The Tor Browser / annotate

security/sandbox/linux/linux_seccomp.h@6474c204b198 (annotated)

security/sandbox/linux/linux_seccomp.h

Wed, 31 Dec 2014 06:09:35 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Wed, 31 Dec 2014 06:09:35 +0100
changeset 0
6474c204b198
permissions
-rw-r--r--

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

michael@0 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
michael@0 2 // Use of this source code is governed by a BSD-style license that can be
michael@0 3 // found in the LICENSE file.
michael@0 4
michael@0 5 /* This file has been initially imported from
michael@0 6 * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/linux_seccomp.h;h=0de0259da39ecdb745e5923b9a6ff3961c13be00;hb=2362c9abea79cae475921bdeee58f9e3910d211c
michael@0 7 *
michael@0 8 * Contains code for macro for common filters from:
michael@0 9 * http://outflux.net/teach-seccomp/step-5/seccomp-bpf.h
michael@0 10 *
michael@0 11 * Contains code for arch_seccomp_data and arch_sigsys from:
michael@0 12 * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/sandbox_bpf.h;h=3d269916070c97b8be8938503b9b799f12d79ca6;hb=2362c9abea79cae475921bdeee58f9e3910d211c
michael@0 13 *
michael@0 14 * For more information about Seccomp, see also:
michael@0 15 * Documentation/prctl/seccomp_filter.txt and
michael@0 16 * samples/seccomp in the Linux kernel directory, for any kernel >= 3.5.0.
michael@0 17 */
michael@0 18
michael@0 19 #ifndef SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__
michael@0 20 #define SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__
michael@0 21
michael@0 22 struct arch_seccomp_data {
michael@0 23 int nr;
michael@0 24 uint32_t arch;
michael@0 25 uint64_t instruction_pointer;
michael@0 26 uint64_t args[6];
michael@0 27 };
michael@0 28
michael@0 29 struct arch_sigsys {
michael@0 30 void *ip;
michael@0 31 int nr;
michael@0 32 unsigned int arch;
michael@0 33 };
michael@0 34
michael@0 35 // The Seccomp2 kernel ABI is not part of older versions of glibc.
michael@0 36 // As we can't break compilation with these versions of the library,
michael@0 37 // we explicitly define all missing symbols.
michael@0 38 // If we ever decide that we can now rely on system headers, the following
michael@0 39 // include files should be enabled:
michael@0 40 // #include <linux/audit.h>
michael@0 41 // #include <linux/seccomp.h>
michael@0 42
michael@0 43 #include <asm/unistd.h>
michael@0 44 #include <linux/filter.h>
michael@0 45
michael@0 46 // From <linux/elf.h> and <linux/audit.h>
michael@0 47 // This is necessary as we can't expect recent audit headers.
michael@0 48 #ifndef EM_ARM
michael@0 49 #define EM_ARM 40
michael@0 50 #endif
michael@0 51 #ifndef EM_386
michael@0 52 #define EM_386 3
michael@0 53 #endif
michael@0 54 #ifndef EM_X86_64
michael@0 55 #define EM_X86_64 62
michael@0 56 #endif
michael@0 57
michael@0 58 #ifndef __AUDIT_ARCH_64BIT
michael@0 59 #define __AUDIT_ARCH_64BIT 0x80000000
michael@0 60 #endif
michael@0 61 #ifndef __AUDIT_ARCH_LE
michael@0 62 #define __AUDIT_ARCH_LE 0x40000000
michael@0 63 #endif
michael@0 64 #ifndef AUDIT_ARCH_ARM
michael@0 65 #define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE)
michael@0 66 #endif
michael@0 67 #ifndef AUDIT_ARCH_I386
michael@0 68 #define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE)
michael@0 69 #endif
michael@0 70 #ifndef AUDIT_ARCH_X86_64
michael@0 71 #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
michael@0 72 #endif
michael@0 73
michael@0 74 // From <linux/prctl.h>
michael@0 75 // This is necessary as we can't expect recent prctl headers.
michael@0 76 #ifndef PR_SET_SECCOMP
michael@0 77 #define PR_SET_SECCOMP 22
michael@0 78 #define PR_GET_SECCOMP 21
michael@0 79 #endif
michael@0 80 #ifndef PR_SET_NO_NEW_PRIVS
michael@0 81 #define PR_SET_NO_NEW_PRIVS 38
michael@0 82 #define PR_GET_NO_NEW_PRIVS 39
michael@0 83 #endif
michael@0 84 #ifndef IPC_64
michael@0 85 #define IPC_64 0x0100
michael@0 86 #endif
michael@0 87
michael@0 88 #ifndef BPF_MOD
michael@0 89 #define BPF_MOD 0x90
michael@0 90 #endif
michael@0 91 #ifndef BPF_XOR
michael@0 92 #define BPF_XOR 0xA0
michael@0 93 #endif
michael@0 94
michael@0 95 // From <linux/seccomp.h>
michael@0 96 // This is necessary as we can't expect recent seccomp headers.
michael@0 97 #ifndef SECCOMP_MODE_FILTER
michael@0 98 #define SECCOMP_MODE_DISABLED 0
michael@0 99 #define SECCOMP_MODE_STRICT 1
michael@0 100 #define SECCOMP_MODE_FILTER 2 // User user-supplied filter (seccomp-bpf)
michael@0 101 #endif
michael@0 102
michael@0 103 #ifndef SECCOMP_RET_KILL
