The Tor Browser / file comparison
comparison: security/sandbox/linux/linux_seccomp.h
security/sandbox/linux/linux_seccomp.h
- branch
- TOR_BUG_9701
- changeset 3
- 141e0f1194b1
equal
deleted
inserted
replaced
| -1:000000000000 | 0:ea77d858b2cb |
|---|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 /* This file has been initially imported from | |
| 6 * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/linux_seccomp.h;h=0de0259da39ecdb745e5923b9a6ff3961c13be00;hb=2362c9abea79cae475921bdeee58f9e3910d211c | |
| 7 * | |
| 8 * Contains code for macro for common filters from: | |
| 9 * http://outflux.net/teach-seccomp/step-5/seccomp-bpf.h | |
| 10 * | |
| 11 * Contains code for arch_seccomp_data and arch_sigsys from: | |
| 12 * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/sandbox_bpf.h;h=3d269916070c97b8be8938503b9b799f12d79ca6;hb=2362c9abea79cae475921bdeee58f9e3910d211c | |
| 13 * | |
| 14 * For more information about Seccomp, see also: | |
| 15 * Documentation/prctl/seccomp_filter.txt and | |
| 16 * samples/seccomp in the Linux kernel directory, for any kernel >= 3.5.0. | |
| 17 */ | |
| 18 | |
| 19 #ifndef SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__ | |
| 20 #define SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__ | |
| 21 | |
| 22 struct arch_seccomp_data { | |
| 23 int nr; | |
| 24 uint32_t arch; | |
| 25 uint64_t instruction_pointer; | |
| 26 uint64_t args[6]; | |
| 27 }; | |
| 28 | |
| 29 struct arch_sigsys { | |
| 30 void *ip; | |
| 31 int nr; | |
| 32 unsigned int arch; | |
| 33 }; | |
| 34 | |
| 35 // The Seccomp2 kernel ABI is not part of older versions of glibc. | |
| 36 // As we can't break compilation with these versions of the library, | |
| 37 // we explicitly define all missing symbols. | |
| 38 // If we ever decide that we can now rely on system headers, the following | |
| 39 // include files should be enabled: | |
| 40 // #include <linux/audit.h> | |
| 41 // #include <linux/seccomp.h> | |
| 42 | |
| 43 #include <asm/unistd.h> | |
| 44 #include <linux/filter.h> | |
| 45 | |
| 46 // From <linux/elf.h> and <linux/audit.h> | |
| 47 // This is necessary as we can't expect recent audit headers. | |
| 48 #ifndef EM_ARM | |
| 49 #define EM_ARM 40 | |
| 50 #endif | |
| 51 #ifndef EM_386 | |
| 52 #define EM_386 3 | |
| 53 #endif | |
| 54 #ifndef EM_X86_64 | |
| 55 #define EM_X86_64 62 | |
| 56 #endif | |
| 57 | |
| 58 #ifndef __AUDIT_ARCH_64BIT | |
| 59 #define __AUDIT_ARCH_64BIT 0x80000000 | |
| 60 #endif | |
| 61 #ifndef __AUDIT_ARCH_LE | |
| 62 #define __AUDIT_ARCH_LE 0x40000000 | |
| 63 #endif | |
| 64 #ifndef AUDIT_ARCH_ARM | |
| 65 #define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE) | |
| 66 #endif | |
| 67 #ifndef AUDIT_ARCH_I386 | |
| 68 #define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE) | |
| 69 #endif | |
| 70 #ifndef AUDIT_ARCH_X86_64 | |
| 71 #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) | |
| 72 #endif | |
| 73 | |
| 74 // From <linux/prctl.h> | |
| 75 // This is necessary as we can't expect recent prctl headers. | |
| 76 #ifndef PR_SET_SECCOMP | |
| 77 #define PR_SET_SECCOMP 22 | |
| 78 #define PR_GET_SECCOMP 21 | |
| 79 #endif | |
| 80 #ifndef PR_SET_NO_NEW_PRIVS | |
| 81 #define PR_SET_NO_NEW_PRIVS 38 | |
| 82 #define PR_GET_NO_NEW_PRIVS 39 | |
| 83 #endif | |
| 84 #ifndef IPC_64 | |
| 85 #define IPC_64 0x0100 | |
| 86 #endif | |
| 87 | |
| 88 #ifndef BPF_MOD | |
| 89 #define BPF_MOD 0x90 | |
| 90 #endif | |
| 91 #ifndef BPF_XOR | |
| 92 #define BPF_XOR 0xA0 | |
| 93 #endif | |
| 94 | |
| 95 // From <linux/seccomp.h> | |
| 96 // This is necessary as we can't expect recent seccomp headers. | |
| 97 #ifndef SECCOMP_MODE_FILTER | |
| 98 #define SECCOMP_MODE_DISABLED 0 | |
| 99 #define SECCOMP_MODE_STRICT 1 | |
| 100 #define SECCOMP_MODE_FILTER 2 // User user-supplied filter (seccomp-bpf) | |
| 101 #endif | |
| 102 | |
| 103 #ifndef SECCOMP_RET_KILL | |
| 104 // Return values supported for BPF filter programs. Please note that the | |
| 105 // "illegal" SECCOMP_RET_INVALID is not supported by the kernel, should only | |
| 106 // ever be used internally, and would result in the kernel killing our process. | |
