount 12-basic-masked-ops 150 libseccomp-0.1.0/tests/13-attrs.c0000644000000000000000000000324111743036476015225 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include "util.h" int main(int argc, char *argv[]) { int rc; uint32_t val = (uint32_t)-1; rc = seccomp_init(SCMP_ACT_ALLOW); if (rc != 0) goto out; rc = seccomp_attr_get(SCMP_FLTATR_ACT_DEFAULT, &val); if (rc != 0) goto out; if (val != SCMP_ACT_ALLOW) { rc = -1; goto out; } rc = seccomp_attr_set(SCMP_FLTATR_ACT_DEFAULT, val); if (rc != -EACCES) { rc = -1; goto out; } rc = seccomp_attr_set(SCMP_FLTATR_ACT_BADARCH, SCMP_ACT_ALLOW); if (rc != 0) goto out; rc = seccomp_attr_get(SCMP_FLTATR_ACT_BADARCH, &val); if (rc != 0) goto out; if (val != SCMP_ACT_ALLOW) { rc = -1; goto out; } rc = seccomp_attr_set(SCMP_FLTATR_CTL_NNP, 0); if (rc != 0) goto out; rc = seccomp_attr_get(SCMP_FLTATR_CTL_NNP, &val); if (rc != 0) goto out; if (val != 0) { rc = -1; goto out; } rc = 0; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/tests/05-long-jumps.c0000644000000000000000000000344411742125307016160 0ustar rootroot/** * Seccomp Library test program * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include "util.h" int main(int argc, char *argv[]) { int rc; int iter; struct util_options opts; rc = util_getopt(argc, argv, &opts); if (rc < 0) goto out; rc = seccomp_init(SCMP_ACT_KILL); if (rc != 0) goto out; /* NOTE - syscalls referenced by number to make the test simpler */ rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1, 0); if (rc != 0) goto out; /* same syscall, many chains */ for (iter = 0; iter < 600; iter++) { rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 1000, 3, SCMP_A0(SCMP_CMP_EQ, iter), SCMP_A1(SCMP_CMP_NE, 0x0), SCMP_A2(SCMP_CMP_LT, SSIZE_MAX)); if (rc != 0) goto out; } /* many syscalls, same chain */ for (iter = 100; iter < 700; iter++) { rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, iter, 1, SCMP_A0(SCMP_CMP_NE, 0)); if (rc != 0) goto out; } rc = seccomp_rule_add_exact(SCMP_ACT_ALLOW, 4, 0); if (rc != 0) goto out; rc = util_filter_output(&opts); if (rc) goto out; out: seccomp_release(); return (rc < 0 ? -rc : rc); } libseccomp-0.1.0/CREDITS0000644000000000000000000000045311763742704013363 0ustar rootrootThe following people have contributed to the libseccomp project: Ashley Lai Corey Bryant Eduardo Otubo Eric Paris Jake Edge Kees Cook Paul Moore libseccomp-0.1.0/install.mk0000644000000000000000000000213311763725304014334 0ustar rootroot# # Enhanced Seccomp Library Installation Defaults # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # INSTALL_PREFIX ?= $(CONF_INSTALL_PREFIX) INSTALL_SBIN_DIR ?= $(DESTDIR)/$(INSTALL_PREFIX)/sbin INSTALL_BIN_DIR ?= $(DESTDIR)/$(INSTALL_PREFIX)/bin INSTALL_LIB_DIR ?= $(DESTDIR)/$(CONF_INSTALL_LIBDIR) INSTALL_INC_DIR ?= $(DESTDIR)/$(INSTALL_PREFIX)/include INSTALL_MAN_DIR ?= $(DESTDIR)/$(INSTALL_PREFIX)/share/man INSTALL_OWNER ?= $$(id -u) INSTALL_GROUP ?= $$(id -g) libseccomp-0.1.0/src/0000755000000000000000000000000011764403332013120 5ustar rootrootlibseccomp-0.1.0/src/gen_bpf.c0000644000000000000000000011430311743036476014676 0ustar rootroot/** * Seccomp BPF Translator * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include #include #include #include "arch.h" #include "gen_bpf.h" #include "db.h" #include "hash.h" #include "system.h" /* allocation increments */ #define AINC_BLK 2 #define AINC_PROG 64 struct acc_state { int32_t offset; uint32_t mask; }; enum bpf_jump_type { TGT_NONE = 0, TGT_K, /* immediate "k" value */ TGT_NXT, /* fall through to the next block */ TGT_IMM, /* resolved immediate value */ TGT_PTR_DB, /* pointer to part of the filter db */ TGT_PTR_BLK, /* pointer to an instruction block */ TGT_PTR_HSH, /* pointer to a block hash table */ }; struct bpf_jump { enum bpf_jump_type type; union { uint8_t imm_j; uint32_t imm_k; uint64_t hash; void *ptr; } tgt; }; #define _BPF_JMP_NO \ ((struct bpf_jump) { TGT_NONE, { .ptr = 0 } }) #define _BPF_JMP_NXT \ ((struct bpf_jump) { TGT_NXT, { .ptr = 0 } }) /* be careful! */ #define _BPF_JMP_IMM(x) \ ((struct bpf_jump) { TGT_IMM, { .imm_j = (x) } }) #define _BPF_JMP_DB(x) \ ((struct bpf_jump) { TGT_PTR_DB, { .ptr = (x) } }) #define _BPF_JMP_BLK(x) \ ((struct bpf_jump) { TGT_PTR_BLK, { .ptr = (x) } }) #define _BPF_JMP_HSH(x) \ ((struct bpf_jump) { TGT_PTR_HSH, { .hash = (x) } }) #define _BPF_K(x) \ ((struct bpf_jump) { TGT_K, { .imm_k = (x) } }) #define _BPF_JMP_MAX 255 #define _BPF_JMP_MAX_RET 255 struct bpf_instr { uint16_t op; struct bpf_jump jt; struct bpf_jump jf; struct bpf_jump k; }; #define _BPF_OFFSET_SYSCALL (offsetof(struct seccomp_data, nr)) #define _BPF_SYSCALL _BPF_K(_BPF_OFFSET_SYSCALL) struct bpf_blk { struct bpf_instr *blks; unsigned int blk_cnt; unsigned int blk_alloc; /* priority - higher is better */ unsigned int priority; /* original db_arg_chain_tree node */ const struct db_arg_chain_tree *node; /* used during final block assembly */ unsigned int hashed_flag; uint64_t hash; struct bpf_blk *hash_nxt; struct bpf_blk *prev, *next; }; #define _BLK_MSZE(x) \ ((x)->blk_cnt * sizeof(*((x)->blks))) struct bpf_hash_bkt { struct bpf_blk *blk; unsigned int found; struct bpf_hash_bkt *next; }; #define _BPF_HASH_BITS 8 #define _BPF_HASH_SIZE (1 << _BPF_HASH_BITS) #define _BPF_HASH_MASK (_BPF_HASH_BITS - 1) struct bpf_state { /* target arch */ const struct arch_def *arch; /* filter attributes */ const struct db_filter_attr *attr; /* default action */ uint64_t def_hsh; /* block hash table */ struct bpf_hash_bkt *htbl[_BPF_HASH_SIZE]; /* bpf program */ struct bpf_program *bpf; }; /** * Populate a BPF instruction * @param _ins the BPF instruction * @param _op the BPF operand * @param _jt the BPF jt value * @param _jf the BPF jf value * @param _k the BPF k value * * Set the given values on the provided bpf_instr struct. * */ #define _BPF_INSTR(_ins,_op,_jt,_jf,_k) \ do { \ memset(&(_ins), 0, sizeof(_ins)); \ (_ins).op = (_op); \ (_ins).jt = _jt; \ (_ins).jf = _jf; \ (_ins).k = _k; \ } while (0) static struct bpf_blk *_gen_bpf_chain(struct bpf_state *state, const struct db_sys_list *sys, const struct db_arg_chain_tree *chain, struct bpf_blk *next); static struct bpf_blk *_hsh_remove(struct bpf_state *state, uint64_t h_val); static struct bpf_blk *_hsh_find(const struct bpf_state *state, uint64_t h_val); /** * Free the BPF instruction block * @param state the BPF state * @param blk the BPF instruction block * * Free the BPF instruction block, any linked blocks are preserved and the hash * table is not modified. In general, you probably want to use _blk_free() * instead. * */ static void __blk_free(struct bpf_state *state, struct bpf_blk *blk) { struct bpf_blk *b_tmp; while (blk->hash_nxt != NULL) { b_tmp = blk->hash_nxt; blk->hash_nxt = b_tmp->hash_nxt; free(b_tmp); } if (blk->blks != NULL) free(blk->blks); free(blk); } /** * Free the BPF instruction block * @param state the BPF state * @param blk the BPF instruction block * * Free the BPF instruction block including any linked blocks. The hash table * is updated to reflect the newly removed block(s). * */ static void _blk_free(struct bpf_state *state, struct bpf_blk *blk) { int iter; struct bpf_blk *b_iter; struct bpf_instr *i_iter; if (blk == NULL) return; /* remove this block from the hash table */ _hsh_remove(state, blk->hash); /* run through the block freeing TGT_PTR_{BLK,HSH} jump targets */ for (iter = 0; iter < blk->blk_cnt; iter++) { i_iter = &blk->blks[iter]; switch (i_iter->jt.type) { case TGT_PTR_BLK: _blk_free(state, i_iter->jt.tgt.ptr); break; case TGT_PTR_HSH: b_iter = _hsh_find(state, i_iter->jt.tgt.hash); _blk_free(state, b_iter); break; default: /* do nothing */ break; } switch (i_iter->jf.type) { case TGT_PTR_BLK: _blk_free(state, i_iter->jf.tgt.ptr); break; case TGT_PTR_HSH: b_iter = _hsh_find(state, i_iter->jf.tgt.hash); _blk_free(state, b_iter); break; default: /* do nothing */ break; } } __blk_free(state, blk); } /** * Append a new BPF instruction to an instruction block * @param state the BPF state * @param blk the existing instruction block, or NULL * @param instr the new instruction * * Add the new BPF instruction to the end of the give instruction block. If * the given instruction block is NULL, a new block will be allocated. Returns * a pointer to the block on success, NULL on failure and in the case of * failure the instruction block is free'd. * */ static struct bpf_blk *_blk_append(struct bpf_state *state, struct bpf_blk *blk, const struct bpf_instr *instr) { struct bpf_instr *new; if (blk == NULL) { blk = malloc(sizeof(*blk)); if (blk == NULL) return NULL; memset(blk, 0, sizeof(*blk)); } if ((blk->blk_cnt + 1) > blk->blk_alloc) { blk->blk_alloc += AINC_BLK; new = realloc(blk->blks, blk->blk_alloc * sizeof(*(blk->blks))); if (new == NULL) { _blk_free(state, blk); return NULL; } blk->blks = new; } memcpy(&blk->blks[blk->blk_cnt++], instr, sizeof(*instr)); return blk; } /** * Append a block of BPF instructions to the final BPF program * @param prg the BPF program * @param blk the BPF instruction block * * Add the BPF instruction block to the end of the BPF program and perform the * necssary translation. Returns zero on success, negative values on failure * and in the case of failure the BPF program is free'd. * */ static int _bpf_append_blk(struct bpf_program *prg, const struct bpf_blk *blk) { int rc; bpf_instr_raw *i_new; bpf_instr_raw *i_iter; unsigned int old_cnt = prg->blk_cnt; unsigned int iter; /* (re)allocate the program memory */ prg->blk_cnt += blk->blk_cnt; i_new = realloc(prg->blks, BPF_PGM_SIZE(prg)); if (i_new == NULL) { rc = -ENOMEM; goto bpf_append_blk_failure; } prg->blks = i_new; /* transfer and translate the blocks to raw instructions */ for (iter = 0; iter < blk->blk_cnt; iter++) { i_iter = &(prg->blks[old_cnt + iter]); i_iter->code = blk->blks[iter].op; switch (blk->blks[iter].jt.type) { case TGT_NONE: i_iter->jt = 0; break; case TGT_IMM: /* jump to the value specified */ i_iter->jt = blk->blks[iter].jt.tgt.imm_j; break; default: /* fatal error - we should never get here */ rc = -EFAULT; goto bpf_append_blk_failure; } switch (blk->blks[iter].jf.type) { case TGT_NONE: i_iter->jf = 0; break; case TGT_IMM: /* jump to the value specified */ i_iter->jf = blk->blks[iter].jf.tgt.imm_j; break; default: /* fatal error - we should never get here */ rc = -EFAULT; goto bpf_append_blk_failure; } switch (blk->blks[iter].k.type) { case TGT_NONE: i_iter->k = 0; break; case TGT_K: i_iter->k = blk->blks[iter].k.tgt.imm_k; break; default: /* fatal error - we should never get here */ rc = -EFAULT; goto bpf_append_blk_failure; } } return prg->blk_cnt; bpf_append_blk_failure: prg->blk_cnt = 0; free(prg->blks); return rc; } /** * Append a single BPF instruction to the final BPF program * @param prg the BPF program * @param instr the BPF instruction * * Add the BPF instruction to the end of the BPF program and perform the * necssary translation. Returns zero on success, negative values on failure * and in the case of failure the BPF program is free'd. * */ static int _bpf_append_instr(struct bpf_program *prg, struct bpf_instr *instr) { struct bpf_blk blk; memset(&blk, 0, sizeof(blk)); blk.blk_cnt = 1; blk.blk_alloc = 1; blk.blks = instr; return _bpf_append_blk(prg, &blk); } /** * Free the BPF program * @param prg the BPF program * * Free the BPF program. None of the associated BPF state used to generate the * BPF program is released in this function. * */ static void _program_free(struct bpf_program *prg) { if (prg == NULL) return; if (prg->blks != NULL) free(prg->blks); free(prg); } /** * Free the BPF state * @param the BPF state * * Free all of the BPF state, including the BPF program if present. * */ static void _state_release(struct bpf_state *state) { unsigned int bkt; struct bpf_hash_bkt *iter; if (state == NULL) return; /* release all of the hash table entries */ for (bkt = 0; bkt < _BPF_HASH_SIZE; bkt++) { while (state->htbl[bkt]) { iter = state->htbl[bkt]; state->htbl[bkt] = iter->next; __blk_free(state, iter->blk); free(iter); } } _program_free(state->bpf); memset(state, 0, sizeof(*state)); } /** * Add an instruction block to the BPF state hash table * @param state the BPF state * @param blk_p pointer to the BPF instruction block * @param found initial found value (see _hsh_find_once() for description) * * This function adds an instruction block to the hash table, and frees the * block if an identical instruction block already exists, returning a pointer * to the original block in place of the given block. Returns zero on success * and negative values on failure. * */ static int _hsh_add(struct bpf_state *state, struct bpf_blk **blk_p, unsigned int found) { uint64_t h_val; struct bpf_hash_bkt *h_new, *h_iter, *h_prev = NULL; struct bpf_blk *blk = *blk_p; struct bpf_blk *b_iter; if (blk->hashed_flag) return 0; h_new = malloc(sizeof(*h_new)); if (h_new == NULL) return -ENOMEM; memset(h_new, 0, sizeof(*h_new)); /* generate the hash */ h_val = jhash(blk->blks, _BLK_MSZE(blk), 0); blk->hash = h_val; blk->hashed_flag = 1; blk->node = NULL; h_new->blk = blk; h_new->found = (found ? 1 : 0); /* insert the block into the hash table */ h_iter = state->htbl[h_val & _BPF_HASH_MASK]; if (h_iter != NULL) { do { if ((h_iter->blk->hash == h_val) && (_BLK_MSZE(h_iter->blk) == _BLK_MSZE(blk)) && (memcmp(h_iter->blk->blks, blk->blks, _BLK_MSZE(blk)) == 0)) { /* duplicate block */ free(h_new); /* update the priority if needed */ if (h_iter->blk->priority < blk->priority) h_iter->blk->priority = blk->priority; /* try to save some memory */ free(blk->blks); blk->blks = h_iter->blk->blks; /* store the duplicate block */ b_iter = h_iter->blk; while (b_iter->hash_nxt != NULL) b_iter = b_iter->hash_nxt; b_iter->hash_nxt = blk; *blk_p = h_iter->blk; return 0; } else if (h_iter->blk->hash == h_val) { /* hash collision */ if ((h_val >> 32) == 0xffffffff) { /* overflow */ blk->hashed_flag = 0; blk->hash = 0; return -EFAULT; } h_val += ((uint64_t)1 << 32); h_new->blk->hash = h_val; /* restart at the beginning of the bucket */ h_iter = state->htbl[h_val & _BPF_HASH_MASK]; } else { /* no match, move along */ h_prev = h_iter; h_iter = h_iter->next; } } while (h_iter != NULL); h_prev->next = h_new; } else state->htbl[h_val & _BPF_HASH_MASK] = h_new; return 0; } /** * Remove an entry from the hash table * @param state the BPF state * @param h_val the hash value * * Remove an entry from the hash table and return it to the caller, NULL is * returned if the entry can not be found. * */ static struct bpf_blk *_hsh_remove(struct bpf_state *state, uint64_t h_val) { unsigned int bkt = h_val & _BPF_HASH_MASK; struct bpf_blk *blk; struct bpf_hash_bkt *h_iter, *h_prev = NULL; h_iter = state->htbl[bkt]; while (h_iter != NULL) { if (h_iter->blk->hash == h_val) { if (h_prev != NULL) h_prev->next = h_iter->next; else state->htbl[bkt] = h_iter->next; blk = h_iter->blk; free(h_iter); return blk; } h_prev = h_iter; h_iter = h_iter->next; } return NULL; } /** * Find and return a hash bucket * @param state the BPF state * @param h_val the hash value * * Find the entry associated with the given hash value and return it to the * caller, NULL is returned if the entry can not be found. This function * should not be called directly; use _hsh_find() and _hsh_find_once() instead. * */ static struct bpf_hash_bkt *_hsh_find_bkt(const struct bpf_state *state, uint64_t h_val) { struct bpf_hash_bkt *h_iter; h_iter = state->htbl[h_val & _BPF_HASH_MASK]; while (h_iter != NULL) { if (h_iter->blk->hash == h_val) return h_iter; h_iter = h_iter->next; } return NULL; } /** * Find and only return an entry in the hash table once * @param state the BPF state * @param h_val the hash value * * Find the entry associated with the given hash value and return it to the * caller if it has not be returned previously by this function; returns NULL * if the entry can not be found or has already been returned in a previous * call. * */ static struct bpf_blk *_hsh_find_once(const struct bpf_state *state, uint64_t h_val) { struct bpf_hash_bkt *h_iter; h_iter = _hsh_find_bkt(state, h_val); if (h_iter == NULL || h_iter->found != 0) return NULL; h_iter->found = 1; return h_iter->blk; } /** * Finds an entry in the hash table * @param state the BPF state * @param h_val the hash value * * Find the entry associated with the given hash value and return it to the * caller, NULL is returned if the entry can not be found. * */ static struct bpf_blk *_hsh_find(const struct bpf_state *state, uint64_t h_val) { struct bpf_hash_bkt *h_iter; h_iter = _hsh_find_bkt(state, h_val); if (h_iter == NULL) return NULL; return h_iter->blk; } /** * Generate a BPF action instruction * @param state the BPF state * @param blk the BPF instruction block, or NULL * @param action the desired action * * Generate a BPF action instruction and append it to the given instruction * block. Returns a pointer to the instruction block on success, NULL on * failure. * */ static struct bpf_blk *_gen_bpf_action(struct bpf_state *state, struct bpf_blk *blk, uint32_t action) { struct bpf_instr instr; _BPF_INSTR(instr, BPF_RET, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_K(action)); return _blk_append(state, blk, &instr); } /** * Generate a BPF action instruction and insert it into the hash table * @param state the BPF state * @param action the desired action * * Generate a BPF action instruction and insert it into the hash table. * Returns a pointer to the instruction block on success, NULL on failure. * */ static struct bpf_blk *_gen_bpf_action_hsh(struct bpf_state *state, uint32_t action) { struct bpf_blk *blk; blk = _gen_bpf_action(state, NULL, action); if (blk == NULL) return NULL; if (_hsh_add(state, &blk, 0) < 0) { _blk_free(state, blk); return NULL; } return blk; } /** * Generate a BPF instruction block for a given chain node * @param state the BPF state * @param node the filter chain node * @param a_state the accumulator state * * Generate BPF instructions to execute the filter for the given chain node. * Returns a pointer to the instruction block on success, NULL on failure. * */ static struct bpf_blk *_gen_bpf_node(struct bpf_state *state, const struct db_arg_chain_tree *node, struct acc_state *a_state) { int32_t acc_offset; uint32_t acc_mask; uint64_t act_t_hash = 0, act_f_hash = 0; struct bpf_blk *blk = NULL, *b_act; struct bpf_instr instr; /* generate the action blocks */ if (node->act_t_flg) { b_act = _gen_bpf_action_hsh(state, node->act_t); if (b_act == NULL) goto node_failure; act_t_hash = b_act->hash; } if (node->act_f_flg) { b_act = _gen_bpf_action_hsh(state, node->act_f); if (b_act == NULL) goto node_failure; act_f_hash = b_act->hash; } /* check the accumulator state */ acc_offset = node->arg_offset; acc_mask = node->mask; if (acc_offset < 0) goto node_failure; if ((acc_offset != a_state->offset) || ((acc_mask & a_state->mask) != acc_mask)) { /* reload the accumulator */ a_state->offset = acc_offset; a_state->mask = ARG_MASK_MAX; _BPF_INSTR(instr, BPF_LD+BPF_ABS, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_K(acc_offset)); blk = _blk_append(state, blk, &instr); if (blk == NULL) goto node_failure; } if (acc_mask != a_state->mask) { /* apply the bitmask */ a_state->mask = acc_mask; _BPF_INSTR(instr, BPF_ALU+BPF_AND, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_K(acc_mask)); blk = _blk_append(state, blk, &instr); if (blk == NULL) goto node_failure; } /* check the accumulator against the datum */ switch (node->op) { case SCMP_CMP_MASKED_EQ: case SCMP_CMP_EQ: _BPF_INSTR(instr, BPF_JMP+BPF_JEQ, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_K(node->datum)); break; case SCMP_CMP_GT: _BPF_INSTR(instr, BPF_JMP+BPF_JGT, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_K(node->datum)); break; case SCMP_CMP_GE: _BPF_INSTR(instr, BPF_JMP+BPF_JGE, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_K(node->datum)); break; case SCMP_CMP_NE: case SCMP_CMP_LT: case SCMP_CMP_LE: /* if we hit here it means the filter db isn't correct */ default: /* fatal error, we should never get here */ goto node_failure; } /* fixup the jump targets */ if (node->nxt_t != NULL) instr.jt = _BPF_JMP_DB(node->nxt_t); else if (node->act_t_flg) instr.jt = _BPF_JMP_HSH(act_t_hash); else instr.jt = _BPF_JMP_NXT; if (node->nxt_f != NULL) instr.jf = _BPF_JMP_DB(node->nxt_f); else if (node->act_f_flg) instr.jf = _BPF_JMP_HSH(act_f_hash); else instr.jf = _BPF_JMP_NXT; blk = _blk_append(state, blk, &instr); if (blk == NULL) goto node_failure; blk->node = node; return blk; node_failure: _blk_free(state, blk); return NULL; } /** * Generate a BPF instruction block for a given filter DB level * @param state the BPF state * @param sys the syscall filter DB node * @param node the filter DB node * @param next the filter node to fallthrough to at the end of the level * * Generate a BPF instruction block which executes the filter specified by the * given filter DB level. Returns a pointer to the instruction block on * success, NULL on failure. The given BPF block is free'd on failure. * */ static struct bpf_blk *_gen_bpf_chain_lvl(struct bpf_state *state, const struct db_sys_list *sys, const struct db_arg_chain_tree *node, struct bpf_blk *next) { struct bpf_blk *blk; struct bpf_blk *b_head = NULL, *b_prev = NULL, *b_next, *b_iter; struct bpf_instr *i_iter; const struct db_arg_chain_tree *l_iter; struct acc_state a_state = { -1, ARG_MASK_MAX }; struct bpf_jump def_jump; unsigned int iter; if (node == NULL) { blk = _gen_bpf_action(state, NULL, sys->action); if (blk == NULL) goto chain_lvl_failure; return blk; } /* find the starting node of the level */ l_iter = node; while (l_iter->lvl_prv != NULL) l_iter = l_iter->lvl_prv; /* build all of the blocks for this level */ do { blk = _gen_bpf_node(state, l_iter, &a_state); if (blk == NULL) goto chain_lvl_failure; if (b_head != NULL) { b_prev->next = blk; blk->prev = b_prev; } else b_head = blk; b_prev = blk; l_iter = l_iter->lvl_nxt; } while (l_iter != NULL); if (next != NULL) def_jump = _BPF_JMP_BLK(next); else def_jump = _BPF_JMP_HSH(state->def_hsh); /* resolve the TGT_NXT jumps */ b_iter = b_head; do { b_next = b_iter->next; for (iter = 0; iter < b_iter->blk_cnt; iter++) { i_iter = &b_iter->blks[iter]; if (i_iter->jt.type == TGT_NXT) i_iter->jt = (b_next == NULL ? def_jump : _BPF_JMP_BLK(b_next)); if (i_iter->jf.type == TGT_NXT) i_iter->jf = (b_next == NULL ? def_jump : _BPF_JMP_BLK(b_next)); } b_iter = b_next; } while (b_iter != NULL); return b_head; chain_lvl_failure: while (b_head != NULL) { b_iter = b_head; b_head = b_iter->next; _blk_free(state, b_iter); } return NULL; } /** * Resolve the jump targets in a BPF instruction block * @param state the BPF state * @param sys the syscall filter * @param blk the BPF instruction block * * Resolve the jump targets in a BPF instruction block generated by the * _gen_bpf_chain_lvl() function and adds the resulting block to the hash * table. Returns a pointer to the new instruction block on success, NULL on * failure. * */ static struct bpf_blk *_gen_bpf_chain_lvl_res(struct bpf_state *state, const struct db_sys_list *sys, struct bpf_blk *blk) { int rc; unsigned int iter; struct bpf_blk *b_new; struct bpf_instr *i_iter; struct db_arg_chain_tree *node; struct bpf_blk *next; if (blk->hashed_flag) return blk; if (state->arch->size == ARCH_SIZE_64 && blk->node != NULL && blk->node->arg_offset == arch_arg_offset_hi(state->arch, blk->node->arg)) next = blk->next; else next = NULL; /* convert TGT_PTR_DB to TGT_PTR_HSH references */ for (iter = 0; iter < blk->blk_cnt; iter++) { i_iter = &blk->blks[iter]; switch (i_iter->jt.type) { case TGT_NONE: case TGT_IMM: case TGT_PTR_HSH: /* ignore these jump types */ break; case TGT_PTR_BLK: b_new = _gen_bpf_chain_lvl_res(state, sys, i_iter->jt.tgt.ptr); if (b_new == NULL) return NULL; i_iter->jt = _BPF_JMP_HSH(b_new->hash); break; case TGT_PTR_DB: node = (struct db_arg_chain_tree *)i_iter->jt.tgt.ptr; b_new = _gen_bpf_chain(state, sys, node, next); if (b_new == NULL) return NULL; i_iter->jt = _BPF_JMP_HSH(b_new->hash); break; default: /* we should not be here */ return NULL; } switch (i_iter->jf.type) { case TGT_NONE: case TGT_IMM: case TGT_PTR_HSH: /* ignore these jump types */ break; case TGT_PTR_BLK: b_new = _gen_bpf_chain_lvl_res(state, sys, i_iter->jf.tgt.ptr); if (b_new == NULL) return NULL; i_iter->jf = _BPF_JMP_HSH(b_new->hash); break; case TGT_PTR_DB: node = (struct db_arg_chain_tree *)i_iter->jf.tgt.ptr; b_new = _gen_bpf_chain(state, sys, node, next); if (b_new == NULL) return NULL; i_iter->jf = _BPF_JMP_HSH(b_new->hash); break; default: /* we should not be here */ return NULL; } switch (i_iter->k.type) { case TGT_NONE: case TGT_K: case TGT_PTR_HSH: /* ignore these jump types */ break; case TGT_PTR_DB: node = (struct db_arg_chain_tree *)i_iter->k.tgt.ptr; b_new = _gen_bpf_chain(state, sys, node, NULL); if (b_new == NULL) return NULL; i_iter->k = _BPF_JMP_HSH(b_new->hash); break; default: /* we should not be here */ return NULL; } } /* insert the block into the hash table */ rc = _hsh_add(state, &blk, 0); if (rc < 0) return NULL; return blk; } /** * Generates the BPF instruction blocks for a given filter chain * @param state the BPF state * @param sys the syscall filter * @param chain the filter chain * @param next the filter node to fallthrough to at the end of the level * * Generate the BPF instruction blocks for the given filter chain and return * a pointer to the first block on success; returns NULL on failure. * */ static struct bpf_blk *_gen_bpf_chain(struct bpf_state *state, const struct db_sys_list *sys, const struct db_arg_chain_tree *chain, struct bpf_blk *next) { struct bpf_blk *blk; blk = _gen_bpf_chain_lvl(state, sys, chain, next); if (blk == NULL) return NULL; return _gen_bpf_chain_lvl_res(state, sys, blk); } /** * Generate the BPF instruction blocks for a given syscall * @param state the BPF state * @param sys the syscall filter DB entry * * Generate the BPF instruction blocks for the given syscall filter and return * a pointer to the first block on success; returns NULL on failure. * */ static struct bpf_blk *_gen_bpf_syscall(struct bpf_state *state, const struct db_sys_list *sys) { int rc; struct bpf_instr instr; struct bpf_blk *blk_c, *blk_s; /* generate the argument chains */ blk_c = _gen_bpf_chain(state, sys, sys->chains, NULL); if (blk_c == NULL) return NULL; /* syscall check (syscall number is still in the accumulator) */ _BPF_INSTR(instr, BPF_JMP+BPF_JEQ, _BPF_JMP_HSH(blk_c->hash), _BPF_JMP_NXT, _BPF_K(sys->num)); blk_s = _blk_append(state, NULL, &instr); if (blk_s == NULL) return NULL; blk_s->priority = sys->priority; rc = _hsh_add(state, &blk_s, 1); if (rc < 0) return NULL; return blk_s; } /** * Manage jumps to return instructions * @param state the BPF state * @param blk the instruction block to check * @param offset the instruction offset into the instruction block * @param blk_ret the return instruction block * * Using the given block and instruction offset, calculate the jump distance * between the jumping instruction and return instruction block. If the jump * distance is too great, duplicate the return instruction to reduce the * distance to the maximum value. Returns 1 if a long jump was added, zero if * the existing jump is valid, and negative values on failure. * */ static int _gen_bpf_build_jmp_ret(struct bpf_state *state, struct bpf_blk *blk, unsigned int offset, struct bpf_blk *blk_ret) { unsigned int j_len; uint64_t tgt_hash = blk_ret->hash; struct bpf_blk *b_jmp, *b_new; /* calculate the jump distance */ j_len = blk->blk_cnt - (offset + 1); b_jmp = blk->next; while (b_jmp != NULL && b_jmp != blk_ret && j_len < _BPF_JMP_MAX_RET) { j_len += b_jmp->blk_cnt; b_jmp = b_jmp->next; } if (j_len <= _BPF_JMP_MAX_RET && b_jmp == blk_ret) return 0; if (b_jmp == NULL) return -EFAULT; /* we need a closer return instruction, see if one already exists */ j_len = blk->blk_cnt - (offset + 1); b_jmp = blk->next; while (b_jmp != NULL && b_jmp->hash != tgt_hash && j_len < _BPF_JMP_MAX_RET) { j_len += b_jmp->blk_cnt; b_jmp = b_jmp->next; } if (j_len <= _BPF_JMP_MAX_RET && b_jmp->hash == tgt_hash) return 0; if (b_jmp == NULL) return -EFAULT; /* we need to insert a new return instruction - create one */ b_new = _gen_bpf_action(state, NULL, blk_ret->blks[0].k.tgt.imm_k); if (b_new == NULL) return -EFAULT; /* NOTE - we need to be careful here, we're giving the block a hash * value (this is a sneaky way to ensure we leverage the * inserted long jumps as much as possible) but we never add the * block to the hash table so it won't get cleaned up * automatically */ b_new->hash = tgt_hash; /* insert the jump after the current jumping block */ b_new->prev = blk; b_new->next = blk->next; blk->next->prev = b_new; blk->next = b_new; return 1; } /** * Manage jump lengths by duplicating and adding jumps if needed * @param state the BPF state * @param tail the tail of the instruction block list * @param blk the instruction block to check * @param offset the instruction offset into the instruction block * @param tgt_hash the hash of the jump destination block * * Using the given block and instruction offset, calculate the jump distance * between the jumping instruction and the destination. If the jump distance * is too great, add a long jump instruction to reduce the distance to a legal * value. Returns 1 if a new instruction was added, zero if the existing jump * is valid, and negative values on failure. * */ static int _gen_bpf_build_jmp(struct bpf_state *state, struct bpf_blk *tail, struct bpf_blk *blk, unsigned int offset, uint64_t tgt_hash) { int rc; unsigned int jmp_len; struct bpf_instr instr; struct bpf_blk *b_new, *b_jmp, *b_tgt; /* find the jump target */ b_tgt = tail; while (b_tgt != blk && b_tgt->hash != tgt_hash) b_tgt = b_tgt->prev; if (b_tgt == blk) return -EFAULT; if (b_tgt->blk_cnt == 1 && b_tgt->blks[0].op == BPF_RET) { rc = _gen_bpf_build_jmp_ret(state, blk, offset, b_tgt); if (rc == 1) return 1; else if (rc < 0) return rc; } /* calculate the jump distance */ jmp_len = blk->blk_cnt - (offset + 1); b_jmp = blk->next; while (b_jmp != NULL && b_jmp != b_tgt && jmp_len < _BPF_JMP_MAX) { jmp_len += b_jmp->blk_cnt; b_jmp = b_jmp->next; } if (jmp_len <= _BPF_JMP_MAX && b_jmp == b_tgt) return 0; if (b_jmp == NULL) return -EFAULT; /* we need a long jump, see if one already exists */ jmp_len = blk->blk_cnt - (offset + 1); b_jmp = blk->next; while (b_jmp != NULL && b_jmp->hash != tgt_hash && jmp_len < _BPF_JMP_MAX) { jmp_len += b_jmp->blk_cnt; b_jmp = b_jmp->next; } if (jmp_len <= _BPF_JMP_MAX && b_jmp->hash == tgt_hash) return 0; if (b_jmp == NULL) return -EFAULT; /* we need to insert a long jump - create one */ _BPF_INSTR(instr, BPF_JMP+BPF_JA, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_JMP_HSH(tgt_hash)); b_new = _blk_append(state, NULL, &instr); if (b_new == NULL) return -EFAULT; /* NOTE - we need to be careful here, we're giving the block a hash * value (this is a sneaky way to ensure we leverage the * inserted long jumps as much as possible) but we never add the * block to the hash table so it won't get cleaned up * automatically */ b_new->hash = tgt_hash; /* insert the jump after the current jumping block */ b_new->prev = blk; b_new->next = blk->next; blk->next->prev = b_new; blk->next = b_new; return 1; } /** * Generate the BPF program for the given filter DB * @param state the BPF state * @param db the filter DB * * Generate the BPF program for the given filter DB. Returns zero on success, * negative values on failure. * */ static int _gen_bpf_build_bpf(struct bpf_state *state, const struct db_filter *db) { int rc; int iter; uint64_t h_val; unsigned int res_cnt; unsigned int jmp_len; struct bpf_instr instr; struct bpf_instr *i_iter; struct db_sys_list *s_iter; struct bpf_blk *def_blk; struct bpf_blk *b_head = NULL, *b_tail = NULL, *b_iter, *b_new, *b_jmp; /* create the default action */ def_blk = _gen_bpf_action(state, NULL, state->attr->act_default); if (def_blk == NULL) return -ENOMEM; rc = _hsh_add(state, &def_blk, 1); if (rc < 0) return rc; state->def_hsh = def_blk->hash; /* create the syscall filters and add them to the top block group */ db_list_foreach(s_iter, db->syscalls) { if (s_iter->valid == 0) continue; /* build the syscall filter */ b_new = _gen_bpf_syscall(state, s_iter); if (b_new == NULL) return -ENOMEM; /* add the filter to the list, sorting based on priority */ if (b_head != NULL) { b_iter = b_head; do { if (b_new->priority > b_iter->priority) { if (b_iter == b_head) { b_new->next = b_head; b_head->prev = b_new; b_head = b_new; } else { b_iter->prev->next = b_new; b_new->prev = b_iter->prev; b_new->next = b_iter; b_iter->prev = b_new; } b_iter = NULL; } else { if (b_iter->next == NULL) { b_iter->next = b_new; b_new->prev = b_iter; b_iter = NULL; } else b_iter = b_iter->next; } } while (b_iter != NULL); if (b_tail->next != NULL) b_tail = b_tail->next; } else { b_head = b_new; b_tail = b_head; b_head->prev = NULL; b_head->next = NULL; } } /* tack on the default action to the end of the top block group */ if (b_tail != NULL) { b_tail->next = def_blk; def_blk->prev = b_tail; b_tail = def_blk; } else { b_head = def_blk; b_tail = b_head; } /* resolve any TGT_NXT jumps at the top level */ b_iter = b_head; do { b_jmp = b_iter->next; for (iter = 0; iter < b_iter->blk_cnt; iter++) { i_iter = &b_iter->blks[iter]; if (i_iter->jt.type == TGT_NXT) i_iter->jt = _BPF_JMP_HSH(b_jmp->hash); if (i_iter->jf.type == TGT_NXT) i_iter->jf = _BPF_JMP_HSH(b_jmp->hash); /* we shouldn't need to worry about a TGT_NXT in k */ } b_iter = b_iter->next; } while (b_iter != NULL && b_iter->next != NULL); /* pull in all of the TGT_PTR_HSH jumps, one layer at a time */ b_iter = b_tail; do { b_jmp = NULL; /* look for jumps - backwards (shorter jumps) */ for (iter = b_iter->blk_cnt - 1; iter >= 0; iter--) { i_iter = &b_iter->blks[iter]; if (i_iter->jt.type == TGT_PTR_HSH) b_jmp = _hsh_find_once(state, i_iter->jt.tgt.hash); if (b_jmp == NULL && i_iter->jf.type == TGT_PTR_HSH) b_jmp = _hsh_find_once(state, i_iter->jf.tgt.hash); if (b_jmp == NULL && i_iter->k.type == TGT_PTR_HSH) b_jmp = _hsh_find_once(state, i_iter->k.tgt.hash); if (b_jmp != NULL) { /* insert the new block after this block */ b_jmp->prev = b_iter; b_jmp->next = b_iter->next; b_iter->next = b_jmp; if (b_jmp->next) b_jmp->next->prev=b_jmp; break; } } if (b_jmp != NULL) { while (b_tail->next != NULL) b_tail = b_tail->next; b_iter = b_tail; } else b_iter = b_iter->prev; } while (b_iter != NULL); /* verify the architecture and kill ourselves if different */ _BPF_INSTR(instr, BPF_LD+BPF_ABS, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_K(offsetof(struct seccomp_data, arch))); rc = _bpf_append_instr(state->bpf, &instr); if (rc < 0) return rc; _BPF_INSTR(instr, BPF_JMP+BPF_JEQ, _BPF_JMP_IMM(1), _BPF_JMP_NO, _BPF_K(state->arch->token)); rc = _bpf_append_instr(state->bpf, &instr); if (rc < 0) return rc; _BPF_INSTR(instr, BPF_RET, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_K(state->attr->act_badarch)); rc = _bpf_append_instr(state->bpf, &instr); if (rc < 0) return rc; /* load the syscall into the accumulator */ _BPF_INSTR(instr, BPF_LD+BPF_ABS, _BPF_JMP_NO, _BPF_JMP_NO, _BPF_SYSCALL); rc = _bpf_append_instr(state->bpf, &instr); if (rc < 0) return rc; /* NOTE - from here to the end of the function we need to fail via the * the build_bpf_free_blks label, not just return an error; see * the _gen_bpf_build_jmp() function for details */ /* check for long jumps and insert if necessary, we also verify that * all our jump targets are valid at this point in the process */ b_iter = b_tail; do { res_cnt = 0; for (iter = b_iter->blk_cnt - 1; iter >= 0; iter--) { i_iter = &b_iter->blks[iter]; switch (i_iter->jt.type) { case TGT_NONE: case TGT_IMM: break; case TGT_PTR_HSH: h_val = i_iter->jt.tgt.hash; rc = _gen_bpf_build_jmp(state, b_tail, b_iter, iter, h_val); if (rc < 0) goto build_bpf_free_blks; res_cnt += rc; break; default: /* fatal error */ goto build_bpf_free_blks; } switch (i_iter->jf.type) { case TGT_NONE: case TGT_IMM: break; case TGT_PTR_HSH: h_val = i_iter->jf.tgt.hash; rc = _gen_bpf_build_jmp(state, b_tail, b_iter, iter, h_val); if (rc < 0) goto build_bpf_free_blks; res_cnt += rc; break; default: /* fatal error */ goto build_bpf_free_blks; } } if (res_cnt == 0) b_iter = b_iter->prev; } while (b_iter != NULL); /* build the bpf program */ do { b_iter = b_head; /* resolve the TGT_PTR_HSH jumps */ for (iter = 0; iter < b_iter->blk_cnt; iter++) { i_iter = &b_iter->blks[iter]; if (i_iter->jt.type == TGT_PTR_HSH) { h_val = i_iter->jt.tgt.hash; jmp_len = b_iter->blk_cnt - (iter + 1); b_jmp = b_iter->next; while (b_jmp != NULL && b_jmp->hash != h_val) { jmp_len += b_jmp->blk_cnt; b_jmp = b_jmp->next; } if (b_jmp == NULL || jmp_len > _BPF_JMP_MAX) goto build_bpf_free_blks; i_iter->jt = _BPF_JMP_IMM(jmp_len); } if (i_iter->jf.type == TGT_PTR_HSH) { h_val = i_iter->jf.tgt.hash; jmp_len = b_iter->blk_cnt - (iter + 1); b_jmp = b_iter->next; while (b_jmp != NULL && b_jmp->hash != h_val) { jmp_len += b_jmp->blk_cnt; b_jmp = b_jmp->next; } if (b_jmp == NULL || jmp_len > _BPF_JMP_MAX) goto build_bpf_free_blks; i_iter->jf = _BPF_JMP_IMM(jmp_len); } if (i_iter->k.type == TGT_PTR_HSH) { h_val = i_iter->k.tgt.hash; jmp_len = b_iter->blk_cnt - (iter + 1); b_jmp = b_tail; while (b_jmp->hash != h_val) b_jmp = b_jmp->prev; b_jmp = b_jmp->prev; while (b_jmp != b_iter) { jmp_len += b_jmp->blk_cnt; b_jmp = b_jmp->prev; } if (b_jmp == NULL) goto build_bpf_free_blks; i_iter->k = _BPF_K(jmp_len); } } /* build the bpf program */ if (_bpf_append_blk(state->bpf, b_iter) < 0) goto build_bpf_free_blks; /* we're done with the block, free it */ b_head = b_iter->next; _blk_free(state, b_iter); } while (b_head != NULL); return 0; build_bpf_free_blks: b_iter = b_head; while (b_iter != NULL) { b_jmp = b_iter->next; _hsh_remove(state, b_iter->hash); __blk_free(state, b_iter); b_iter = b_jmp; } return -EFAULT; } /** * Generate a BPF representation of the filter DB * @param db the seccomp filter DB * * This function generates a BPF representation of the given filter DB. * Returns a pointer to a valid bpf_program on success, NULL on failure. * */ struct bpf_program *gen_bpf_generate(const struct db_filter *db) { int rc; struct bpf_state state; memset(&state, 0, sizeof(state)); state.arch = db->arch; state.attr = &db->attr; state.bpf = malloc(sizeof(*(state.bpf))); if (state.bpf == NULL) return NULL; memset(state.bpf, 0, sizeof(*(state.bpf))); rc = _gen_bpf_build_bpf(&state, db); if (rc < 0) goto bpf_generate_end; bpf_generate_end: if (rc < 0) _state_release(&state); return state.bpf; } /** * Free memory associated with a BPF representation * @param fprog the BPF representation * * Free the memory associated with a BPF representation generated by the * gen_bpf_generate() function. * */ void gen_bpf_release(struct bpf_program *program) { _program_free(program); } libseccomp-0.1.0/src/arch.c0000644000000000000000000001064511741112152014177 0ustar rootroot/** * Enhanced Seccomp Architecture/Machine Specific Code * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include #include "arch.h" #include "arch-i386.h" #include "arch-x86_64.h" #include "system.h" const struct arch_def arch_def_native = { #if __i386__ .token = AUDIT_ARCH_I386, #elif __x86_64__ .token = AUDIT_ARCH_X86_64, #else #error the arch code needs to know about your machine type #endif /* machine type guess */ #if __BITS_PER_LONG == 32 .size = ARCH_SIZE_32, #elif __BITS_PER_LONG == 64 .size = ARCH_SIZE_64, #else .size = ARCH_SIZE_UNSPEC, #endif /* BITS_PER_LONG */ #if __BYTE_ORDER == __LITTLE_ENDIAN .endian = ARCH_ENDIAN_LITTLE, #elif __BYTE_ORDER == __BIG_ENDIAN .endian = ARCH_ENDIAN_BIG, #else .endian = ARCH_ENDIAN_UNSPEC, #endif /* __BYTE_ORDER */ }; /** * Determine the maximum number of syscall arguments * @param arch the architecture definition * * Determine the maximum number of syscall arguments for the given architecture. * Returns the number of arguments on success, negative values on failure. * */ int arch_arg_count_max(const struct arch_def *arch) { switch (arch->token) { case AUDIT_ARCH_I386: return i386_arg_count_max; case AUDIT_ARCH_X86_64: return x86_64_arg_count_max; default: return -EDOM; } } /** * Determine the argument offset for the lower 32 bits * @param arch the architecture definition * @param arg the argument number * * Determine the correct offset for the low 32 bits of the given argument based * on the architecture definition. Returns the offset on success, negative * values on failure. * */ int arch_arg_offset_lo(const struct arch_def *arch, unsigned int arg) { switch (arch->token) { case AUDIT_ARCH_X86_64: return x86_64_arg_offset_lo(arg); default: return -EDOM; } } /** * Determine the argument offset for the high 32 bits * @param arch the architecture definition * @param arg the argument number * * Determine the correct offset for the high 32 bits of the given argument * based on the architecture definition. Returns the offset on success, * negative values on failure. * */ int arch_arg_offset_hi(const struct arch_def *arch, unsigned int arg) { switch (arch->token) { case AUDIT_ARCH_X86_64: return x86_64_arg_offset_hi(arg); default: return -EDOM; } } /** * Rewrite a syscall value to match the architecture * @param arch the architecture definition * @param syscall the syscall number * * Syscalls can vary across different architectures so this function rewrites * the syscall into the correct value for the specified architecture. Returns * zero on success, negative values on failure. * */ int arch_syscall_rewrite(const struct arch_def *arch, int *syscall) { switch (arch->token) { case AUDIT_ARCH_I386: return i386_syscall_rewrite(arch, syscall); default: return -EDOM; } } /** * Rewrite a filter rule to match the architecture specifics * @param arch the architecture definition * @param strict strict flag * @param syscall the syscall number * @param chain the argument filter chain * * Syscalls can vary across different architectures so this function handles * the necessary seccomp rule rewrites to ensure the right thing is done * regardless of the rule or architecture. If @strict is true then the * function will fail if the entire filter can not be preservered, however, * if @strict is false the function will do a "best effort" rewrite and not * fail. Returns zero on success, negative values on failure. * */ int arch_filter_rewrite(const struct arch_def *arch, unsigned int strict, int *syscall, struct db_api_arg *chain) { switch (arch->token) { case AUDIT_ARCH_I386: return i386_filter_rewrite(arch, strict, syscall, chain); default: return -EDOM; } } libseccomp-0.1.0/src/hash.h0000644000000000000000000000126111716316743014222 0ustar rootroot/** * The "lookup3.c" Hash Implementation from Bob Jenkins * * Original Author: Bob Jenkins * Source: http://burtleburtle.net/bob/c/lookup3.c */ /* * Original License: * * These are functions for producing 32-bit hashes for hash table lookup. * hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final() * are externally useful functions. Routines to test the hash are included * if SELF_TEST is defined. You can use this free for any purpose. It's in * the public domain. It has no warranty. */ #ifndef _HASH_H #define _HASH_H #include uint32_t jhash(const void *key, size_t length, uint32_t initval); #endif libseccomp-0.1.0/src/gen_pfc.c0000644000000000000000000001555011742046555014701 0ustar rootroot/** * Seccomp Pseudo Filter Code (PFC) Generator * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include #include #include #include #include "arch.h" #include "db.h" #include "gen_pfc.h" struct pfc_sys_list { struct db_sys_list *sys; struct pfc_sys_list *next; }; /* XXX - we should check the fprintf() return values */ /** * Display a string representation of the node argument * @param fds the file stream to send the output * @param arch the architecture definition * @param node the node */ static void _pfc_arg(FILE *fds, const struct arch_def *arch, const struct db_arg_chain_tree *node) { if (arch->size == ARCH_SIZE_64) { if (arch_arg_offset_hi(arch, node->arg) == node->arg_offset) fprintf(fds, "$a%d.hi32", node->arg); else fprintf(fds, "$a%d.lo32", node->arg); } else fprintf(fds, "$a%d", node->arg); } /** * Display a string representation of the filter action * @param fds the file stream to send the output * @param action the action */ static void _pfc_action(FILE *fds, uint32_t action) { switch (action & 0xffff0000) { case SCMP_ACT_KILL: fprintf(fds, " action KILL;\n"); break; case SCMP_ACT_TRAP: fprintf(fds, " action TRAP;\n"); break; case SCMP_ACT_ERRNO(0): fprintf(fds, " action ERRNO(%u);\n", (action & 0x0000ffff)); break; case SCMP_ACT_TRACE(0): fprintf(fds, " action TRACE(%u);\n", (action & 0x0000ffff)); break; case SCMP_ACT_ALLOW: fprintf(fds, " action ALLOW;\n"); break; default: fprintf(fds, " action 0x%x;\n", action); } } /** * Indent the output stream * @param fds the file stream to send the output * @param lvl the indentation level * * This function indents the output stream with whitespace based on the * requested indentation level. */ static void _indent(FILE *fds, unsigned int lvl) { while (lvl-- > 0) fprintf(fds, " "); } /** * Generate the pseudo filter code for an argument chain * @param arch the architecture definition * @param node the head of the argument chain * @param lvl the indentation level * @param fds the file stream to send the output * * This function generates the pseudo filter code representation of the given * argument chain and writes it to the given output stream. * */ static void _gen_pfc_chain(const struct arch_def *arch, const struct db_arg_chain_tree *node, unsigned int lvl, FILE *fds) { const struct db_arg_chain_tree *c_iter; /* get to the start */ c_iter = node; while (c_iter->lvl_prv != NULL) c_iter = c_iter->lvl_prv; while (c_iter != NULL) { /* comparison operation */ _indent(fds, lvl); fprintf(fds, " if ("); _pfc_arg(fds, arch, c_iter); switch (c_iter->op) { case SCMP_CMP_EQ: fprintf(fds, " == "); break; case SCMP_CMP_GE: fprintf(fds, " >= "); break; case SCMP_CMP_GT: fprintf(fds, " > "); break; case SCMP_CMP_MASKED_EQ: fprintf(fds, " & 0x%.8x == ", c_iter->mask); break; default: fprintf(fds, " ??? "); } fprintf(fds, "%u)\n", c_iter->datum); /* true result */ if (c_iter->act_t_flg) { _indent(fds, lvl + 1); _pfc_action(fds, c_iter->act_t); } else if (c_iter->nxt_t != NULL) _gen_pfc_chain(arch, c_iter->nxt_t, lvl + 1, fds); /* false result */ if (c_iter->act_f_flg) { _indent(fds, lvl); fprintf(fds, " else\n"); _indent(fds, lvl + 1); _pfc_action(fds, c_iter->act_f); } else if (c_iter->nxt_f != NULL) { _indent(fds, lvl); fprintf(fds, " else\n"); _gen_pfc_chain(arch, c_iter->nxt_f, lvl + 1, fds); } c_iter = c_iter->lvl_nxt; } } /** * Generate pseudo filter code for a syscall * @param arch the architecture definition * @param sys the syscall filter * @param fds the file stream to send the output * * This function generates a pseduo filter code representation of the given * syscall filter and writes it to the given output stream. * */ static void _gen_pfc_syscall(const struct arch_def *arch, const struct db_sys_list *sys, FILE *fds) { unsigned int sys_num = sys->num; fprintf(fds, "# filter code for syscall #%d (priority: %d)\n", sys_num, sys->priority); if (sys->chains != NULL) { fprintf(fds, " if ($syscall != %d) goto syscal_%d_end;\n", sys_num, sys_num); _gen_pfc_chain(arch, sys->chains, 0, fds); fprintf(fds, " syscall_%d_end:\n", sys_num); } else { fprintf(fds, " if ($syscall == %d)", sys_num); _pfc_action(fds, sys->action); } } /** * Generate a pseudo filter code string representation * @param db the seccomp filter DB * @param fd the fd to send the output * * This function generates a pseudo filter code representation of the given * filter DB and writes it to the given fd. Returns zero on success, negative * values on failure. * */ int gen_pfc_generate(const struct db_filter *db, int fd) { int rc = 0; int newfd; FILE *fds; struct db_sys_list *s_iter; struct pfc_sys_list *p_iter = NULL, *p_new, *p_head = NULL, *p_prev; newfd = dup(fd); if (newfd < 0) return errno; fds = fdopen(newfd, "a"); if (fds == NULL) { close(newfd); return errno; } /* sort the syscall list */ db_list_foreach(s_iter, db->syscalls) { p_new = malloc(sizeof(*p_new)); if (p_new == NULL) { rc = -ENOMEM; goto generate_return; } memset(p_new, 0, sizeof(*p_new)); p_new->sys = s_iter; p_prev = NULL; p_iter = p_head; while (p_iter != NULL && s_iter->priority < p_iter->sys->priority) { p_prev = p_iter; p_iter = p_iter->next; } if (p_head == NULL) p_head = p_new; else if (p_prev == NULL) { p_new->next = p_head; p_head = p_new; } else { p_new->next = p_iter; p_prev->next = p_new; } } /* generate the pfc */ fprintf(fds, "#\n"); fprintf(fds, "# pseudo filter code start\n"); fprintf(fds, "#\n"); p_iter = p_head; while (p_iter != NULL) { if (p_iter->sys->valid == 0) continue; _gen_pfc_syscall(db->arch, p_iter->sys, fds); p_iter = p_iter->next; } fprintf(fds, "# default action\n"); _pfc_action(fds, db->attr.act_default); fprintf(fds, "#\n"); fprintf(fds, "# pseudo filter code end\n"); fprintf(fds, "#\n"); fflush(fds); fclose(fds); generate_return: while (p_head != NULL) { p_iter = p_head; p_head = p_head->next; free(p_iter); } return rc; } libseccomp-0.1.0/src/gen_bpf.h0000644000000000000000000000215211741112152014661 0ustar rootroot/** * Seccomp BPF Translator * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _TRANSLATOR_BPF_H #define _TRANSLATOR_BPF_H #include #include "arch.h" #include "db.h" #include "system.h" struct bpf_program { uint16_t blk_cnt; bpf_instr_raw *blks; }; #define BPF_PGM_SIZE(x) \ ((x)->blk_cnt * sizeof(*((x)->blks))) struct bpf_program *gen_bpf_generate(const struct db_filter *db); void gen_bpf_release(struct bpf_program *program); #endif libseccomp-0.1.0/src/arch.h0000644000000000000000000000366011741112152014203 0ustar rootroot/** * Enhanced Seccomp Architecture/Machine Specific Code * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _ARCH_H #define _ARCH_H #include #include #include #include "system.h" struct db_api_arg; struct arch_def { uint32_t token; enum { ARCH_SIZE_UNSPEC = 0, ARCH_SIZE_32 = 32, ARCH_SIZE_64 = 64, } size; enum { ARCH_ENDIAN_UNSPEC = 0, ARCH_ENDIAN_LITTLE, ARCH_ENDIAN_BIG, } endian; }; /* arch_def for the current process */ extern const struct arch_def arch_def_native; #define DATUM_MAX ((scmp_datum_t)-1) #define D64_LO(x) ((uint32_t)((uint64_t)(x) & 0x00000000ffffffff)) #define D64_HI(x) ((uint32_t)((uint64_t)(x) >> 32)) int arch_arg_count_max(const struct arch_def *arch); /** * Determine the argument offset * @param _arg the argument number * * Return the correct offset of the given argument. * */ #define arch_arg_offset(_arg) (offsetof(struct seccomp_data, args[_arg])) int arch_arg_offset_lo(const struct arch_def *arch, unsigned int arg); int arch_arg_offset_hi(const struct arch_def *arch, unsigned int arg); int arch_syscall_rewrite(const struct arch_def *arch, int *syscall); int arch_filter_rewrite(const struct arch_def *arch, unsigned int strict, int *syscall, struct db_api_arg *chain); #endif libseccomp-0.1.0/src/Makefile0000644000000000000000000000246411763743735014603 0ustar rootroot# # Enhanced Seccomp Library Makefile # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # # # macros # include ../macros.mk # # configuration # include $(TOPDIR)/version_info.mk include $(TOPDIR)/configure.mk include $(TOPDIR)/install.mk LIB_STATIC = libseccomp.a LIB_SHARED = libseccomp.so.$(VERSION_RELEASE) OBJS = \ api.o db.o \ arch.o arch-i386.o \ hash.o \ gen_pfc.o gen_bpf.o DEPS = $(OBJS:%.o=%.d) # # targets # .PHONY: all install clean all: $(LIB_STATIC) $(LIB_SHARED) -include $(DEPS) $(LIB_STATIC): $(OBJS) $(ARCHIVE) $(LIB_SHARED): $(OBJS) $(LINK_LIB) install: $(LIB_SHARED) $(INSTALL_LIB_MACRO) clean: $(RM) -f $(DEPS) $(OBJS) $(LIB_STATIC) $(LIB_SHARED) libseccomp-0.1.0/src/gen_pfc.h0000644000000000000000000000156211741112152014666 0ustar rootroot/** * Seccomp String Translator * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _TRANSLATOR_STR_H #define _TRANSLATOR_STR_H #include "db.h" int gen_pfc_generate(const struct db_filter *db, int fd); #endif libseccomp-0.1.0/src/arch-i386.c0000644000000000000000000000610611741112151014662 0ustar rootroot/** * Enhanced Seccomp i386 Specific Code * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include "arch.h" #include "arch-i386.h" /* i386 syscall numbers */ #define __i386_NR_socketcall 102 #define __i386_NR_ipc 117 /** * Rewrite a syscall value to match the architecture * @param arch the architecture definition * @param syscall the syscall number * * Syscalls can vary across different architectures so this function rewrites * the syscall into the correct value for the specified architecture. Returns * zero on success, negative values on failure. * */ int i386_syscall_rewrite(const struct arch_def *arch, int *syscall) { if ((*syscall) <= -100 && (*syscall) >= -117) *syscall = __i386_NR_socketcall; else if ((*syscall) <= -200 && (*syscall) >= -211) *syscall = __i386_NR_ipc; else if ((*syscall) < 0) return -EINVAL; return 0; } /** * Rewrite a filter rule to match the architecture specifics * @param arch the architecture definition * @param strict strict flag * @param syscall the syscall number * @param chain the argument filter chain * * Syscalls can vary across different architectures so this function handles * the necessary seccomp rule rewrites to ensure the right thing is done * regardless of the rule or architecture. If @strict is true then the * function will fail if the entire filter can not be preservered, however, * if @strict is false the function will do a "best effort" rewrite and not * fail. Returns zero on success, negative values on failure. * */ int i386_filter_rewrite(const struct arch_def *arch, unsigned int strict, int *syscall, struct db_api_arg *chain) { unsigned int iter; if ((*syscall) <= -100 && (*syscall) >= -117) { for (iter = 0; iter < i386_arg_count_max; iter++) { if (chain[iter].valid != 0) goto filter_rewrite_failure; } *syscall = __i386_NR_socketcall; chain[0].arg = 0; chain[0].op = SCMP_CMP_EQ; chain[0].datum = abs((*syscall) % 100); chain[0].valid = 1; } else if ((*syscall) <= -200 && (*syscall) >= -211) { for (iter = 0; iter < i386_arg_count_max; iter++) { if (chain[iter].valid != 0) goto filter_rewrite_failure; } *syscall = __i386_NR_ipc; chain[0].arg = 0; chain[0].op = SCMP_CMP_EQ; chain[0].datum = abs((*syscall) % 200); chain[0].valid = 1; } else if ((*syscall) < 0) return -EINVAL; return 0; filter_rewrite_failure: if (strict) return -EINVAL; return 0; } libseccomp-0.1.0/src/arch-x86_64.h0000644000000000000000000000177411741313504015147 0ustar rootroot/** * Enhanced Seccomp x86_64 Specific Code * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _ARCH_x86_64_H #define _ARCH_x86_64_H #include #include "arch.h" #include "system.h" #define x86_64_arg_count_max 6 #define x86_64_arg_offset_lo(x) (arch_arg_offset(x)) #define x86_64_arg_offset_hi(x) (arch_arg_offset(x) + 4) #endif libseccomp-0.1.0/src/system.h0000644000000000000000000000543411742100366014620 0ustar rootroot/** * Seccomp System Information * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _SYSTEM_H #define _SYSTEM_H #include #include #include #ifdef CONF_SYSINC_SECCOMP /* system header file */ #include #else /* NOTE: the definitions below were taken from the Linux Kernel sources */ #include /* Valid values for seccomp.mode and prctl(PR_SET_SECCOMP, ) */ #define SECCOMP_MODE_DISABLED 0 /* seccomp is not in use. */ #define SECCOMP_MODE_STRICT 1 /* uses hard-coded filter. */ #define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */ /* * All BPF programs must return a 32-bit value. * The bottom 16-bits are for optional return data. * The upper 16-bits are ordered from least permissive values to most. * * The ordering ensures that a min_t() over composed return values always * selects the least permissive choice. */ #define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */ #define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */ #define SECCOMP_RET_ERRNO 0x00050000U /* returns an errno */ #define SECCOMP_RET_TRACE 0x7ff00000U /* pass to a tracer or disallow */ #define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */ /* Masks for the return value sections. */ #define SECCOMP_RET_ACTION 0x7fff0000U #define SECCOMP_RET_DATA 0x0000ffffU /* * struct seccomp_data - the format the BPF program executes over. * @nr: the system call number * @arch: indicates system call convention as an AUDIT_ARCH_* value * as defined in . * @instruction_pointer: at the time of the system call. * @args: up to 6 system call arguments always stored as 64-bit values * regardless of the architecture. */ struct seccomp_data { int nr; __u32 arch; __u64 instruction_pointer; __u64 args[6]; }; #endif /* CONF_SYSINC_SECCOMP */ /* rename some of the socket filter types to make more sense */ typedef struct sock_filter bpf_instr_raw; #ifndef PR_SET_NO_NEW_PRIVS #define PR_SET_NO_NEW_PRIVS 38 #endif /* PR_SET_NO_NEW_PRIVS */ #ifndef PR_GET_NO_NEW_PRIVS #define PR_GET_NO_NEW_PRIVS 39 #endif /* PR_GET_NO_NEW_PRIVS */ #endif libseccomp-0.1.0/src/hash.c0000644000000000000000000006436011716316743014226 0ustar rootroot/* ------------------------------------------------------------------------------- lookup3.c, by Bob Jenkins, May 2006, Public Domain. These are functions for producing 32-bit hashes for hash table lookup. hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final() are externally useful functions. Routines to test the hash are included if SELF_TEST is defined. You can use this free for any purpose. It's in the public domain. It has no warranty. You probably want to use hashlittle(). hashlittle() and hashbig() hash byte arrays. hashlittle() is is faster than hashbig() on little-endian machines. Intel and AMD are little-endian machines. On second thought, you probably want hashlittle2(), which is identical to hashlittle() except it returns two 32-bit hashes for the price of one. You could implement hashbig2() if you wanted but I haven't bothered here. If you want to find a hash of, say, exactly 7 integers, do a = i1; b = i2; c = i3; mix(a,b,c); a += i4; b += i5; c += i6; mix(a,b,c); a += i7; final(a,b,c); then use c as the hash value. If you have a variable length array of 4-byte integers to hash, use hashword(). If you have a byte array (like a character string), use hashlittle(). If you have several byte arrays, or a mix of things, see the comments above hashlittle(). Why is this so big? I read 12 bytes at a time into 3 4-byte integers, then mix those integers. This is fast (you can do a lot more thorough mixing with 12*3 instructions on 3 integers than you can with 3 instructions on 1 byte), but shoehorning those bytes into integers efficiently is messy. ------------------------------------------------------------------------------- */ #include /* defines uint32_t etc */ #include /* attempt to define endianness */ #ifdef linux # include /* attempt to define endianness */ #endif #include "hash.h" #define hashlittle jhash /* * My best guess at if you are big-endian or little-endian. This may * need adjustment. */ #if (defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && \ __BYTE_ORDER == __LITTLE_ENDIAN) || \ (defined(i386) || defined(__i386__) || defined(__i486__) || \ defined(__i586__) || defined(__i686__) || defined(vax) || defined(MIPSEL)) # define HASH_LITTLE_ENDIAN 1 # define HASH_BIG_ENDIAN 0 #elif (defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && \ __BYTE_ORDER == __BIG_ENDIAN) || \ (defined(sparc) || defined(POWERPC) || defined(mc68000) || defined(sel)) # define HASH_LITTLE_ENDIAN 0 # define HASH_BIG_ENDIAN 1 #else # define HASH_LITTLE_ENDIAN 0 # define HASH_BIG_ENDIAN 0 #endif #define hashsize(n) ((uint32_t)1<<(n)) #define hashmask(n) (hashsize(n)-1) #define rot(x,k) (((x)<<(k)) | ((x)>>(32-(k)))) /* ------------------------------------------------------------------------------- mix -- mix 3 32-bit values reversibly. This is reversible, so any information in (a,b,c) before mix() is still in (a,b,c) after mix(). If four pairs of (a,b,c) inputs are run through mix(), or through mix() in reverse, there are at least 32 bits of the output that are sometimes the same for one pair and different for another pair. This was tested for: * pairs that differed by one bit, by two bits, in any combination of top bits of (a,b,c), or in any combination of bottom bits of (a,b,c). * "differ" is defined as +, -, ^, or ~^. For + and -, I transformed the output delta to a Gray code (a^(a>>1)) so a string of 1's (as is commonly produced by subtraction) look like a single 1-bit difference. * the base values were pseudorandom, all zero but one bit set, or all zero plus a counter that starts at zero. Some k values for my "a-=c; a^=rot(c,k); c+=b;" arrangement that satisfy this are 4 6 8 16 19 4 9 15 3 18 27 15 14 9 3 7 17 3 Well, "9 15 3 18 27 15" didn't quite get 32 bits diffing for "differ" defined as + with a one-bit base and a two-bit delta. I used http://burtleburtle.net/bob/hash/avalanche.html to choose the operations, constants, and arrangements of the variables. This does not achieve avalanche. There are input bits of (a,b,c) that fail to affect some output bits of (a,b,c), especially of a. The most thoroughly mixed value is c, but it doesn't really even achieve avalanche in c. This allows some parallelism. Read-after-writes are good at doubling the number of bits affected, so the goal of mixing pulls in the opposite direction as the goal of parallelism. I did what I could. Rotates seem to cost as much as shifts on every machine I could lay my hands on, and rotates are much kinder to the top and bottom bits, so I used rotates. ------------------------------------------------------------------------------- */ #define mix(a,b,c) \ { \ a -= c; a ^= rot(c, 4); c += b; \ b -= a; b ^= rot(a, 6); a += c; \ c -= b; c ^= rot(b, 8); b += a; \ a -= c; a ^= rot(c,16); c += b; \ b -= a; b ^= rot(a,19); a += c; \ c -= b; c ^= rot(b, 4); b += a; \ } /* ------------------------------------------------------------------------------- final -- final mixing of 3 32-bit values (a,b,c) into c Pairs of (a,b,c) values differing in only a few bits will usually produce values of c that look totally different. This was tested for * pairs that differed by one bit, by two bits, in any combination of top bits of (a,b,c), or in any combination of bottom bits of (a,b,c). * "differ" is defined as +, -, ^, or ~^. For + and -, I transformed the output delta to a Gray code (a^(a>>1)) so a string of 1's (as is commonly produced by subtraction) look like a single 1-bit difference. * the base values were pseudorandom, all zero but one bit set, or all zero plus a counter that starts at zero. These constants passed: 14 11 25 16 4 14 24 12 14 25 16 4 14 24 and these came close: 4 8 15 26 3 22 24 10 8 15 26 3 22 24 11 8 15 26 3 22 24 ------------------------------------------------------------------------------- */ #define final(a,b,c) \ { \ c ^= b; c -= rot(b,14); \ a ^= c; a -= rot(c,11); \ b ^= a; b -= rot(a,25); \ c ^= b; c -= rot(b,16); \ a ^= c; a -= rot(c,4); \ b ^= a; b -= rot(a,14); \ c ^= b; c -= rot(b,24); \ } /* -------------------------------------------------------------------- This works on all machines. To be useful, it requires -- that the key be an array of uint32_t's, and -- that the length be the number of uint32_t's in the key The function hashword() is identical to hashlittle() on little-endian machines, and identical to hashbig() on big-endian machines, except that the length has to be measured in uint32_ts rather than in bytes. hashlittle() is more complicated than hashword() only because hashlittle() has to dance around fitting the key bytes into registers. -------------------------------------------------------------------- */ uint32_t hashword( const uint32_t *k, /* the key, an array of uint32_t values */ size_t length, /* the length of the key, in uint32_ts */ uint32_t initval) /* the previous hash, or an arbitrary value */ { uint32_t a,b,c; /* Set up the internal state */ a = b = c = 0xdeadbeef + (((uint32_t)length)<<2) + initval; /*------------------------------------------------- handle most of the key */ while (length > 3) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 3; k += 3; } /*------------------------------------------- handle the last 3 uint32_t's */ switch(length) /* all the case statements fall through */ { case 3 : c+=k[2]; case 2 : b+=k[1]; case 1 : a+=k[0]; final(a,b,c); case 0: /* case 0: nothing left to add */ break; } /*------------------------------------------------------ report the result */ return c; } /* -------------------------------------------------------------------- hashword2() -- same as hashword(), but take two seeds and return two 32-bit values. pc and pb must both be nonnull, and *pc and *pb must both be initialized with seeds. If you pass in (*pb)==0, the output (*pc) will be the same as the return value from hashword(). -------------------------------------------------------------------- */ void hashword2 ( const uint32_t *k, /* the key, an array of uint32_t values */ size_t length, /* the length of the key, in uint32_ts */ uint32_t *pc, /* IN: seed OUT: primary hash value */ uint32_t *pb) /* IN: more seed OUT: secondary hash value */ { uint32_t a,b,c; /* Set up the internal state */ a = b = c = 0xdeadbeef + ((uint32_t)(length<<2)) + *pc; c += *pb; /*------------------------------------------------- handle most of the key */ while (length > 3) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 3; k += 3; } /*------------------------------------------- handle the last 3 uint32_t's */ switch(length) /* all the case statements fall through */ { case 3 : c+=k[2]; case 2 : b+=k[1]; case 1 : a+=k[0]; final(a,b,c); case 0: /* case 0: nothing left to add */ break; } /*------------------------------------------------------ report the result */ *pc=c; *pb=b; } /* ------------------------------------------------------------------------------- hashlittle() -- hash a variable-length key into a 32-bit value k : the key (the unaligned variable-length array of bytes) length : the length of the key, counting by bytes initval : can be any 4-byte value Returns a 32-bit value. Every bit of the key affects every bit of the return value. Two keys differing by one or two bits will have totally different hash values. The best hash table sizes are powers of 2. There is no need to do mod a prime (mod is sooo slow!). If you need less than 32 bits, use a bitmask. For example, if you need only 10 bits, do h = (h & hashmask(10)); In which case, the hash table should have hashsize(10) elements. If you are hashing n strings (uint8_t **)k, do it like this: for (i=0, h=0; i 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * "k[2]&0xffffff" actually reads beyond the end of the string, but * then masks off the part it's not allowed to read. Because the * string is aligned, the masked-off tail is in the same word as the * rest of the string. Every machine with memory protection I've seen * does it on word boundaries, so is OK with this. But VALGRIND will * still catch it and complain. The masking trick does make the hash * noticably faster for short strings (like English words). */ #ifndef VALGRIND switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break; case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break; case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break; case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=k[1]&0xffffff; a+=k[0]; break; case 6 : b+=k[1]&0xffff; a+=k[0]; break; case 5 : b+=k[1]&0xff; a+=k[0]; break; case 4 : a+=k[0]; break; case 3 : a+=k[0]&0xffffff; break; case 2 : a+=k[0]&0xffff; break; case 1 : a+=k[0]&0xff; break; case 0 : return c; /* zero length strings require no mixing */ } #else /* make valgrind happy */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=((uint32_t)k8[9])<<8; /* fall through */ case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<8; /* fall through */ case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<8; /* fall through */ case 1 : a+=k8[0]; break; case 0 : return c; } #endif /* !valgrind */ } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) { const uint16_t *k = (const uint16_t *)key; /* read 16-bit chunks */ const uint8_t *k8; /*--------------- all but last block: aligned reads and different mixing */ while (length > 12) { a += k[0] + (((uint32_t)k[1])<<16); b += k[2] + (((uint32_t)k[3])<<16); c += k[4] + (((uint32_t)k[5])<<16); mix(a,b,c); length -= 12; k += 6; } /*----------------------------- handle the last (probably partial) block */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[4]+(((uint32_t)k[5])<<16); b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=k[4]; b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=k[2]; a+=k[0]+(((uint32_t)k[1])<<16); break; case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]+(((uint32_t)k[1])<<16); break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=k[0]; break; case 1 : a+=k8[0]; break; case 0 : return c; /* zero length requires no mixing */ } } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; a += ((uint32_t)k[1])<<8; a += ((uint32_t)k[2])<<16; a += ((uint32_t)k[3])<<24; b += k[4]; b += ((uint32_t)k[5])<<8; b += ((uint32_t)k[6])<<16; b += ((uint32_t)k[7])<<24; c += k[8]; c += ((uint32_t)k[9])<<8; c += ((uint32_t)k[10])<<16; c += ((uint32_t)k[11])<<24; mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=((uint32_t)k[11])<<24; case 11: c+=((uint32_t)k[10])<<16; case 10: c+=((uint32_t)k[9])<<8; case 9 : c+=k[8]; case 8 : b+=((uint32_t)k[7])<<24; case 7 : b+=((uint32_t)k[6])<<16; case 6 : b+=((uint32_t)k[5])<<8; case 5 : b+=k[4]; case 4 : a+=((uint32_t)k[3])<<24; case 3 : a+=((uint32_t)k[2])<<16; case 2 : a+=((uint32_t)k[1])<<8; case 1 : a+=k[0]; break; case 0 : return c; } } final(a,b,c); return c; } /* * hashlittle2: return 2 32-bit hash values * * This is identical to hashlittle(), except it returns two 32-bit hash * values instead of just one. This is good enough for hash table * lookup with 2^^64 buckets, or if you want a second hash if you're not * happy with the first, or if you want a probably-unique 64-bit ID for * the key. *pc is better mixed than *pb, so use *pc first. If you want * a 64-bit value do something like "*pc + (((uint64_t)*pb)<<32)". */ void hashlittle2( const void *key, /* the key to hash */ size_t length, /* length of the key */ uint32_t *pc, /* IN: primary initval, OUT: primary hash */ uint32_t *pb) /* IN: secondary initval, OUT: secondary hash */ { uint32_t a,b,c; /* internal state */ union { const void *ptr; size_t i; } u; /* needed for Mac Powerbook G4 */ /* Set up the internal state */ a = b = c = 0xdeadbeef + ((uint32_t)length) + *pc; c += *pb; u.ptr = key; if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) { const uint32_t *k = (const uint32_t *)key; /* read 32-bit chunks */ /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * "k[2]&0xffffff" actually reads beyond the end of the string, but * then masks off the part it's not allowed to read. Because the * string is aligned, the masked-off tail is in the same word as the * rest of the string. Every machine with memory protection I've seen * does it on word boundaries, so is OK with this. But VALGRIND will * still catch it and complain. The masking trick does make the hash * noticably faster for short strings (like English words). */ #ifndef VALGRIND switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break; case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break; case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break; case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=k[1]&0xffffff; a+=k[0]; break; case 6 : b+=k[1]&0xffff; a+=k[0]; break; case 5 : b+=k[1]&0xff; a+=k[0]; break; case 4 : a+=k[0]; break; case 3 : a+=k[0]&0xffffff; break; case 2 : a+=k[0]&0xffff; break; case 1 : a+=k[0]&0xff; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } #else /* make valgrind happy */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=((uint32_t)k8[9])<<8; /* fall through */ case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<8; /* fall through */ case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<8; /* fall through */ case 1 : a+=k8[0]; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } #endif /* !valgrind */ } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) { const uint16_t *k = (const uint16_t *)key; /* read 16-bit chunks */ const uint8_t *k8; /*--------------- all but last block: aligned reads and different mixing */ while (length > 12) { a += k[0] + (((uint32_t)k[1])<<16); b += k[2] + (((uint32_t)k[3])<<16); c += k[4] + (((uint32_t)k[5])<<16); mix(a,b,c); length -= 12; k += 6; } /*----------------------------- handle the last (probably partial) block */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[4]+(((uint32_t)k[5])<<16); b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=k[4]; b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=k[2]; a+=k[0]+(((uint32_t)k[1])<<16); break; case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]+(((uint32_t)k[1])<<16); break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=k[0]; break; case 1 : a+=k8[0]; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; a += ((uint32_t)k[1])<<8; a += ((uint32_t)k[2])<<16; a += ((uint32_t)k[3])<<24; b += k[4]; b += ((uint32_t)k[5])<<8; b += ((uint32_t)k[6])<<16; b += ((uint32_t)k[7])<<24; c += k[8]; c += ((uint32_t)k[9])<<8; c += ((uint32_t)k[10])<<16; c += ((uint32_t)k[11])<<24; mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=((uint32_t)k[11])<<24; case 11: c+=((uint32_t)k[10])<<16; case 10: c+=((uint32_t)k[9])<<8; case 9 : c+=k[8]; case 8 : b+=((uint32_t)k[7])<<24; case 7 : b+=((uint32_t)k[6])<<16; case 6 : b+=((uint32_t)k[5])<<8; case 5 : b+=k[4]; case 4 : a+=((uint32_t)k[3])<<24; case 3 : a+=((uint32_t)k[2])<<16; case 2 : a+=((uint32_t)k[1])<<8; case 1 : a+=k[0]; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } } final(a,b,c); *pc=c; *pb=b; } /* * hashbig(): * This is the same as hashword() on big-endian machines. It is different * from hashlittle() on all machines. hashbig() takes advantage of * big-endian byte ordering. */ uint32_t hashbig( const void *key, size_t length, uint32_t initval) { uint32_t a,b,c; union { const void *ptr; size_t i; } u; /* to cast key to (size_t) happily */ /* Set up the internal state */ a = b = c = 0xdeadbeef + ((uint32_t)length) + initval; u.ptr = key; if (HASH_BIG_ENDIAN && ((u.i & 0x3) == 0)) { const uint32_t *k = (const uint32_t *)key; /* read 32-bit chunks */ /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * "k[2]<<8" actually reads beyond the end of the string, but * then shifts out the part it's not allowed to read. Because the * string is aligned, the illegal read is in the same word as the * rest of the string. Every machine with memory protection I've seen * does it on word boundaries, so is OK with this. But VALGRIND will * still catch it and complain. The masking trick does make the hash * noticably faster for short strings (like English words). */ #ifndef VALGRIND switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=k[2]&0xffffff00; b+=k[1]; a+=k[0]; break; case 10: c+=k[2]&0xffff0000; b+=k[1]; a+=k[0]; break; case 9 : c+=k[2]&0xff000000; b+=k[1]; a+=k[0]; break; case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=k[1]&0xffffff00; a+=k[0]; break; case 6 : b+=k[1]&0xffff0000; a+=k[0]; break; case 5 : b+=k[1]&0xff000000; a+=k[0]; break; case 4 : a+=k[0]; break; case 3 : a+=k[0]&0xffffff00; break; case 2 : a+=k[0]&0xffff0000; break; case 1 : a+=k[0]&0xff000000; break; case 0 : return c; /* zero length strings require no mixing */ } #else /* make valgrind happy */ k8 = (const uint8_t *)k; switch(length) /* all the case statements fall through */ { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<8; /* fall through */ case 10: c+=((uint32_t)k8[9])<<16; /* fall through */ case 9 : c+=((uint32_t)k8[8])<<24; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<8; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<16; /* fall through */ case 5 : b+=((uint32_t)k8[4])<<24; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<8; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<16; /* fall through */ case 1 : a+=((uint32_t)k8[0])<<24; break; case 0 : return c; } #endif /* !VALGRIND */ } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += ((uint32_t)k[0])<<24; a += ((uint32_t)k[1])<<16; a += ((uint32_t)k[2])<<8; a += ((uint32_t)k[3]); b += ((uint32_t)k[4])<<24; b += ((uint32_t)k[5])<<16; b += ((uint32_t)k[6])<<8; b += ((uint32_t)k[7]); c += ((uint32_t)k[8])<<24; c += ((uint32_t)k[9])<<16; c += ((uint32_t)k[10])<<8; c += ((uint32_t)k[11]); mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=k[11]; case 11: c+=((uint32_t)k[10])<<8; case 10: c+=((uint32_t)k[9])<<16; case 9 : c+=((uint32_t)k[8])<<24; case 8 : b+=k[7]; case 7 : b+=((uint32_t)k[6])<<8; case 6 : b+=((uint32_t)k[5])<<16; case 5 : b+=((uint32_t)k[4])<<24; case 4 : a+=k[3]; case 3 : a+=((uint32_t)k[2])<<8; case 2 : a+=((uint32_t)k[1])<<16; case 1 : a+=((uint32_t)k[0])<<24; break; case 0 : return c; } } final(a,b,c); return c; } libseccomp-0.1.0/src/arch-i386.h0000644000000000000000000000207411741112152014670 0ustar rootroot/** * Enhanced Seccomp i386 Specific Code * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _ARCH_i386_H #define _ARCH_i386_H #include "arch.h" #include "db.h" #include "system.h" #define i386_arg_count_max 6 int i386_syscall_rewrite(const struct arch_def *arch, int *syscall); int i386_filter_rewrite(const struct arch_def *arch, unsigned int strict, int *syscall, struct db_api_arg *chain); #endif libseccomp-0.1.0/src/api.c0000644000000000000000000001614111746233754014051 0ustar rootroot/** * Seccomp Library API * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include #include #include #include #include #include #include "arch.h" #include "db.h" #include "gen_pfc.h" #include "gen_bpf.h" #include "system.h" /* the underlying code supports multiple simultaneous seccomp filters, but in * practice we really only need one per-process right now, and this is it */ static struct db_filter *filter = NULL; /* NOTE - function header comment in include/seccomp.h */ int seccomp_init(uint32_t def_action) { int rc; rc = db_action_valid(def_action); if (rc < 0) return rc; if (filter != NULL) return -EEXIST; filter = db_init(&arch_def_native, def_action); return (filter ? 