michael@0 104 // Return values supported for BPF filter programs. Please note that the
michael@0 105 // "illegal" SECCOMP_RET_INVALID is not supported by the kernel, should only
michael@0 106 // ever be used internally, and would result in the kernel killing our process.
michael@0 107 #define SECCOMP_RET_KILL 0x00000000U // Kill the task immediately
michael@0 108 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value
michael@0 109 #define SECCOMP_RET_TRAP 0x00030000U // Disallow and force a SIGSYS
michael@0 110 #define SECCOMP_RET_ERRNO 0x00050000U // Returns an errno
michael@0 111 #define SECCOMP_RET_TRACE 0x7ff00000U // Pass to a tracer or disallow
michael@0 112 #define SECCOMP_RET_ALLOW 0x7fff0000U // Allow
michael@0 113 #define SECCOMP_RET_ACTION 0xffff0000U // Masks for the return value
michael@0 114 #define SECCOMP_RET_DATA 0x0000ffffU // sections
michael@0 115 #else
michael@0 116 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value
michael@0 117 #endif
michael@0 118
michael@0 119 #ifndef SYS_SECCOMP
michael@0 120 #define SYS_SECCOMP 1
michael@0 121 #endif
michael@0 122
michael@0 123 // Impose some reasonable maximum BPF program size. Realistically, the
michael@0 124 // kernel probably has much lower limits. But by limiting to less than
michael@0 125 // 30 bits, we can ease requirements on some of our data types.
michael@0 126 #define SECCOMP_MAX_PROGRAM_SIZE (1<<30)
michael@0 127
michael@0 128 #if defined(__i386__)
michael@0 129 #define MIN_SYSCALL 0u
michael@0 130 #define MAX_PUBLIC_SYSCALL 1024u
michael@0 131 #define MAX_SYSCALL MAX_PUBLIC_SYSCALL
michael@0 132 #define SECCOMP_ARCH AUDIT_ARCH_I386
michael@0 133
michael@0 134 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)])
michael@0 135 #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, REG_EAX)
michael@0 136 #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, REG_EAX)
michael@0 137 #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, REG_EIP)
michael@0 138 #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, REG_EBX)
michael@0 139 #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, REG_ECX)
michael@0 140 #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, REG_EDX)
michael@0 141 #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, REG_ESI)
michael@0 142 #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, REG_EDI)
michael@0 143 #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, REG_EBP)
michael@0 144 #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr))
michael@0 145 #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch))
michael@0 146 #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \
michael@0 147 instruction_pointer) + 4)
michael@0 148 #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \
michael@0 149 instruction_pointer) + 0)
michael@0 150 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
michael@0 151 8*(nr) + 4)
michael@0 152 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
michael@0 153 8*(nr) + 0)
michael@0 154
michael@0 155 #elif defined(__x86_64__)
michael@0 156 #define MIN_SYSCALL 0u
michael@0 157 #define MAX_PUBLIC_SYSCALL 1024u
michael@0 158 #define MAX_SYSCALL MAX_PUBLIC_SYSCALL
michael@0 159 #define SECCOMP_ARCH AUDIT_ARCH_X86_64
michael@0 160
michael@0 161 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)])
michael@0 162 #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, REG_RAX)
michael@0 163 #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, REG_RAX)
michael@0 164 #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, REG_RIP)
michael@0 165 #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, REG_RDI)
michael@0 166 #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, REG_RSI)
michael@0 167 #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, REG_RDX)
michael@0 168 #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, REG_R10)
michael@0 169 #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, REG_R8)
michael@0 170 #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, REG_R9)
michael@0 171 #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr))
michael@0 172 #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch))
michael@0 173 #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \
michael@0 174 instruction_pointer) + 4)
michael@0 175 #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \
michael@0 176 instruction_pointer) + 0)
michael@0 177 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
michael@0 178 8*(nr) + 4)
michael@0 179 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
michael@0 180 8*(nr) + 0)