| 107 #define SECCOMP_RET_KILL 0x00000000U // Kill the task immediately | |
| 108 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value | |
| 109 #define SECCOMP_RET_TRAP 0x00030000U // Disallow and force a SIGSYS | |
| 110 #define SECCOMP_RET_ERRNO 0x00050000U // Returns an errno | |
| 111 #define SECCOMP_RET_TRACE 0x7ff00000U // Pass to a tracer or disallow | |
| 112 #define SECCOMP_RET_ALLOW 0x7fff0000U // Allow | |
| 113 #define SECCOMP_RET_ACTION 0xffff0000U // Masks for the return value | |
| 114 #define SECCOMP_RET_DATA 0x0000ffffU // sections | |
| 115 #else | |
| 116 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value | |
| 117 #endif | |
| 118 | |
| 119 #ifndef SYS_SECCOMP | |
| 120 #define SYS_SECCOMP 1 | |
| 121 #endif | |
| 122 | |
| 123 // Impose some reasonable maximum BPF program size. Realistically, the | |
| 124 // kernel probably has much lower limits. But by limiting to less than | |
| 125 // 30 bits, we can ease requirements on some of our data types. | |
| 126 #define SECCOMP_MAX_PROGRAM_SIZE (1<<30) | |
| 127 | |
| 128 #if defined(__i386__) | |
| 129 #define MIN_SYSCALL 0u | |
| 130 #define MAX_PUBLIC_SYSCALL 1024u | |
| 131 #define MAX_SYSCALL MAX_PUBLIC_SYSCALL | |
| 132 #define SECCOMP_ARCH AUDIT_ARCH_I386 | |
| 133 | |
| 134 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)]) | |
| 135 #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, REG_EAX) | |
| 136 #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, REG_EAX) | |
| 137 #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, REG_EIP) | |
| 138 #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, REG_EBX) | |
| 139 #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, REG_ECX) | |
| 140 #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, REG_EDX) | |
| 141 #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, REG_ESI) | |
| 142 #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, REG_EDI) | |
| 143 #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, REG_EBP) | |
| 144 #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr)) | |
| 145 #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch)) | |
| 146 #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \ | |
| 147 instruction_pointer) + 4) | |
| 148 #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \ | |
| 149 instruction_pointer) + 0) | |
| 150 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ | |
| 151 8*(nr) + 4) | |
| 152 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ | |
| 153 8*(nr) + 0) | |
| 154 | |
| 155 #elif defined(__x86_64__) | |
| 156 #define MIN_SYSCALL 0u | |
| 157 #define MAX_PUBLIC_SYSCALL 1024u | |
| 158 #define MAX_SYSCALL MAX_PUBLIC_SYSCALL | |
| 159 #define SECCOMP_ARCH AUDIT_ARCH_X86_64 | |
| 160 | |
| 161 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)]) | |
| 162 #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, REG_RAX) | |
| 163 #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, REG_RAX) | |
| 164 #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, REG_RIP) | |
| 165 #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, REG_RDI) | |
| 166 #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, REG_RSI) | |
| 167 #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, REG_RDX) | |
| 168 #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, REG_R10) | |
| 169 #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, REG_R8) | |
| 170 #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, REG_R9) | |
| 171 #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr)) | |
| 172 #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch)) | |
| 173 #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \ | |
| 174 instruction_pointer) + 4) | |
| 175 #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \ | |
| 176 instruction_pointer) + 0) | |
| 177 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ | |
| 178 8*(nr) + 4) | |
| 179 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ | |
| 180 8*(nr) + 0) | |
| 181 | |
| 182 #elif defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__)) | |
| 183 // ARM EABI includes "ARM private" system calls starting at |__ARM_NR_BASE|, | |
| 184 // and a "ghost syscall private to the kernel", cmpxchg, | |
| 185 // at |__ARM_NR_BASE+0x00fff0|. | |
| 186 // See </arch/arm/include/asm/unistd.h> in the Linux kernel. | |
| 187 #define MIN_SYSCALL ((unsigned int)__NR_SYSCALL_BASE) | |
| 188 #define MAX_PUBLIC_SYSCALL (MIN_SYSCALL + 1024u) | |
| 189 #define MIN_PRIVATE_SYSCALL ((unsigned int)__ARM_NR_BASE) | |
| 190 #define MAX_PRIVATE_SYSCALL (MIN_PRIVATE_SYSCALL + 16u) | |
| 191 #define MIN_GHOST_SYSCALL ((unsigned int)__ARM_NR_BASE + 0xfff0u) | |
| 192 #define MAX_SYSCALL (MIN_GHOST_SYSCALL + 4u) | |
| 193 | |
| 194 #define SECCOMP_ARCH AUDIT_ARCH_ARM | |
| 195 | |
| 196 // ARM sigcontext_t is different from i386/x86_64. | |
| 197 // See </arch/arm/include/asm/sigcontext.h> in the Linux kernel. | |
| 198 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.arm_##_reg) | |
| 199 // ARM EABI syscall convention. | |
| 200 #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, r0) | |
| 201 #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, r7) | |
| 202 #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, pc) | |
| 203 #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, r0) | |
| 204 #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, r1) | |
| 205 #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, r2) | |
| 206 #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, r3) | |
| 207 #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, r4) | |
| 208 #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, r5) | |
| 209 #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr)) | |
| 210 #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch)) | |
| 211 #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \ | |
| 212 instruction_pointer) + 4) | |
| 213 #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \ | |
| 214 instruction_pointer) + 0) | |
| 215 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ | |
| 216 8*(nr) + 4) | |
| 217 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ | |
| 218 8*(nr) + 0) | |
| 219 | |
| 220 #else | |
| 221 #error Unsupported target platform | |
| 222 | |
| 223 #endif | |
| 224 | |
| 225 /* Macros to common filters */ | |
| 226 #define VALIDATE_ARCHITECTURE \ | |
| 227 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_ARCH_IDX), \ | |
| 228 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_ARCH, 1, 0), \ | |
| 229 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) | |
| 230 | |
| 231 #define EXAMINE_SYSCALL \ | |
| 232 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_NR_IDX) | |
| 233 | |
| 234 #define ALLOW_SYSCALL(name) \ | |
| 235 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \ | |
| 236 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) | |
| 237 | |
| 238 #if defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__)) | |
| 239 #define ALLOW_ARM_SYSCALL(name) \ | |
| 240 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __ARM_NR_##name, 0, 1), \ | |
| 241 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) | |
| 242 #endif | |
| 243 | |
| 244 #define DENY_KILL_SYSCALL(name) \ | |
| 245 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \ | |
| 246 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) | |
| 247 | |
| 248 #define DENY_SYSCALL(name, err) \ | |
| 249 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \ | |
| 250 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO + err) | |
| 251 | |
| 252 #define KILL_PROCESS \ | |
| 253 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) | |
| 254 | |
| 255 #define TRAP_PROCESS \ | |
| 256 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP) | |
| 257 | |
| 258 #define ALLOW_PROCESS \ | |
| 259 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) | |
| 260 | |
| 261 #define TRACE_PROCESS \ | |
| 262 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRACE) | |
| 263 | |
| 264 #define ERRNO_PROCESS \ | |
| 265 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO) | |
| 266 | |
| 267 #endif // SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__ |