0 : -ENOMEM); } /* NOTE - function header comment in include/seccomp.h */ int seccomp_reset(uint32_t def_action) { if (filter != NULL) db_release(filter); return seccomp_init(def_action); } /* NOTE - function header comment in include/seccomp.h */ void seccomp_release(void) { if (filter == NULL) return; db_release(filter); filter = NULL; } /* NOTE - function header comment in include/seccomp.h */ int seccomp_load(void) { int rc; struct bpf_program *program; if (filter == NULL) return -EFAULT; program = gen_bpf_generate(filter); if (program == NULL) return -ENOMEM; /* attempt to set NO_NEW_PRIVS but don't fail if it doesn't work */ if (filter->attr.nnp_enable) { rc = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); if (rc < 0) return -errno; } /* load the filter into the kernel */ rc = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, program); gen_bpf_release(program); if (rc < 0) return -errno; return 0; } /* NOTE - function header comment in include/seccomp.h */ int seccomp_attr_get(enum scmp_filter_attr attr, uint32_t *value) { if (filter == NULL) return -EFAULT; return db_attr_get(filter, attr, value); } /* NOTE - function header comment in include/seccomp.h */ int seccomp_attr_set(enum scmp_filter_attr attr, uint32_t value) { if (filter == NULL) return -EFAULT; return db_attr_set(filter, attr, value); } /* NOTE - function header comment in include/seccomp.h */ int seccomp_syscall_priority(int syscall, uint8_t priority) { int rc; if (filter == NULL) return -EFAULT; /* if this is a pseudo syscall (syscall < 0) then we need to rewrite * the syscall for some arch specific reason */ if (syscall < 0) { rc = arch_syscall_rewrite(filter->arch, &syscall); if (rc < 0) return rc; } return db_syscall_priority(filter, syscall, priority); } /** * Add a new rule to the current filter * @param strict the strict flag * @param action the filter action * @param syscall the syscall number * @param arg_cnt the number of argument filters in the argument filter chain * @param arg_list the argument filter chain, (uint, enum scmp_compare, ulong) * * This function adds a new argument/comparison/value to the seccomp filter for * a syscall; multiple arguments can be specified and they will be chained * together (essentially AND'd together) in the filter. When the strict flag * is true the function will fail if the exact rule can not be added to the * filter, if the strict flag is false the function will not fail if the * function needs to adjust the rule due to architecture specifics. Returns * zero on success, negative values on failure. * */ static int _seccomp_rule_add(unsigned int strict, uint32_t action, int syscall, unsigned int arg_cnt, va_list arg_list) { int rc; unsigned int iter; unsigned int chain_len_max; unsigned int arg_num; struct db_api_arg *chain = NULL; struct scmp_arg_cmp arg_data; if (filter == NULL) return -EFAULT; rc = db_action_valid(action); if (rc < 0) return rc; if (action == filter->attr.act_default) return -EPERM; /* collect the arguments for the filter rule */ chain_len_max = arch_arg_count_max(filter->arch); chain = malloc(sizeof(*chain) * chain_len_max); if (chain == NULL) return -ENOMEM; memset(chain, 0, sizeof(*chain) * chain_len_max); for (iter = 0; iter < arg_cnt; iter++) { arg_data = va_arg(arg_list, struct scmp_arg_cmp); arg_num = arg_data.arg; if (arg_num < chain_len_max && chain[arg_num].valid == 0) { chain[arg_num].valid = 1; chain[arg_num].arg = arg_num; chain[arg_num].op = arg_data.op; /* XXX - we should check datum/mask size against the * arch definition, e.g. 64 bit datum on x86 */ switch (chain[arg_num].op) { case SCMP_CMP_NE: case SCMP_CMP_LT: case SCMP_CMP_LE: case SCMP_CMP_EQ: case SCMP_CMP_GE: case SCMP_CMP_GT: chain[arg_num].mask = DATUM_MAX; chain[arg_num].datum = arg_data.datum_a; break; case SCMP_CMP_MASKED_EQ: chain[arg_num].mask = arg_data.datum_a; chain[arg_num].datum = arg_data.datum_b; break; default: rc = -EINVAL; goto rule_add_return; } } else { rc = -EINVAL; goto rule_add_return; } } /* if this is a pseudo syscall (syscall < 0) then we need to rewrite * the rule for some arch specific reason */ if (syscall < 0) { rc = arch_filter_rewrite(filter->arch, strict, &syscall, chain); if (rc < 0) goto rule_add_return; } /* add the new rule to the existing filter */ rc = db_rule_add(filter, action, syscall, chain); rule_add_return: if (chain != NULL) free(chain); return rc; } /* NOTE - function header comment in include/seccomp.h */ int seccomp_rule_add(uint32_t action, int syscall, unsigned int arg_cnt, ...) { int rc; va_list arg_list; va_start(arg_list, arg_cnt); rc = _seccomp_rule_add(0, action, syscall, arg_cnt, arg_list); va_end(arg_list); return rc; } /* NOTE - function header comment in include/seccomp.h */ int seccomp_rule_add_exact(uint32_t action, int syscall, unsigned int arg_cnt, ...) { int rc; va_list arg_list; va_start(arg_list, arg_cnt); rc = _seccomp_rule_add(1, action, syscall, arg_cnt, arg_list); va_end(arg_list); return rc; } /* NOTE - function header comment in include/seccomp.h */ int seccomp_export_pfc(int fd) { if (filter == NULL) return -EFAULT; return gen_pfc_generate(filter, fd); } /* NOTE - function header comment in include/seccomp.h */ int seccomp_export_bpf(int fd) { int rc; struct bpf_program *program; if (filter == NULL) return -EFAULT; program = gen_bpf_generate(filter); if (program == NULL) return -ENOMEM; rc = write(fd, program->blks, BPF_PGM_SIZE(program)); gen_bpf_release(program); if (rc < 0) return -errno; return 0; } libseccomp-0.1.0/src/db.h0000644000000000000000000001120511743036476013665 0ustar rootroot/** * Enhanced Seccomp Filter DB * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _FILTER_DB_H #define _FILTER_DB_H #include "inttypes.h" #include #include "arch.h" /* XXX - need to provide doxygen comments for the types here */ struct db_api_arg { unsigned int valid; unsigned int arg; unsigned int op; scmp_datum_t mask; scmp_datum_t datum; }; struct db_arg_chain_tree { /* argument number (a0 = 0, a1 = 1, etc.) */ unsigned int arg; /* argument bpf offset */ unsigned int arg_offset; /* comparison operator */ enum scmp_compare op; /* syscall argument value */ uint32_t mask; uint32_t datum; /* actions */ unsigned int act_t_flg; uint32_t act_t; unsigned int act_f_flg; uint32_t act_f; /* list of nodes on this level */ struct db_arg_chain_tree *lvl_prv, *lvl_nxt; /* next node in the chain */ struct db_arg_chain_tree *nxt_t; struct db_arg_chain_tree *nxt_f; unsigned int refcnt; }; #define ARG_MASK_MAX ((uint32_t)-1) #define db_chain_lt(x,y) \ (((x)->arg < (y)->arg) || \ (((x)->arg == (y)->arg) && (((x)->op < (y)->op) || \ (((x)->mask & (y)->mask) == (y)->mask)))) #define db_chain_eq(x,y) \ (((x)->arg == (y)->arg) && \ ((x)->op == (y)->op) && ((x)->datum == (y)->datum) && \ ((x)->mask == (y)->mask)) #define db_chain_gt(x,y) \ (((x)->arg > (y)->arg) || \ (((x)->arg == (y)->arg) && (((x)->op > (y)->op) || \ (((x)->mask & (y)->mask) != (y)->mask)))) #define db_chain_leaf(x) \ (((x)->act_t_flg != 0) || ((x)->act_f_flg != 0)) #define db_chain_zombie(x) \ (((x)->nxt_t == NULL) && ((x)->nxt_f == NULL) && \ ((x)->act_t_flg == 0) && ((x)->act_f_flg == 0)) #define db_chain_one_nxt(x) \ (((x)->nxt_t != NULL && (x)->nxt_f == NULL) || \ ((x)->nxt_t == NULL && (x)->nxt_f != NULL)) #define db_chain_one_action(x) \ ((x)->act_t_flg != (x)->act_f_flg) #define db_chain_one_result(x) \ (db_chain_one_nxt(x) != db_chain_one_action(x)) #define db_chain_eq_result(x,y) \ ((((x)->nxt_t != NULL && (y)->nxt_t != NULL) || \ ((x)->nxt_t == NULL && (y)->nxt_t == NULL)) && \ (((x)->nxt_f != NULL && (y)->nxt_f != NULL) || \ ((x)->nxt_f == NULL && (y)->nxt_f == NULL)) && \ ((x)->act_t_flg == (y)->act_t_flg) && \ ((x)->act_f_flg == (y)->act_f_flg) && \ (((x)->act_t_flg && (x)->act_t == (y)->act_t) || \ (!((x)->act_t_flg))) && \ (((x)->act_f_flg && (x)->act_f == (y)->act_f) || \ (!((x)->act_f_flg)))) struct db_sys_list { /* native syscall number */ unsigned int num; unsigned int valid; /* priority - higher is better */ unsigned int priority; /* the argument chain heads */ struct db_arg_chain_tree *chains; unsigned int node_cnt; /* action in the case of no argument chains */ uint32_t action; struct db_sys_list *next; }; struct db_filter_attr { /* action to take if we don't match an explicit allow/deny */ uint32_t act_default; /* action to take if we don't match the architecture */ uint32_t act_badarch; /* NO_NEW_PRIVS related attributes */ uint32_t nnp_enable; }; struct db_filter { /* target architecture */ const struct arch_def *arch; /* attributes */ struct db_filter_attr attr; /* syscall filters, kept as a sorted single-linked list */ struct db_sys_list *syscalls; }; /** * Iterate over each item in the DB list * @param iter the iterator * @param list the list * * This macro acts as for()/while() conditional and iterates the following * statement for each item in the given list. * */ #define db_list_foreach(iter,list) \ for (iter = (list); iter != NULL; iter = iter->next) int db_action_valid(uint32_t action); struct db_filter *db_init(const struct arch_def *arch, uint32_t def_action); void db_release(struct db_filter *db); int db_attr_get(struct db_filter *db, enum scmp_filter_attr attr, uint32_t *value); int db_attr_set(struct db_filter *db, enum scmp_filter_attr attr, uint32_t value); int db_syscall_priority(struct db_filter *db, unsigned int syscall, uint8_t priority); int db_rule_add(struct db_filter *db, uint32_t action, unsigned int syscall, struct db_api_arg *chain); #endif libseccomp-0.1.0/src/db.c0000644000000000000000000006365011743036476013673 0ustar rootroot/** * Enhanced Seccomp Filter DB * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #include #include #include #include #include #include #include #include "arch.h" #include "db.h" /* the priority field is fairly simple - without any user hints, or in the case * of a hint "tie", we give higher priority to syscalls with less chain nodes * (filter is easier to evaluate) */ #define _DB_PRI_MASK_CHAIN 0x0000FFFF #define _DB_PRI_MASK_USER 0x00FF0000 #define _DB_PRI_USER(x) (((x) << 16) & _DB_PRI_MASK_USER) static unsigned int _db_tree_free(struct db_arg_chain_tree *tree); /** * Do not call this function directly, use _db_tree_free() instead */ static unsigned int __db_tree_free(struct db_arg_chain_tree *tree) { int cnt; if (tree == NULL || --(tree->refcnt) > 0) return 0; /* we assume the caller has ensured that 'tree->lvl_prv == NULL' */ cnt = __db_tree_free(tree->lvl_nxt); cnt += _db_tree_free(tree->nxt_t); cnt += _db_tree_free(tree->nxt_f); free(tree); return cnt + 1; } /** * Free a syscall filter argument chain tree * @param list the argument chain list * * This function frees a syscall argument chain list and returns the number of * nodes freed. * */ static unsigned int _db_tree_free(struct db_arg_chain_tree *tree) { struct db_arg_chain_tree *iter; if (tree == NULL) return 0; iter = tree; while (iter->lvl_prv != NULL) iter = iter->lvl_prv; return __db_tree_free(iter); } /** * Remove a node from an argument chain tree * @param tree the pointer to the tree * @param node the node to remove * @param action_flg the replacement action flag * @param action the replacement action * * This function searches the tree looking for the node and removes it once * found. The function also removes any other nodes that are no longer needed * as a result of removing the given node. Returns the number of nodes freed. * */ static unsigned int _db_tree_remove(struct db_arg_chain_tree **tree, struct db_arg_chain_tree *node, unsigned int action_flg, uint32_t action) { int cnt = 0; struct db_arg_chain_tree *c_iter; if (tree == NULL || *tree == NULL || node == NULL) return 0; c_iter = *tree; while (c_iter->lvl_prv != NULL) c_iter = c_iter->lvl_prv; do { if (c_iter == node) { /* remove from the tree */ if (c_iter == *tree) { if (c_iter->lvl_prv != NULL) *tree = c_iter->lvl_prv; else *tree = c_iter->lvl_nxt; } if (c_iter->lvl_prv != NULL) c_iter->lvl_prv->lvl_nxt = c_iter->lvl_nxt; if (c_iter->lvl_nxt != NULL) c_iter->lvl_nxt->lvl_prv = c_iter->lvl_prv; /* free and return */ c_iter->lvl_prv = NULL; c_iter->lvl_nxt = NULL; cnt += _db_tree_free(c_iter); return cnt; } /* check the true/false sub-trees */ cnt += _db_tree_remove(&(c_iter->nxt_t), node, action_flg, action); cnt += _db_tree_remove(&(c_iter->nxt_f), node, action_flg, action); c_iter = c_iter->lvl_nxt; } while (c_iter != NULL); return cnt; } /** * Traverse a tree checking the action values * @param tree the pointer to the tree * @param action the action * * Traverse the tree inspecting each action to see if it matches the given * action. Returns zero if all actions match the given action, negative values * on failure. * */ static int _db_tree_act_check(struct db_arg_chain_tree *tree, uint32_t action) { int rc; struct db_arg_chain_tree *c_iter; if (tree == NULL) return 0; c_iter = tree; while (c_iter->lvl_prv != NULL) c_iter = c_iter->lvl_prv; do { if (c_iter->act_t_flg && c_iter->act_t != action) return -EEXIST; if (c_iter->act_f_flg && c_iter->act_f != action) return -EEXIST; rc = _db_tree_act_check(c_iter->nxt_t, action); if (rc < 0) return rc; rc = _db_tree_act_check(c_iter->nxt_f, action); if (rc < 0) return rc; c_iter = c_iter->lvl_nxt; } while (c_iter != NULL); return 0; } /** * Checks for a sub-tree match in an existing tree and prunes the leaves * @param tree_head the head of the existing tree * @param tree_start the starting point into the existing tree * @param new_p pointer to the new tree * @param remove_flg removal flag, only valid on return if return >= 0 * * This function searches the existing tree for an occurance of the new tree * and removes as much of it as possible. Returns the number of nodes removed * from the tree on success, and negative values on failure. * */ static int _db_tree_sub_prune(struct db_arg_chain_tree **tree_head, struct db_arg_chain_tree *tree_start, struct db_arg_chain_tree *new, unsigned int *remove_flg) { int rc = 0; struct db_arg_chain_tree *c_iter = tree_start; *remove_flg = 0; if (new == NULL || c_iter == NULL) return 0; if (!db_chain_one_result(new)) return 0; while (c_iter->lvl_prv != NULL) c_iter = c_iter->lvl_prv; do { if (c_iter->arg < new->arg) { if (c_iter->nxt_t != NULL) { rc = _db_tree_sub_prune(tree_head, c_iter->nxt_t, new, remove_flg); if (rc > 0) goto sub_prune_found_down; } if (c_iter->nxt_f != NULL) { rc = _db_tree_sub_prune(tree_head, c_iter->nxt_f, new, remove_flg); if (rc > 0) goto sub_prune_found_down; } } else if (db_chain_eq(c_iter, new)) { if (db_chain_leaf(new)) { if (!db_chain_one_result(c_iter)) { /* can't remove existing node */ if (new->act_t_flg && c_iter->act_t_flg && new->act_t == c_iter->act_t) c_iter->act_t_flg = 0; if (new->act_f_flg && c_iter->act_f_flg && new->act_f == c_iter->act_f) c_iter->act_f_flg = 0; goto sub_prune_return; } if ((db_chain_eq_result(c_iter, new)) || ((new->act_t_flg && c_iter->nxt_t != NULL)|| (new->act_f_flg && c_iter->nxt_f != NULL))) /* exact or close match - remove node */ goto sub_prune_remove; goto sub_prune_return; } if (new->nxt_t != NULL) { rc = _db_tree_sub_prune(tree_head, c_iter->nxt_t, new->nxt_t, remove_flg); if (rc > 0) goto sub_prune_found_down; } if (new->nxt_f != NULL) { rc = _db_tree_sub_prune(tree_head, c_iter->nxt_f, new->nxt_f, remove_flg); if (rc > 0) goto sub_prune_found_down; } } else if (db_chain_gt(c_iter, new)) goto sub_prune_return; c_iter = c_iter->lvl_nxt; } while (c_iter != NULL); goto sub_prune_return; sub_prune_found_down: if (db_chain_zombie(c_iter)) goto sub_prune_remove; sub_prune_return: *remove_flg = 0; return rc; sub_prune_remove: rc += _db_tree_remove(tree_head, c_iter, 0, 0); *remove_flg = 1; return rc; } /** * Validate the seccomp action * @param action the seccomp action * * Verify that the given action is a valid seccomp action; return zero if * valid, -EINVAL if invalid. */ int db_action_valid(uint32_t action) { if (action == SCMP_ACT_KILL) return 0; else if (action == SCMP_ACT_TRAP) return 0; else if (action == SCMP_ACT_ERRNO(action & 0x0000ffff)) return 0; else if (action == SCMP_ACT_TRACE(action & 0x0000ffff)) return 0; else if (action == SCMP_ACT_ALLOW) return 0; return -EINVAL; } /** * Intitalize a seccomp filter DB * @param arch the architecture definition * @param def_action the default filter action * * This function initializes a seccomp filter DB and readies it for use. * Returns a pointer to the DB on success, NULL on failure. * */ struct db_filter *db_init(const struct arch_def *arch, uint32_t def_action) { struct db_filter *db; db = malloc(sizeof(*db)); if (db == NULL) return NULL; memset(db, 0, sizeof(*db)); db->arch = arch; /* default attribute values */ db->attr.act_default = def_action; db->attr.act_badarch = SCMP_ACT_KILL; db->attr.nnp_enable = 1; return db; } /** * Destroy a seccomp filter DB * @param db the seccomp filter DB * * This function destroys a seccomp filter DB. After calling this function, * the filter should no longer be referenced. * */ void db_release(struct db_filter *db) { struct db_sys_list *s_iter; if (db == NULL) return; s_iter = db->syscalls; while (s_iter != NULL) { db->syscalls = s_iter->next; _db_tree_free(s_iter->chains); free(s_iter); s_iter = db->syscalls; } free(db); } /** * Get a filter attribute * @param db the seccomp filter DB * @param attr the filter attribute * @param value the filter attribute value * * Get the requested filter attribute and provide it via @value. Returns zero * on success, negative values on failure. * */ int db_attr_get(struct db_filter *db, enum scmp_filter_attr attr, uint32_t *value) { switch (attr) { case SCMP_FLTATR_ACT_DEFAULT: *value = db->attr.act_default; break; case SCMP_FLTATR_ACT_BADARCH: *value = db->attr.act_badarch; break; case SCMP_FLTATR_CTL_NNP: *value = db->attr.nnp_enable; break; default: return -EEXIST; break; } return 0; } /** * Set a filter attribute * @param db the seccomp filter DB * @param attr the filter attribute * @param value the filter attribute value * * Set the requested filter attribute with the given value. Returns zero on * success, negative values on failure. * */ int db_attr_set(struct db_filter *db, enum scmp_filter_attr attr, uint32_t value) { switch (attr) { case SCMP_FLTATR_ACT_DEFAULT: /* read only */ return -EACCES; break; case SCMP_FLTATR_ACT_BADARCH: if (db_action_valid(value) == 0) db->attr.act_badarch = value; else return -EINVAL; break; case SCMP_FLTATR_CTL_NNP: db->attr.nnp_enable = (value ? 1 : 0); break; default: return -EEXIST; break; } return 0; } /** * Update the user specified portion of the syscall priority * @param db the seccomp filter db * @param syscall the syscall number * @param priority the syscall priority * * This function sets, or updates, the syscall priority; the highest priority * value between the existing and specified value becomes the new syscall * priority. If the syscall entry does not already exist, a new phantom * syscall entry is created as a placeholder. Returns zero on success, * negative values on failure. * */ int db_syscall_priority(struct db_filter *db, unsigned int syscall, uint8_t priority) { unsigned int sys_pri = _DB_PRI_USER(priority); struct db_sys_list *s_new, *s_iter, *s_prev = NULL; assert(db != NULL); s_iter = db->syscalls; while (s_iter != NULL && s_iter->num < syscall) { s_prev = s_iter; s_iter = s_iter->next; } /* matched an existing syscall entry */ if (s_iter != NULL && s_iter->num == syscall) { if (sys_pri > (s_iter->priority & _DB_PRI_MASK_USER)) { s_iter->priority &= (~_DB_PRI_MASK_USER); s_iter->priority |= sys_pri; } return 0; } /* no existing syscall entry - create a phantom entry */ s_new = malloc(sizeof(*s_new)); if (s_new == NULL) return -ENOMEM; memset(s_new, 0, sizeof(*s_new)); s_new->num = syscall; s_new->priority = sys_pri; s_new->valid = 0; /* add it before s_iter */ if (s_prev != NULL) { s_new->next = s_prev->next; s_prev->next = s_new; } else { s_new->next = db->syscalls; db->syscalls = s_new; } return 0; } /** * Fixup the node based on the op/mask * @param node the chain node * * Apply some simplifications based on the comparison op and mask value. * */ static void _db_node_mask_fixup(struct db_arg_chain_tree *node) { if (node->op == SCMP_CMP_MASKED_EQ && node->mask == 0) { node->op = SCMP_CMP_EQ; node->mask = ARG_MASK_MAX; node->datum = 0; } else node->datum &= node->mask; } /** * Generate a new filter rule for a 64 bit system * @param arch the architecture definition * @param action the filter action * @param syscall the syscall number * @param chain argument filter chain * * This function generates a new syscall filter for a 64 bit system. Returns * zero on success, negative values on failure. * */ static struct db_sys_list *_db_rule_gen_64(const struct arch_def *arch, uint32_t action, unsigned int syscall, struct db_api_arg *chain) { unsigned int iter; int chain_len_max; struct db_sys_list *s_new; struct db_arg_chain_tree *c_iter_hi = NULL, *c_iter_lo = NULL; struct db_arg_chain_tree *c_prev_hi = NULL, *c_prev_lo = NULL; unsigned int tf_flag; s_new = malloc(sizeof(*s_new)); if (s_new == NULL) return NULL; memset(s_new, 0, sizeof(*s_new)); s_new->num = syscall; s_new->valid = 1; /* run through the argument chain */ chain_len_max = arch_arg_count_max(arch); for (iter = 0; iter < chain_len_max; iter++) { if (chain[iter].valid == 0) continue; c_iter_hi = malloc(sizeof(*c_iter_hi)); if (c_iter_hi == NULL) goto gen_64_failure; memset(c_iter_hi, 0, sizeof(*c_iter_hi)); c_iter_hi->refcnt = 1; c_iter_lo = malloc(sizeof(*c_iter_lo)); if (c_iter_lo == NULL) { free(c_iter_hi); goto gen_64_failure; } memset(c_iter_lo, 0, sizeof(*c_iter_lo)); c_iter_lo->refcnt = 1; /* link the hi node to the previous level */ if (c_prev_hi != NULL) { if (tf_flag) c_prev_lo->nxt_t = c_iter_hi; else { c_iter_hi->refcnt++; c_prev_hi->nxt_f = c_iter_hi; c_prev_lo->nxt_f = c_iter_hi; } } else s_new->chains = c_iter_hi; s_new->node_cnt += 2; /* set the arg, op, and datum fields */ c_iter_hi->arg = chain[iter].arg; c_iter_lo->arg = chain[iter].arg; c_iter_hi->arg_offset = arch_arg_offset_hi(arch, c_iter_hi->arg); c_iter_lo->arg_offset = arch_arg_offset_lo(arch, c_iter_lo->arg); switch (chain[iter].op) { case SCMP_CMP_GT: c_iter_hi->op = SCMP_CMP_GE; c_iter_lo->op = SCMP_CMP_GT; tf_flag = 1; break; case SCMP_CMP_NE: c_iter_hi->op = SCMP_CMP_EQ; c_iter_lo->op = SCMP_CMP_EQ; tf_flag = 0; break; case SCMP_CMP_LT: c_iter_hi->op = SCMP_CMP_GE; c_iter_lo->op = SCMP_CMP_GE; tf_flag = 0; break; case SCMP_CMP_LE: c_iter_hi->op = SCMP_CMP_GE; c_iter_lo->op = SCMP_CMP_GT; tf_flag = 0; break; default: c_iter_hi->op = chain[iter].op; c_iter_lo->op = chain[iter].op; tf_flag = 1; } c_iter_hi->mask = D64_HI(chain[iter].mask); c_iter_lo->mask = D64_LO(chain[iter].mask); c_iter_hi->datum = D64_HI(chain[iter].datum); c_iter_lo->datum = D64_LO(chain[iter].datum); /* fixup the mask/datum */ _db_node_mask_fixup(c_iter_hi); _db_node_mask_fixup(c_iter_lo); /* link the hi and lo chain nodes */ c_iter_hi->nxt_t = c_iter_lo; c_prev_hi = c_iter_hi; c_prev_lo = c_iter_lo; } if (c_iter_lo != NULL) { /* set the leaf node */ if (tf_flag) { c_iter_lo->act_t_flg = 1; c_iter_lo->act_t = action; } else { c_iter_lo->act_f_flg = 1; c_iter_lo->act_f = action; } } else s_new->action = action; return s_new; gen_64_failure: /* free the new chain and its syscall struct */ _db_tree_free(s_new->chains); free(s_new); return NULL; } /** * Generate a new filter rule for a 32 bit system * @param arch the architecture definition * @param action the filter action * @param syscall the syscall number * @param chain argument filter chain * * This function generates a new syscall filter for a 32 bit system. Returns * zero on success, negative values on failure. * */ static struct db_sys_list *_db_rule_gen_32(const struct arch_def *arch, uint32_t action, unsigned int syscall, struct db_api_arg *chain) { unsigned int iter; int chain_len_max; struct db_sys_list *s_new; struct db_arg_chain_tree *c_iter = NULL, *c_prev = NULL; unsigned int tf_flag; s_new = malloc(sizeof(*s_new)); if (s_new == NULL) return NULL; memset(s_new, 0, sizeof(*s_new)); s_new->num = syscall; s_new->valid = 1; /* run through the argument chain */ chain_len_max = arch_arg_count_max(arch); for (iter = 0; iter < chain_len_max; iter++) { if (chain[iter].valid == 0) continue; c_iter = malloc(sizeof(*c_iter)); if (c_iter == NULL) goto gen_32_failure; memset(c_iter, 0, sizeof(*c_iter)); c_iter->refcnt = 1; c_iter->arg = chain[iter].arg; c_iter->arg_offset = arch_arg_offset(c_iter->arg); c_iter->op = chain[iter].op; c_iter->mask = chain[iter].mask; c_iter->datum = chain[iter].datum; /* link in the new node and update the chain */ if (c_prev != NULL) { if (tf_flag) c_prev->nxt_t = c_iter; else c_prev->nxt_f = c_iter; } else s_new->chains = c_iter; s_new->node_cnt++; /* rewrite the op to reduce the op/datum combos */ switch (c_iter->op) { case SCMP_CMP_NE: c_iter->op = SCMP_CMP_EQ; tf_flag = 0; break; case SCMP_CMP_LT: c_iter->op = SCMP_CMP_GE; tf_flag = 0; break; case SCMP_CMP_LE: c_iter->op = SCMP_CMP_GT; tf_flag = 0; break; default: tf_flag = 1; } /* fixup the mask/datum */ _db_node_mask_fixup(c_iter); c_prev = c_iter; } if (c_iter != NULL) { /* set the leaf node */ if (tf_flag) { c_iter->act_t_flg = 1; c_iter->act_t = action; } else { c_iter->act_f_flg = 1; c_iter->act_f = action; } } else s_new->action = action; return s_new; gen_32_failure: /* free the new chain and its syscall struct */ _db_tree_free(s_new->chains); free(s_new); return NULL; } /** * Add a new rule to the seccomp filter DB * @param db the seccomp filter db * @param action the filter action * @param syscall the syscall number * @param chain argument filter chain * * This function adds a new syscall filter to the seccomp filter DB, adding to * the existing filters for the syscall, unless no argument specific filters * are present (filtering only on the syscall). When adding new chains, the * shortest chain, or most inclusive filter match, will be entered into the * filter DB. Returns zero on success, negative values on failure. * */ int db_rule_add(struct db_filter *db, uint32_t action, unsigned int syscall, struct db_api_arg *chain) { int rc = -ENOMEM; struct db_sys_list *s_new, *s_iter, *s_prev = NULL; struct db_arg_chain_tree *c_iter = NULL, *c_prev = NULL; struct db_arg_chain_tree *ec_iter, *ec_iter_b; unsigned int rm_flag = 0; unsigned int new_chain_cnt = 0; unsigned int n_cnt; assert(db != NULL); /* do all our possible memory allocation up front so we don't have to * worry about failure once we get to the point where we start updating * the filter db */ if (db->arch->size == ARCH_SIZE_64) s_new = _db_rule_gen_64(db->arch, action, syscall, chain); else if (db->arch->size == ARCH_SIZE_32) s_new = _db_rule_gen_32(db->arch, action, syscall, chain); else return -EFAULT; if (s_new == NULL) return -ENOMEM; new_chain_cnt = s_new->node_cnt; /* no more failures allowed after this point that would result in the * stored filter being in an inconsistent state */ /* find a matching syscall/chain or insert a new one */ s_iter = db->syscalls; while (s_iter != NULL && s_iter->num < syscall) { s_prev = s_iter; s_iter = s_iter->next; } add_reset: s_new->node_cnt = new_chain_cnt; s_new->priority = _DB_PRI_MASK_CHAIN - s_new->node_cnt; c_prev = NULL; c_iter = s_new->chains; if (s_iter != NULL) ec_iter = s_iter->chains; else ec_iter = NULL; if (s_iter == NULL || s_iter->num != syscall) { /* new syscall, add before s_iter */ if (s_prev != NULL) { s_new->next = s_prev->next; s_prev->next = s_new; } else { s_new->next = db->syscalls; db->syscalls = s_new; } return 0; } else if (s_iter->chains == NULL) { if (rm_flag || s_iter->valid == 0) { /* we are here because our previous pass cleared the * entire syscall chain when searching for a subtree * match or the existing syscall entry is a phantom, * so either way add the new chain */ s_iter->chains = s_new->chains; s_iter->action = s_new->action; s_iter->node_cnt = s_new->node_cnt; if (s_iter->valid == 1) s_iter->priority = s_new->priority; s_iter->valid = 1; free(s_new); rc = 0; goto add_priority_update; } else /* syscall exists without any chains - existing filter * is at least as large as the new entry so cleanup and * exit */ goto add_free_ok; } else if (s_iter->chains != NULL && s_new->chains == NULL) { /* syscall exists with chains but the new filter has no chains * so we need to clear the existing chains and exit */ _db_tree_free(s_iter->chains); s_iter->chains = NULL; s_iter->node_cnt = 0; s_iter->action = action; goto add_free_ok; } /* syscall exists and has at least one existing chain - start at the * top and walk the two chains */ do { /* check for sub-tree matches in the existing tree */ rc = _db_tree_sub_prune(&(s_iter->chains), ec_iter, c_iter, &rm_flag); if (rc > 0) s_iter->node_cnt -= rc; else if (rc < 0) goto add_free; if (rm_flag) goto add_reset; /* check for sub-tree matches in the new tree */ ec_iter_b = ec_iter; while (ec_iter_b->lvl_prv != NULL) ec_iter_b = ec_iter_b->lvl_prv; do { rc = _db_tree_sub_prune(&(s_new->chains), c_iter, ec_iter_b, &rm_flag); ec_iter_b = ec_iter_b->lvl_nxt; } while (rc == 0 && ec_iter_b != NULL); if (rc > 0) { s_new->node_cnt -= rc; if (s_new->node_cnt > 0) /* XXX - are we ever going to hit this is a * normal use case? pretty sure we can't * "reset" in this case ... */ return -EFAULT; rc = 0; goto add_free; } else if (rc < 0) goto add_free; /* insert the new rule into the existing tree */ if (db_chain_eq(c_iter, ec_iter)) { /* found a matching node on this chain level */ if (db_chain_leaf(c_iter) && db_chain_leaf(ec_iter)) { /* both are leaf nodes */ if (c_iter->act_t_flg && ec_iter->act_t_flg) { if (ec_iter->act_t != action) goto add_free_exist; } else if (c_iter->act_t_flg) { ec_iter->act_t_flg = 1; ec_iter->act_t = action; } if (c_iter->act_f_flg && ec_iter->act_f_flg) { if (ec_iter->act_f != action) goto add_free_exist; } else if (c_iter->act_f_flg) { ec_iter->act_f_flg = 1; ec_iter->act_f = action; } if (ec_iter->act_t_flg == ec_iter->act_f_flg && ec_iter->act_t == ec_iter->act_f) { n_cnt = _db_tree_remove( &(s_iter->chains), ec_iter, 1, ec_iter->act_t); s_iter->node_cnt -= n_cnt; } goto add_free_ok; } else if (db_chain_leaf(c_iter)) { /* new is shorter */ if (c_iter->act_t_flg) { rc = _db_tree_act_check(ec_iter->nxt_t, action); if (rc < 0) goto add_free; n_cnt = _db_tree_free(ec_iter->nxt_t); ec_iter->nxt_t = NULL; ec_iter->act_t_flg = 1; ec_iter->act_t = action; } else { rc = _db_tree_act_check(ec_iter->nxt_f, action); if (rc < 0) goto add_free; n_cnt = _db_tree_free(ec_iter->nxt_f); ec_iter->nxt_f = NULL; ec_iter->act_f_flg = 1; ec_iter->act_f = action; } s_iter->node_cnt -= n_cnt; return 0; } else if (c_iter->nxt_t != NULL) { if (ec_iter->nxt_t != NULL) { /* jump to the next level */ c_prev = c_iter; c_iter = c_iter->nxt_t; ec_iter = ec_iter->nxt_t; s_new->node_cnt--; } else if (ec_iter->act_t_flg) { /* existing is shorter */ if (ec_iter->act_t == action) goto add_free_ok; goto add_free_exist; } else { /* add a new branch */ ec_iter->nxt_t = c_iter->nxt_t; s_iter->node_cnt += (s_new->node_cnt-1); goto add_free_match; } } else if (c_iter->nxt_f != NULL) { if (ec_iter->nxt_f != NULL) { /* jump to the next level */ c_prev = c_iter; c_iter = c_iter->nxt_f; ec_iter = ec_iter->nxt_f; s_new->node_cnt--; } else if (ec_iter->act_f_flg) { /* existing is shorter */ if (ec_iter->act_f == action) goto add_free_ok; goto add_free_exist; } else { /* add a new branch */ ec_iter->nxt_f = c_iter->nxt_f; s_iter->node_cnt += (s_new->node_cnt-1); goto add_free_match; } } else { /* we should never be here! */ rc = -EFAULT; goto add_free; } } else { /* need to check other nodes on this level */ if (db_chain_lt(c_iter, ec_iter)) { if (ec_iter->lvl_prv == NULL) { /* add to the start of the level */ ec_iter->lvl_prv = c_iter; c_iter->lvl_nxt = ec_iter; if (ec_iter == s_iter->chains) s_iter->chains = c_iter; s_iter->node_cnt += s_new->node_cnt; goto add_free_match; } else ec_iter = ec_iter->lvl_prv; } else { if (ec_iter->lvl_nxt == NULL) { /* add to the end of the level */ ec_iter->lvl_nxt = c_iter; c_iter->lvl_prv = ec_iter; s_iter->node_cnt += s_new->node_cnt; goto add_free_match; } else if (db_chain_lt(c_iter, ec_iter->lvl_nxt)) { /* add new chain in between */ c_iter->lvl_nxt = ec_iter->lvl_nxt; ec_iter->lvl_nxt->lvl_prv = c_iter; ec_iter->lvl_nxt = c_iter; c_iter->lvl_prv = ec_iter; s_iter->node_cnt += s_new->node_cnt; goto add_free_match; } else ec_iter = ec_iter->lvl_nxt; } } } while ((c_iter != NULL) && (ec_iter != NULL)); /* we should never be here! */ return -EFAULT; add_free_exist: rc = -EEXIST; goto add_free; add_free_ok: rc = 0; add_free: /* free the new chain and its syscall struct */ _db_tree_free(s_new->chains); free(s_new); goto add_priority_update; add_free_match: /* free the matching portion of new chain */ if (c_prev != NULL) { c_prev->nxt_t = NULL; c_prev->nxt_f = NULL; _db_tree_free(s_new->chains); } free(s_new); rc = 0; add_priority_update: /* update the priority */ if (s_iter != NULL) { s_iter->priority &= (~_DB_PRI_MASK_CHAIN); s_iter->priority |= (_DB_PRI_MASK_CHAIN - s_iter->node_cnt); } return rc; } libseccomp-0.1.0/include/0000755000000000000000000000000011763743761013770 5ustar rootrootlibseccomp-0.1.0/include/Makefile0000644000000000000000000000175511763743761015440 0ustar rootroot# # Enhanced Seccomp Library Makefile # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # # # macros # include ../macros.mk # # configuration # include $(TOPDIR)/version_info.mk include $(TOPDIR)/configure.mk include $(TOPDIR)/install.mk # # targets # .PHONY: all install install_hdr all: install: install_hdr install_hdr: seccomp.h $(INSTALL_INC_MACRO) libseccomp-0.1.0/include/seccomp.h0000644000000000000000000002667711746233754015611 0ustar rootroot/** * Seccomp Library * * Copyright (c) 2012 Red Hat * Author: Paul Moore */ /* * This library is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License as * published by the Free Software Foundation. * * This library is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License * for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this library; if not, see . */ #ifndef _SECCOMP_H #define _SECCOMP_H #include #include /* * types */ /** * Filter attributes */ enum scmp_filter_attr { _SCMP_FLTATR_MIN = 0, SCMP_FLTATR_ACT_DEFAULT = 1, /**< default filter action */ SCMP_FLTATR_ACT_BADARCH = 2, /**< bad architecture action */ SCMP_FLTATR_CTL_NNP = 3, /**< set NO_NEW_PRIVS on filter load */ _SCMP_FLTATR_MAX, }; /** * Comparison operators */ enum scmp_compare { _SCMP_CMP_MIN = 0, SCMP_CMP_NE = 1, /**< not equal */ SCMP_CMP_LT = 2, /**< less than */ SCMP_CMP_LE = 3, /**< less than or equal */ SCMP_CMP_EQ = 4, /**< equal */ SCMP_CMP_GE = 5, /**< greater than or equal */ SCMP_CMP_GT = 6, /**< greater than */ SCMP_CMP_MASKED_EQ = 7, /**< masked equality */ _SCMP_CMP_MAX, }; /** * Argument datum */ typedef uint64_t scmp_datum_t; /** * Argument / Value comparison definition */ struct scmp_arg_cmp { unsigned int arg; /**< argument number, starting at 0 */ enum scmp_compare op; /**< the comparison op, e.g. SCMP_CMP_* */ scmp_datum_t datum_a; scmp_datum_t datum_b; }; /* * macros/defines */ /** * Convert a syscall name into the associated syscall number * @param x the syscall name */ #define SCMP_SYS(x) __NR_##x /** * Specify an argument comparison struct for use in declaring rules * @param arg the argument number, starting at 0 * @param op the comparison operator, e.g. SCMP_CMP_* * @param datum_a dependent on comparison * @param datum_b dependent on comparison, optional */ #define SCMP_CMP(...) ((struct scmp_arg_cmp){__VA_ARGS__}) /** * Specify an argument comparison struct for argument 0 */ #define SCMP_A0(...) SCMP_CMP(0, __VA_ARGS__) /** * Specify an argument comparison struct for argument 1 */ #define SCMP_A1(...) SCMP_CMP(1, __VA_ARGS__) /** * Specify an argument comparison struct for argument 2 */ #define SCMP_A2(...) SCMP_CMP(2, __VA_ARGS__) /** * Specify an argument comparison struct for argument 3 */ #define SCMP_A3(...) SCMP_CMP(3, __VA_ARGS__) /** * Specify an argument comparison struct for argument 4 */ #define SCMP_A4(...) SCMP_CMP(4, __VA_ARGS__) /** * Specify an argument comparison struct for argument 5 */ #define SCMP_A5(...) SCMP_CMP(5, __VA_ARGS__) /* * seccomp actions */ /** * Kill the process */ #define SCMP_ACT_KILL 0x00000000U /** * Throw a SIGSYS signal */ #define SCMP_ACT_TRAP 0x00030000U /** * Return the specified error code */ #define SCMP_ACT_ERRNO(x) (0x00050000U | ((x) & 0x0000ffffU)) /** * Notify a tracing process with the specified value */ #define SCMP_ACT_TRACE(x) (0x7ff00000U | ((x) & 0x0000ffffU)) /** * Allow the syscall to be executed */ #define SCMP_ACT_ALLOW 0x7fff0000U /* * functions */ /** * Initialize the filter state * @param def_action the default filter action * * This function initializes the internal seccomp filter state and should * be called before any other functions in this library to ensure the filter * state is initialized. Returns zero on success, negative values on failure. * */ int seccomp_init(uint32_t def_action); /** * Reset the current filter state * @param def_action the default filter action * * This function resets the internal seccomp filter state and ensures the * filter state is reinitialized. This function does not reset any seccomp * filters already loaded into the kernel. Returns zero on success, negative * values on failure. * */ int seccomp_reset(uint32_t def_action); /** * Destroys the current filter state and releases any resources * * This functions destroys the internal seccomp filter state and releases any * resources, including memory, associated with the filter state. This * function does not reset any seccomp filters already loaded into the kernel. * The function seccomp_reset() must be called before the filter can be * reconfigured after calling this function. * */ void seccomp_release(void); /** * Loads the current filter into the kernel * * This function loads the currently configured seccomp filter into the kernel. * If the filter was loaded correctly, the kernel will be enforcing the filter * when this function returns. Returns zero on success, negative values on * error. * */ int seccomp_load(void); /** * Get the value of a filter attribute * @param attr the filter attribute name * @param value the filter attribute value * * This function fetches the value of the given attribute name and returns it * via @value. Returns zero on success, negative values on failure. * */ int seccomp_attr_get(enum scmp_filter_attr attr, uint32_t *value); /** * Set the value of a filter attribute * @param attr the filter attribute name * @param value the filter attribute value * * This function sets the value of the given attribute. Returns zero on * success, negative values on failure. * */ int seccomp_attr_set(enum scmp_filter_attr attr, uint32_t value); /** * Set the priority of a given syscall * @param syscall the syscall number * @param priority priority value, higher value == higher priority * * This function sets the priority of the given syscall; this value is used * when generating the seccomp filter code such that higher priority syscalls * will incur less filter code overhead than the lower priority syscalls in the * filter. Returns zero on success, negative values on failure. * */ int seccomp_syscall_priority(int syscall, uint8_t priority); /** * Add a new rule to the current filter * @param action the filter action * @param syscall the syscall number * @param arg_cnt the number of argument filters in the argument filter chain * @param ... scmp_arg_cmp structs (use of SCMP_ARG_CMP() recommended) * * This function adds a series of new argument/value checks to the seccomp * filter for the given syscall; multiple argument/value checks can be * specified and they will be chained together (AND'd together) in the filter. * If the specified rule needs to be adjusted due to architecture specifics it * will be adjusted without notification. Returns zero on success, negative * values on failure. * */ int seccomp_rule_add(uint32_t action, int syscall, unsigned int arg_cnt, ...); /** * Add a new rule to the current filter * @param action the filter action * @param syscall the syscall number * @param arg_cnt the number of argument filters in the argument filter chain * @param ... scmp_arg_cmp structs (use of SCMP_ARG_CMP() recommended) * * This function adds a series of new argument/value checks to the seccomp * filter for the given syscall; multiple argument/value checks can be * specified and they will be chained together (AND'd together) in the filter. * If the specified rule can not be represented on the architecture the * function will fail. Returns zero on success, negative values on failure. * */ int seccomp_rule_add_exact(uint32_t action, int syscall, unsigned int arg_cnt, ...); /** * Generate seccomp Pseudo Filter Code (PFC) and export it to a file * @param fd the destination fd * * This function generates seccomp Pseudo Filter Code (PFC) and writes it to * the given fd. Returns zero on success, negative values on failure. * */ int seccomp_export_pfc(int fd); /** * Generate seccomp Berkley Packet Filter (BPF) code and export it to a file * @param fd the destination fd * * This function generates seccomp Berkley Packer Filter (BPF) code and writes * it to the given fd. Returns zero on success, negative values on failure. * */ int seccomp_export_bpf(int fd); /* * pseudo syscall definitions */ /* NOTE - pseudo syscall values {-1..-99} are reserved */ #define __PNR_socket -100 #ifndef __NR_socket #define __NR_socket __PNR_socket #endif /* __NR_socket */ #define __PNR_bind -101 #ifndef __NR_bind #define __NR_bind __PNR_bind #endif /* __NR_bind */ #define __PNR_connect -102 #ifndef __NR_connect #define __NR_connect __PNR_connect #endif /* __NR_connect */ #define __PNR_listen -103 #ifndef __NR_listen #define __NR_listen __PNR_listen #endif /* __NR_listen */ #define __PNR_accept -104 #ifndef __NR_accept #define __NR_accept __PNR_accept #endif /* __NR_accept */ #define __PNR_getsockname -105 #ifndef __NR_getsockname #define __NR_getsockname __PNR_getsockname #endif /* __NR_getsockname */ #define __PNR_getpeername -106 #ifndef __NR_getpeername #define __NR_getpeername __PNR_getpeername #endif /* __NR_getpeername */ #define __PNR_socketpair -107 #ifndef __NR_socketpair #define __NR_socketpair __PNR_socketpair #endif /* __NR_socketpair */ #define __PNR_send -108 #ifndef __NR_send #define __NR_send __PNR_send #endif /* __NR_send */ #define __PNR_recv -109 #ifndef __NR_recv #define __NR_recv __PNR_recv #endif /* __NR_recv */ #define __PNR_sendto -110 #ifndef __NR_sendto #define __NR_sendto __PNR_sendto #endif /* __NR_sendto */ #define __PNR_recvfrom -111 #ifndef __NR_recvfrom #define __NR_recvfrom __PNR_recvfrom #endif /* __NR_recvfrom */ #define __PNR_shutdown -112 #ifndef __NR_shutdown #define __NR_shutdown __PNR_shutdown #endif /* __NR_shutdown */ #define __PNR_getsockopt -113 #ifndef __NR_getsockopt #define __NR_getsockopt __PNR_getsockopt #endif /* __NR_getsockopt */ #define __PNR_sendmsg -114 #ifndef __NR_sendmsg #define __NR_sendmsg __PNR_sendmsg #endif /* __NR_sendmsg */ #define __PNR_recvmsg -115 #ifndef __NR_recvmsg #define __NR_recvmsg __PNR_recvmsg #endif /* __NR_recvmsg */ #define __PNR_recvmmsg -116 #ifndef __NR_recvmmsg #define __NR_recvmmsg __PNR_recvmmsg #endif /* __NR_recvmmsg */ #define __PNR_sendmmsg -117 #ifndef __NR_sendmmsg #define __NR_sendmmsg __PNR_sendmmsg #endif /* __NR_sendmmsg */ #define __PNR_semop -200 #ifndef __NR_semop #define __NR_semop __PNR_semop #endif /* __NR_semop */ #define __PNR_semget -201 #ifndef __NR_semget #define __NR_semget __PNR_semget #endif /* __NR_semget */ #define __PNR_semctl -202 #ifndef __NR_semctl #define __NR_semctl __PNR_semctl #endif /* __NR_semctl */ #define __PNR_semtimedop -203 #ifndef __NR_semtimedop #define __NR_semtimedop __PNR_semtimedop #endif /* __NR_semtime */ #define __PNR_msgsnd -204 #ifndef __NR_msgsnd #define __NR_msgsnd __PNR_msgsnd #endif /* __NR_msgsnd */ #define __PNR_msgrcv -205 #ifndef __NR_msgrcv #define __NR_msgrcv __PNR_msgrcv #endif /* __NR_msgrcv */ #define __PNR_msgget -206 #ifndef __NR_msgget #define __NR_msgget __PNR_msgget #endif /* __NR_msgget */ #define __PNR_msgctl -207 #ifndef __NR_msgctl #define __NR_msgctl __PNR_msgctl #endif /* __NR_msgctl */ #define __PNR_shmat -208 #ifndef __NR_shmat #define __NR_shmat __PNR_shmat #endif /* __NR_shmat */ #define __PNR_shmdt -209 #ifndef __NR_shmdt #define __NR_shmdt __PNR_shmdt #endif /* __NR_shmdt */ #define __PNR_shmget -210 #ifndef __NR_shmget #define __NR_shmget __PNR_shmget #endif /* __NR_shmget */ #define __PNR_shmctl -211 #ifndef __NR_shmctl #define __NR_shmctl __PNR_shmctl #endif /* __NR_shmctl */ #endif libseccomp-0.1.0/doc/0000755000000000000000000000000011763744034013104 5ustar rootrootlibseccomp-0.1.0/doc/Makefile0000644000000000000000000000254111763744034014546 0ustar rootroot# # Enhanced Seccomp Library Makefile # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # # # macros # include ../macros.mk # # configuration # include $(TOPDIR)/version_info.mk include $(TOPDIR)/configure.mk include $(TOPDIR)/install.mk MAN3 = \ man/man3/seccomp_init.3 \ man/man3/seccomp_load.3 \ man/man3/seccomp_release.3 \ man/man3/seccomp_reset.3 \ man/man3/seccomp_rule_add.3 \ man/man3/seccomp_rule_add_exact.3 \ man/man3/seccomp_syscall_priority.3 \ man/man3/seccomp_export_bpf.3 \ man/man3/seccomp_export_pfc.3 \ man/man3/seccomp_attr_set.3 \ man/man3/seccomp_attr_get.3 # # targets # .PHONY: all install install_man3 all: install: install_man3 install_man3: $(MAN3) $(INSTALL_MAN_MACRO) man3 "manpages" libseccomp-0.1.0/doc/man/0000755000000000000000000000000011740662363013656 5ustar rootrootlibseccomp-0.1.0/doc/man/man3/0000755000000000000000000000000011756732202014511 5ustar rootrootlibseccomp-0.1.0/doc/man/man3/seccomp_export_bpf.30000644000000000000000000000640611756732202020464 0ustar rootroot.TH "seccomp_export_bpf" 3 "15 April 2012" "paul@paul-moore.com" "libseccomp Documentation" .\" ////////////////////////////////////////////////////////////////////////// .SH NAME .\" ////////////////////////////////////////////////////////////////////////// seccomp_export_bpf, seccomp_export_pfc \- Export the seccomp filter .\" ////////////////////////////////////////////////////////////////////////// .SH SYNOPSIS .\" ////////////////////////////////////////////////////////////////////////// .nf .B #include .sp .BI "int seccomp_export_bpf(int " fd ");" .BI "int seccomp_export_pfc(int " fd ");" .fi .\" ////////////////////////////////////////////////////////////////////////// .SH DESCRIPTION .\" ////////////////////////////////////////////////////////////////////////// .P The .BR seccomp_export_bpf () and .BR seccomp_export_pfc () functions generate and output the current seccomp filter in either BPF (Berkley Packet Filter) or PFC (Pseudo Filter Code). The output of .BR seccomp_export_bpf () is suitable for loading into the kernel, while the output of .BR seccomp_export_pfc () is human readable and is intended primarily as a debugging tool for developers using libseccomp. Both functions write the filter to the .I fd file descriptor. .P While the two output formats are guaranteed to be functionally equivalent for the given seccomp filter configuration, the filter instructions, and their ordering, are not guaranteed to be the same in both the BPF and PFC formats. .\" ////////////////////////////////////////////////////////////////////////// .SH RETURN VALUE .\" ////////////////////////////////////////////////////////////////////////// Returns zero on success, negative errno values on failure. .\" ////////////////////////////////////////////////////////////////////////// .SH EXAMPLES .\" ////////////////////////////////////////////////////////////////////////// .nf #include int main(int argc, char *argv[]) { int rc; int filter_fd; rc = seccomp_init(SCMP_ACT_KILL); if (rc < 0) goto out; /* ... */ filter_fd = open("/tmp/seccomp_filter.bpf", O_WRONLY); if (filter_fd == -1) { rc = -errno; goto out; } rc = seccomp_export_bpf(filter_fd); if (rc < 0) { close(filter_fd); goto out; } close(filter_fd); /* ... */ out: seccomp_release(); return -rc; } .fi .\" ////////////////////////////////////////////////////////////////////////// .SH NOTES .\" ////////////////////////////////////////////////////////////////////////// .P While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter generated by libseccomp. .P The libseccomp project site, with more information and the source code repository, can be found at http://libseccomp.sf.net. This library is currently under development, please report any bugs at the project site or directly to the author. .\" ////////////////////////////////////////////////////////////////////////// .SH AUTHOR .\" ////////////////////////////////////////////////////////////////////////// Paul Moore .\" ////////////////////////////////////////////////////////////////////////// .SH SEE ALSO .\" ////////////////////////////////////////////////////////////////////////// .BR seccomp_init (3), .BR seccomp_release (3) libseccomp-0.1.0/doc/man/man3/seccomp_attr_get.30000644000000000000000000000003411743036611020111 0ustar rootroot.so man3/seccomp_attr_set.3 libseccomp-0.1.0/doc/man/man3/seccomp_reset.30000644000000000000000000000003011737351557017432 0ustar rootroot.so man3/seccomp_init.3 libseccomp-0.1.0/doc/man/man3/seccomp_release.30000644000000000000000000000472411756732202017735 0ustar rootroot.TH "seccomp_release" 3 "5 April 2012" "paul@paul-moore.com" "libseccomp Documentation" .\" ////////////////////////////////////////////////////////////////////////// .SH NAME .\" ////////////////////////////////////////////////////////////////////////// seccomp_release \- Release the seccomp filter state .\" ////////////////////////////////////////////////////////////////////////// .SH SYNOPSIS .\" ////////////////////////////////////////////////////////////////////////// .nf .B #include .sp .BI "void seccomp_release(void);" .fi .\" ////////////////////////////////////////////////////////////////////////// .SH DESCRIPTION .\" ////////////////////////////////////////////////////////////////////////// .P Releases the internal seccomp filter state initialized by .BR seccomp_init (3) or .BR seccomp_reset (3) and frees any memory associated with the currently configured seccomp filter. Any seccomp filters loaded into the kernel are not affected. .\" ////////////////////////////////////////////////////////////////////////// .SH RETURN VALUE .\" ////////////////////////////////////////////////////////////////////////// Does not return a value. .\" ////////////////////////////////////////////////////////////////////////// .SH EXAMPLES .\" ////////////////////////////////////////////////////////////////////////// .nf #include int main(int argc, char *argv[]) { int rc; rc = seccomp_init(SCMP_ACT_KILL); if (rc < 0) return -rc; /* ... */ seccomp_release(); return 0; } .fi .\" ////////////////////////////////////////////////////////////////////////// .SH NOTES .\" ////////////////////////////////////////////////////////////////////////// .P While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter generated by libseccomp. .P The libseccomp project site, with more information and the source code repository, can be found at http://libseccomp.sf.net. This library is currently under development, please report any bugs at the project site or directly to the author. .\" ////////////////////////////////////////////////////////////////////////// .SH AUTHOR .\" ////////////////////////////////////////////////////////////////////////// Paul Moore .\" ////////////////////////////////////////////////////////////////////////// .SH SEE ALSO .\" ////////////////////////////////////////////////////////////////////////// .BR seccomp_init (3), .BR seccomp_reset (3) libseccomp-0.1.0/doc/man/man3/seccomp_attr_set.30000644000000000000000000000730011756732202020133 0ustar rootroot.TH "seccomp_attr_set" 3 "16 April 2012" "paul@paul-moore.com" "libseccomp Documentation" .\" ////////////////////////////////////////////////////////////////////////// .SH NAME .\" ////////////////////////////////////////////////////////////////////////// seccomp_attr_set, seccomp_attr_get \- Manage the seccomp filter attributes .\" ////////////////////////////////////////////////////////////////////////// .SH SYNOPSIS .\" ////////////////////////////////////////////////////////////////////////// .nf .B #include .sp .B enum scmp_filter_attr; .sp .BI "int seccomp_attr_set(enum scmp_filter_attr " attr ", uint32_t " value ");" .BI "int seccomp_attr_get(enum scmp_filter_attr " attr ", uint32_t *" value ");" .fi .\" ////////////////////////////////////////////////////////////////////////// .SH DESCRIPTION .\" ////////////////////////////////////////////////////////////////////////// .P The .BR seccomp_attr_set () function sets the different seccomp filter attributes while the .BR seccomp_attr_get () function fetches the filter attributes. The seccomp filter attributes are tunable values that affect how the library behaves when generating and loading the seccomp filter into the kernel. The attributes are reset to their default values whenever the filter is initialized or reset via .BR seccomp_filter_init () or .BR seccomp_filter_reset (). .P Valid .I attr values are as follows: .TP .B SCMP_FLTATR_ACT_DEFAULT The default filter action as specified in the call to .BR seccomp_filter_init () or .BR seccomp_filter_reset (). This attribute is read-only. .TP .B SCMP_FLTATR_ACT_BADARCH The filter action taken when the loaded filter does not match the architecture of the executing application. Defaults to the .B SCMP_ACT_KILL action. .TP .B SCMP_FLTATR_CTL_NNP A flag to specify if the NO_NEW_PRIVS functionality should be enabled before loading the seccomp filter into the kernel. If set to off ( .I value == 0) then loading the seccomp filter into the kernel will fail if CAP_SYS_ADMIN is not set. Defaults to on ( .I value == 1). .\" ////////////////////////////////////////////////////////////////////////// .SH RETURN VALUE .\" ////////////////////////////////////////////////////////////////////////// Returns zero on success, negative errno values on failure. .\" ////////////////////////////////////////////////////////////////////////// .SH EXAMPLES .\" ////////////////////////////////////////////////////////////////////////// .nf #include int main(int argc, char *argv[]) { int rc; rc = seccomp_init(SCMP_ACT_ALLOW); if (rc < 0) goto out; /* ... */ rc = seccomp_attr_set(SCMP_FLTATR_ACT_BADARCH, SCMP_ACT_TRAP); if (rc < 0) goto out; /* ... */ out: seccomp_release(); return -rc; } .fi .\" ////////////////////////////////////////////////////////////////////////// .SH NOTES .\" ////////////////////////////////////////////////////////////////////////// .P While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter generated by libseccomp. .P The libseccomp project site, with more information and the source code repository, can be found at http://libseccomp.sf.net. This library is currently under development, please report any bugs at the project site or directly to the author. .\" ////////////////////////////////////////////////////////////////////////// .SH AUTHOR .\" ////////////////////////////////////////////////////////////////////////// Paul Moore .\" ////////////////////////////////////////////////////////////////////////// .SH SEE ALSO .\" ////////////////////////////////////////////////////////////////////////// .BR seccomp_init (3), .BR seccomp_reset (3), .BR seccomp_load (3) libseccomp-0.1.0/doc/man/man3/seccomp_rule_add.30000644000000000000000000001634611756732202020077 0ustar rootroot.TH "seccomp_rule_add" 3 "5 April 2012" "paul@paul-moore.com" "libseccomp Documentation" .\" ////////////////////////////////////////////////////////////////////////// .SH NAME .\" ////////////////////////////////////////////////////////////////////////// seccomp_rule_add, seccomp_rule_add_exact \- Add a seccomp filter rule .\" ////////////////////////////////////////////////////////////////////////// .SH SYNOPSIS .\" ////////////////////////////////////////////////////////////////////////// .nf .B #include .sp .BI "int SCMP_SYS(" syscall_name ");" .sp .BI "struct scmp_arg_cmp SCMP_CMP(unsigned int " arg "," .BI " enum scmp_compare " op ", " ... ");" .BI "struct scmp_arg_cmp SCMP_A0(enum scmp_compare " op ", " ... ");" .BI "struct scmp_arg_cmp SCMP_A1(enum scmp_compare " op ", " ... ");" .BI "struct scmp_arg_cmp SCMP_A2(enum scmp_compare " op ", " ... ");" .BI "struct scmp_arg_cmp SCMP_A3(enum scmp_compare " op ", " ... ");" .BI "struct scmp_arg_cmp SCMP_A4(enum scmp_compare " op ", " ... ");" .BI "struct scmp_arg_cmp SCMP_A5(enum scmp_compare " op ", " ... ");" .sp .BI "int seccomp_rule_add(uint32_t " action "," .BI " int " syscall ", unsigned int " arg_cnt ", " ... ");" .BI "int seccomp_rule_add_exact(uint32_t " action "," .BI " int " syscall ", unsigned int " arg_cnt ", " ... ");" .fi .\" ////////////////////////////////////////////////////////////////////////// .SH DESCRIPTION .\" ////////////////////////////////////////////////////////////////////////// .P The .BR seccomp_rule_add () and .BR seccomp_rule_add_exact () functions add a new filter rule to the current seccomp filter. The .BR seccomp_rule_add () function will make a "best effort" to add the rule as specified, but may alter the rule slightly due to architecture specifics, e.g. socket and ipc functions on x86. The .BR seccomp_rule_add_exact () function will attempt to add the rule exactly as specified so it may behave differently on different architectures. While it does not guarantee a exact filter ruleset, .BR seccomp_rule_add () does guarantee the same behavior regardless of the architecture. .P The newly added filter rule does not take effect until the entire filter is loaded into the kernel using .BR seccomp_load (3). .P The .BR SCMP_CMP () and .BR SCMP_A{0-5} () macros generate a scmp_arg_cmp structure for use in .BR seccomp_rule_add () and .BR seccomp_rule_add_exact (). The .BR SCMP_CMP () macro allows the caller to specify an arbitrary argument along with the comparison operator, mask, and datum values where the .BR SCMP_A{0-5} () macros are specific to a certain argument. See the EXAMPLES section below. .P While it is possible to specify the .I syscall value directly using the standard .B __NR_syscall values, in order to ensure proper operation across multiple architectures it is highly recommended to use the .BR SCMP_SYS () macro instead. See the EXAMPLES section below. .P Valid .I action values are as follows: .TP .B SCMP_ACT_KILL The process will be killed by the kernel when it calls a syscall that does not match any of the configured seccomp filter rules. .TP .B SCMP_ACT_TRAP The process will throw a SIGSYS signal when it calls a syscall that does not match any of the configured seccomp filter rules. .TP .B SCMP_ACT_ERRNO(uint16_t errno) The process will receive a return value of .I errno when it calls a syscall that does not match any of the configured seccomp filter rules. .TP .B SCMP_ACT_TRACE(uint16_t msg_num) If the process is being traced and the tracing process specified the .B PTRACE_O_TRACESECCOMP option in the call to .BR ptrace (2), the tracing process will be notified, via .B PTRACE_EVENT_SECCOMP , and the value provided in .I msg_num can be retrieved using the .B PTRACE_GETEVENTMSG option. .TP .B SCMP_ACT_ALLOW The seccomp filter will have no effect on the process calling the syscall if it does not match any of the configured seccomp filter rules. .P Valid comparison .I op values are as follows: .TP .B SCMP_CMP_NE Matches when the argument value is not equal to the datum value, example: .sp SCMP_CMP( .I arg , SCMP_CMP_NE , .I datum ) .TP .B SCMP_CMP_LT Matches when the argument value is less than the datum value, example: .sp SCMP_CMP( .I arg , SCMP_CMP_LT , .I datum ) .TP .B SCMP_CMP_LE Matches when the argument value is less than or equal to the datum value, example: .sp SCMP_CMP( .I arg , SCMP_CMP_LE , .I datum ) .TP .B SCMP_CMP_EQ Matches when the argument value is equal to the datum value, example: .sp SCMP_CMP( .I arg , SCMP_CMP_EQ , .I datum ) .TP .B SCMP_CMP_GE Matches when the argument value is greater than or equal to the datum value, example: .sp SCMP_CMP( .I arg , SCMP_CMP_GE , .I datum ) .TP .B SCMP_CMP_GT Matches when the argument value is greater than the datum value, example: .sp SCMP_CMP( .I arg , SCMP_CMP_GT , .I datum ) .TP .B SCMP_CMP_MASKED_EQ Matches when the masked argument value is equal to the masked datum value, example: .sp SCMP_CMP( .I arg , SCMP_CMP_MASKED_EQ , .I mask , .I datum ) .\" ////////////////////////////////////////////////////////////////////////// .SH RETURN VALUE .\" ////////////////////////////////////////////////////////////////////////// The .BR seccomp_rule_add () and .BR seccomp_rule_add_exact () functions return zero on success, negative errno values on failure. .\" ////////////////////////////////////////////////////////////////////////// .SH EXAMPLES .\" ////////////////////////////////////////////////////////////////////////// .nf #include #include #include #include #define BUF_SIZE 256 int main(int argc, char *argv[]) { int rc; int fd; unsigned char buf[BUF_SIZE]; rc = seccomp_init(SCMP_ACT_KILL); if (rc < 0) goto out; /* ... */ fd = open("file.txt", 0); /* ... */ rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(close), 0); if (rc < 0) goto out; rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(read), 3, SCMP_A0(SCMP_CMP_EQ, fd), SCMP_A1(SCMP_CMP_EQ, (scmp_datum_t)buf), SCMP_A2(SCMP_CMP_LE, BUF_SIZE)); if (rc < 0) goto out; rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(write), 1, SCMP_CMP(0, SCMP_CMP_EQ, fd)); if (rc < 0) goto out; rc = seccomp_load(); if (rc < 0) goto out; /* ... */ out: seccomp_release(); return -rc; } .fi .\" ////////////////////////////////////////////////////////////////////////// .SH NOTES .\" ////////////////////////////////////////////////////////////////////////// .P While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter generated by libseccomp. .P The libseccomp project site, with more information and the source code repository, can be found at http://libseccomp.sf.net. This library is currently under development, please report any bugs at the project site or directly to the author. .\" ////////////////////////////////////////////////////////////////////////// .SH AUTHOR .\" ////////////////////////////////////////////////////////////////////////// Paul Moore .\" ////////////////////////////////////////////////////////////////////////// .SH SEE ALSO .\" ////////////////////////////////////////////////////////////////////////// .BR seccomp_syscall_priority (3), .BR seccomp_load (3) libseccomp-0.1.0/doc/man/man3/seccomp_load.30000644000000000000000000000506711756732202017235 0ustar rootroot.TH "seccomp_load" 3 "5 April 2012" "paul@paul-moore.com" "libseccomp Documentation" .\" ////////////////////////////////////////////////////////////////////////// .SH NAME .\" ////////////////////////////////////////////////////////////////////////// seccomp_load \- Load the current seccomp filter into the kernel .\" ////////////////////////////////////////////////////////////////////////// .SH SYNOPSIS .\" ////////////////////////////////////////////////////////////////////////// .nf .B #include .sp .BI "int seccomp_load(void);" .fi .\" ////////////////////////////////////////////////////////////////////////// .SH DESCRIPTION .\" ////////////////////////////////////////////////////////////////////////// .P Loads the currently configured seccomp filter into the kernel; if the function succeeds the new seccomp filter will be active when the function returns. .\" ////////////////////////////////////////////////////////////////////////// .SH RETURN VALUE .\" ////////////////////////////////////////////////////////////////////////// Returns zero on success, negative errno values on failure. .\" ////////////////////////////////////////////////////////////////////////// .SH EXAMPLES .\" ////////////////////////////////////////////////////////////////////////// .nf #include int main(int argc, char *argv[]) { int rc; rc = seccomp_init(SCMP_ACT_KILL); if (rc < 0) return -rc; /* ... */ rc = seccomp_load(); if (rc < 0) goto out; /* ... */ out: seccomp_release(); return -rc; } .fi .\" ////////////////////////////////////////////////////////////////////////// .SH NOTES .\" ////////////////////////////////////////////////////////////////////////// .P While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter generated by libseccomp. .P The libseccomp project site, with more information and the source code repository, can be found at http://libseccomp.sf.net. This library is currently under development, please report any bugs at the project site or directly to the author. .\" ////////////////////////////////////////////////////////////////////////// .SH AUTHOR .\" ////////////////////////////////////////////////////////////////////////// Paul Moore .\" ////////////////////////////////////////////////////////////////////////// .SH SEE ALSO .\" ////////////////////////////////////////////////////////////////////////// .BR seccomp_init (3), .BR seccomp_reset (3), .BR seccomp_release (3), .BR seccomp_rule_add (3), .BR seccomp_rule_add_exact (3) libseccomp-0.1.0/doc/man/man3/seccomp_rule_add_exact.30000644000000000000000000000003411737351557021257 0ustar rootroot.so man3/seccomp_rule_add.3 libseccomp-0.1.0/doc/man/man3/seccomp_export_pfc.30000644000000000000000000000003611746233754020465 0ustar rootroot.so man3/seccomp_export_bpf.3 libseccomp-0.1.0/doc/man/man3/seccomp_syscall_priority.30000644000000000000000000000676511756732202021737 0ustar rootroot.TH "seccomp_syscall_priority" 3 "5 April 2012" "paul@paul-moore.com" "libseccomp Documentation" .\" ////////////////////////////////////////////////////////////////////////// .SH NAME .\" ////////////////////////////////////////////////////////////////////////// seccomp_syscall_priority \- Prioritize syscalls in the seccomp filter .\" ////////////////////////////////////////////////////////////////////////// .SH SYNOPSIS .\" ////////////////////////////////////////////////////////////////////////// .nf .B #include .sp .BI "int SCMP_SYS(" syscall_name ");" .sp .BI "int seccomp_syscall_priority(int " syscall ", uint8_t " priority ");" .fi .\" ////////////////////////////////////////////////////////////////////////// .SH DESCRIPTION .\" ////////////////////////////////////////////////////////////////////////// .P The .BR seccomp_syscall_priority () function provides a priority hint to the seccomp filter generator in libseccomp such that higher priority syscalls are placed earlier in the seccomp filter code so that they incur less overhead at the expense of lower priority syscalls. A syscall's priority can be set regardless of if any rules currently exist for that syscall; the library will remember the priority and it will be assigned to the syscall if and when a rule for that syscall is created. .P While it is possible to specify the .I syscall value directly using the standard .B __NR_syscall values, in order to ensure proper operation across multiple architectures it is highly recommended to use the .BR SCMP_SYS () macro instead. See the EXAMPLES section below. .P The .I priority parameter takes an 8-bit value ranging from 0 - 255; a higher value represents a higher priority. .\" ////////////////////////////////////////////////////////////////////////// .SH RETURN VALUE .\" ////////////////////////////////////////////////////////////////////////// The .BR seccomp_syscall_priority () function returns zero on success, negative errno values on failure. The .BR SCMP_SYS () macro returns a value suitable for use as the .I syscall value in .BR seccomp_syscall_priority (). .\" ////////////////////////////////////////////////////////////////////////// .SH EXAMPLES .\" ////////////////////////////////////////////////////////////////////////// .nf #include int main(int argc, char *argv[]) { int rc; rc = seccomp_init(SCMP_ACT_KILL); if (rc < 0) goto out; /* ... */ rc = seccomp_syscall_priority(SCMP_SYS(read), 200); if (rc < 0) goto out; /* ... */ out: seccomp_release(); return -rc; } .fi .\" ////////////////////////////////////////////////////////////////////////// .SH NOTES .\" ////////////////////////////////////////////////////////////////////////// .P While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter generated by libseccomp. .P The libseccomp project site, with more information and the source code repository, can be found at http://libseccomp.sf.net. This library is currently under development, please report any bugs at the project site or directly to the author. .\" ////////////////////////////////////////////////////////////////////////// .SH AUTHOR .\" ////////////////////////////////////////////////////////////////////////// Paul Moore .\" ////////////////////////////////////////////////////////////////////////// .SH SEE ALSO .\" ////////////////////////////////////////////////////////////////////////// .BR seccomp_rule_add (3), .BR seccomp_rule_add_exact (3) libseccomp-0.1.0/doc/man/man3/seccomp_init.30000644000000000000000000001013111756732202017245 0ustar rootroot.TH "seccomp_init" 3 "5 April 2012" "paul@paul-moore.com" "libseccomp Documentation" .\" ////////////////////////////////////////////////////////////////////////// .SH NAME .\" ////////////////////////////////////////////////////////////////////////// seccomp_init, seccomp_reset \- Initialize the seccomp filter state .\" ////////////////////////////////////////////////////////////////////////// .SH SYNOPSIS .\" ////////////////////////////////////////////////////////////////////////// .nf .B #include .sp .BI "int seccomp_init(uint32_t " def_action ");" .BI "int seccomp_reset(uint32_t " def_action ");" .fi .\" ////////////////////////////////////////////////////////////////////////// .SH DESCRIPTION .\" ////////////////////////////////////////////////////////////////////////// .P The .BR seccomp_init () and .BR seccomp_reset () functions initialize the internal seccomp filter state, prepares it for use, and sets the default action based on the .I def_action parameter. The .BR seccomp_init () function must be called before any other libseccomp functions as the rest of the library API will fail if the filter state is not initialized properly. The .BR seccomp_reset () function releases the existing filter state before reinitializing it and can only be called after a call to .BR seccomp_init () has succeeded. .P When the caller is finished configuring the seccomp filter and has loaded it into the kernel, the caller should call .BR seccomp_release (3) to release all of the internal filter state. .P Valid .I def_action values are as follows: .TP .B SCMP_ACT_KILL The process will be killed by the kernel when it calls a syscall that does not match any of the configured seccomp filter rules. .TP .B SCMP_ACT_TRAP The process will throw a SIGSYS signal when it calls a syscall that does not match any of the configured seccomp filter rules. .TP .B SCMP_ACT_ERRNO(uint16_t errno) The process will receive a return value of .I errno when it calls a syscall that does not match any of the configured seccomp filter rules. .TP .B SCMP_ACT_TRACE(uint16_t msg_num) If the process is being traced and the tracing process specified the .B PTRACE_O_TRACESECCOMP option in the call to .BR ptrace (2), the tracing process will be notified, via .B PTRACE_EVENT_SECCOMP , and the value provided in .I msg_num can be retrieved using the .B PTRACE_GETEVENTMSG option. .TP .B SCMP_ACT_ALLOW The seccomp filter will have no effect on the process calling the syscall if it does not match any of the configured seccomp filter rules. .\" ////////////////////////////////////////////////////////////////////////// .SH RETURN VALUE .\" ////////////////////////////////////////////////////////////////////////// Returns zero on success, negative errno values on failure. .\" ////////////////////////////////////////////////////////////////////////// .SH EXAMPLES .\" ////////////////////////////////////////////////////////////////////////// .nf #include int main(int argc, char *argv[]) { int rc; rc = seccomp_init(SCMP_ACT_KILL); if (rc < 0) goto out; /* ... */ rc = seccomp_reset(SCMP_ACT_KILL); if (rc < 0) goto out; /* ... */ out: seccomp_release(); return -rc; } .fi .\" ////////////////////////////////////////////////////////////////////////// .SH NOTES .\" ////////////////////////////////////////////////////////////////////////// .P While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter generated by libseccomp. .P The libseccomp project site, with more information and the source code repository, can be found at http://libseccomp.sf.net. This library is currently under development, please report any bugs at the project site or directly to the author. .\" ////////////////////////////////////////////////////////////////////////// .SH AUTHOR .\" ////////////////////////////////////////////////////////////////////////// Paul Moore .\" ////////////////////////////////////////////////////////////////////////// .SH SEE ALSO .\" ////////////////////////////////////////////////////////////////////////// .BR seccomp_release (3) libseccomp-0.1.0/libseccomp.pc.in0000644000000000000000000000175011763665475015426 0ustar rootroot# # Enhanced Seccomp Library pkg-config Configuration # # Copyright (c) 2012 Red Hat # Author: Paul Moore # # # This library is free software; you can redistribute it and/or modify it # under the terms of version 2.1 of the GNU Lesser General Public License as # published by the Free Software Foundation. # # This library is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or # FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License # for more details. # # You should have received a copy of the GNU Lesser General Public License # along with this library; if not, see . # prefix=%%INSTALL_PREFIX%% libdir=%%INSTALL_LIBDIR%% includedir=${prefix}/include Name: libseccomp Description: The enhanced seccomp library URL: http://libseccomp.sf.net Version: %%VERSION_RELEASE%% Cflags: -I${includedir} Libs: -L${libdir} -lseccomp libseccomp-0.1.0/version.h0000644000000000000000000000017111764216124014167 0ustar rootroot/* automatically generated - do not edit */ #ifndef _VERSION_H #define _VERSION_H #define VERSION_RELEASE "0.1.0" #endif