michael@0 181
michael@0 182 #elif defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__))
michael@0 183 // ARM EABI includes "ARM private" system calls starting at |__ARM_NR_BASE|,
michael@0 184 // and a "ghost syscall private to the kernel", cmpxchg,
michael@0 185 // at |__ARM_NR_BASE+0x00fff0|.
michael@0 186 // See </arch/arm/include/asm/unistd.h> in the Linux kernel.
michael@0 187 #define MIN_SYSCALL ((unsigned int)__NR_SYSCALL_BASE)
michael@0 188 #define MAX_PUBLIC_SYSCALL (MIN_SYSCALL + 1024u)
michael@0 189 #define MIN_PRIVATE_SYSCALL ((unsigned int)__ARM_NR_BASE)
michael@0 190 #define MAX_PRIVATE_SYSCALL (MIN_PRIVATE_SYSCALL + 16u)
michael@0 191 #define MIN_GHOST_SYSCALL ((unsigned int)__ARM_NR_BASE + 0xfff0u)
michael@0 192 #define MAX_SYSCALL (MIN_GHOST_SYSCALL + 4u)
michael@0 193
michael@0 194 #define SECCOMP_ARCH AUDIT_ARCH_ARM
michael@0 195
michael@0 196 // ARM sigcontext_t is different from i386/x86_64.
michael@0 197 // See </arch/arm/include/asm/sigcontext.h> in the Linux kernel.
michael@0 198 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.arm_##_reg)
michael@0 199 // ARM EABI syscall convention.
michael@0 200 #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, r0)
michael@0 201 #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, r7)
michael@0 202 #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, pc)
michael@0 203 #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, r0)
michael@0 204 #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, r1)
michael@0 205 #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, r2)
michael@0 206 #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, r3)
michael@0 207 #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, r4)
michael@0 208 #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, r5)
michael@0 209 #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr))
michael@0 210 #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch))
michael@0 211 #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \
michael@0 212 instruction_pointer) + 4)
michael@0 213 #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \
michael@0 214 instruction_pointer) + 0)
michael@0 215 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
michael@0 216 8*(nr) + 4)
michael@0 217 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
michael@0 218 8*(nr) + 0)
michael@0 219
michael@0 220 #else
michael@0 221 #error Unsupported target platform
michael@0 222
michael@0 223 #endif
michael@0 224
michael@0 225 /* Macros to common filters */
michael@0 226 #define VALIDATE_ARCHITECTURE \
michael@0 227 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_ARCH_IDX), \
michael@0 228 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_ARCH, 1, 0), \
michael@0 229 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
michael@0 230
michael@0 231 #define EXAMINE_SYSCALL \
michael@0 232 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_NR_IDX)
michael@0 233
michael@0 234 #define ALLOW_SYSCALL(name) \
michael@0 235 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
michael@0 236 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
michael@0 237
michael@0 238 #if defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__))
michael@0 239 #define ALLOW_ARM_SYSCALL(name) \
michael@0 240 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __ARM_NR_##name, 0, 1), \
michael@0 241 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
michael@0 242 #endif
michael@0 243
michael@0 244 #define DENY_KILL_SYSCALL(name) \
michael@0 245 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
michael@0 246 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
michael@0 247
michael@0 248 #define DENY_SYSCALL(name, err) \
michael@0 249 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
michael@0 250 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO + err)
michael@0 251
michael@0 252 #define KILL_PROCESS \
michael@0 253 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
michael@0 254
michael@0 255 #define TRAP_PROCESS \
michael@0 256 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP)
michael@0 257
michael@0 258 #define ALLOW_PROCESS \
michael@0 259 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
michael@0 260
michael@0 261 #define TRACE_PROCESS \
michael@0 262 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRACE)
michael@0 263
michael@0 264 #define ERRNO_PROCESS \
michael@0 265 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO)
michael@0 266
michael@0 267 #endif // SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial