security/sandbox/linux/linux_seccomp.h@141e0f1194b1
security/sandbox/linux/linux_seccomp.h
Wed, 31 Dec 2014 07:16:47 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 07:16:47 +0100
- branch
- TOR_BUG_9701
- changeset 3
- 141e0f1194b1
- permissions
- -rw-r--r--
Revert simplistic fix pending revisit of Mozilla integration attempt.
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 /* This file has been initially imported from
6 * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/linux_seccomp.h;h=0de0259da39ecdb745e5923b9a6ff3961c13be00;hb=2362c9abea79cae475921bdeee58f9e3910d211c
7 *
8 * Contains code for macro for common filters from:
9 * http://outflux.net/teach-seccomp/step-5/seccomp-bpf.h
10 *
11 * Contains code for arch_seccomp_data and arch_sigsys from:
12 * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/sandbox_bpf.h;h=3d269916070c97b8be8938503b9b799f12d79ca6;hb=2362c9abea79cae475921bdeee58f9e3910d211c
13 *
14 * For more information about Seccomp, see also:
15 * Documentation/prctl/seccomp_filter.txt and
16 * samples/seccomp in the Linux kernel directory, for any kernel >= 3.5.0.
17 */
19 #ifndef SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__
20 #define SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__
22 struct arch_seccomp_data {
23 int nr;
24 uint32_t arch;
25 uint64_t instruction_pointer;
26 uint64_t args[6];
27 };
29 struct arch_sigsys {
30 void *ip;
31 int nr;
32 unsigned int arch;
33 };
35 // The Seccomp2 kernel ABI is not part of older versions of glibc.
36 // As we can't break compilation with these versions of the library,
37 // we explicitly define all missing symbols.
38 // If we ever decide that we can now rely on system headers, the following
39 // include files should be enabled:
40 // #include <linux/audit.h>
41 // #include <linux/seccomp.h>
43 #include <asm/unistd.h>
44 #include <linux/filter.h>
46 // From <linux/elf.h> and <linux/audit.h>
47 // This is necessary as we can't expect recent audit headers.
48 #ifndef EM_ARM
49 #define EM_ARM 40
50 #endif
51 #ifndef EM_386
52 #define EM_386 3
53 #endif
54 #ifndef EM_X86_64
55 #define EM_X86_64 62
56 #endif
58 #ifndef __AUDIT_ARCH_64BIT
59 #define __AUDIT_ARCH_64BIT 0x80000000
60 #endif
61 #ifndef __AUDIT_ARCH_LE
62 #define __AUDIT_ARCH_LE 0x40000000
63 #endif
64 #ifndef AUDIT_ARCH_ARM
65 #define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE)
66 #endif
67 #ifndef AUDIT_ARCH_I386
68 #define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE)
69 #endif
70 #ifndef AUDIT_ARCH_X86_64
71 #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
72 #endif
74 // From <linux/prctl.h>
75 // This is necessary as we can't expect recent prctl headers.
76 #ifndef PR_SET_SECCOMP
77 #define PR_SET_SECCOMP 22
78 #define PR_GET_SECCOMP 21
79 #endif
80 #ifndef PR_SET_NO_NEW_PRIVS
81 #define PR_SET_NO_NEW_PRIVS 38
82 #define PR_GET_NO_NEW_PRIVS 39
83 #endif
84 #ifndef IPC_64
85 #define IPC_64 0x0100
86 #endif
88 #ifndef BPF_MOD
89 #define BPF_MOD 0x90
90 #endif
91 #ifndef BPF_XOR
92 #define BPF_XOR 0xA0
93 #endif
95 // From <linux/seccomp.h>
96 // This is necessary as we can't expect recent seccomp headers.
97 #ifndef SECCOMP_MODE_FILTER
98 #define SECCOMP_MODE_DISABLED 0
99 #define SECCOMP_MODE_STRICT 1
100 #define SECCOMP_MODE_FILTER 2 // User user-supplied filter (seccomp-bpf)
101 #endif
103 #ifndef SECCOMP_RET_KILL
104 // Return values supported for BPF filter programs. Please note that the
105 // "illegal" SECCOMP_RET_INVALID is not supported by the kernel, should only
106 // ever be used internally, and would result in the kernel killing our process.
107 #define SECCOMP_RET_KILL 0x00000000U // Kill the task immediately
108 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value
109 #define SECCOMP_RET_TRAP 0x00030000U // Disallow and force a SIGSYS
110 #define SECCOMP_RET_ERRNO 0x00050000U // Returns an errno
111 #define SECCOMP_RET_TRACE 0x7ff00000U // Pass to a tracer or disallow
112 #define SECCOMP_RET_ALLOW 0x7fff0000U // Allow
113 #define SECCOMP_RET_ACTION 0xffff0000U // Masks for the return value
114 #define SECCOMP_RET_DATA 0x0000ffffU // sections
115 #else
116 #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value
117 #endif
119 #ifndef SYS_SECCOMP
120 #define SYS_SECCOMP 1
121 #endif
123 // Impose some reasonable maximum BPF program size. Realistically, the
124 // kernel probably has much lower limits. But by limiting to less than
125 // 30 bits, we can ease requirements on some of our data types.
126 #define SECCOMP_MAX_PROGRAM_SIZE (1<<30)
128 #if defined(__i386__)
129 #define MIN_SYSCALL 0u
130 #define MAX_PUBLIC_SYSCALL 1024u
131 #define MAX_SYSCALL MAX_PUBLIC_SYSCALL
132 #define SECCOMP_ARCH AUDIT_ARCH_I386
134 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)])
135 #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, REG_EAX)
136 #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, REG_EAX)
137 #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, REG_EIP)
138 #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, REG_EBX)
139 #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, REG_ECX)
140 #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, REG_EDX)
141 #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, REG_ESI)
142 #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, REG_EDI)
143 #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, REG_EBP)
144 #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr))
145 #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch))
146 #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \
147 instruction_pointer) + 4)
148 #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \
149 instruction_pointer) + 0)
150 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
151 8*(nr) + 4)
152 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
153 8*(nr) + 0)
155 #elif defined(__x86_64__)
156 #define MIN_SYSCALL 0u
157 #define MAX_PUBLIC_SYSCALL 1024u
158 #define MAX_SYSCALL MAX_PUBLIC_SYSCALL
159 #define SECCOMP_ARCH AUDIT_ARCH_X86_64
161 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)])
162 #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, REG_RAX)
163 #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, REG_RAX)
164 #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, REG_RIP)
165 #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, REG_RDI)
166 #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, REG_RSI)
167 #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, REG_RDX)
168 #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, REG_R10)
169 #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, REG_R8)
170 #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, REG_R9)
171 #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr))
172 #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch))
173 #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \
174 instruction_pointer) + 4)
175 #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \
176 instruction_pointer) + 0)
177 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
178 8*(nr) + 4)
179 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
180 8*(nr) + 0)
182 #elif defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__))
183 // ARM EABI includes "ARM private" system calls starting at |__ARM_NR_BASE|,
184 // and a "ghost syscall private to the kernel", cmpxchg,
185 // at |__ARM_NR_BASE+0x00fff0|.
186 // See </arch/arm/include/asm/unistd.h> in the Linux kernel.
187 #define MIN_SYSCALL ((unsigned int)__NR_SYSCALL_BASE)
188 #define MAX_PUBLIC_SYSCALL (MIN_SYSCALL + 1024u)
189 #define MIN_PRIVATE_SYSCALL ((unsigned int)__ARM_NR_BASE)
190 #define MAX_PRIVATE_SYSCALL (MIN_PRIVATE_SYSCALL + 16u)
191 #define MIN_GHOST_SYSCALL ((unsigned int)__ARM_NR_BASE + 0xfff0u)
192 #define MAX_SYSCALL (MIN_GHOST_SYSCALL + 4u)
194 #define SECCOMP_ARCH AUDIT_ARCH_ARM
196 // ARM sigcontext_t is different from i386/x86_64.
197 // See </arch/arm/include/asm/sigcontext.h> in the Linux kernel.
198 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.arm_##_reg)
199 // ARM EABI syscall convention.
200 #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, r0)
201 #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, r7)
202 #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, pc)
203 #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, r0)
204 #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, r1)
205 #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, r2)
206 #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, r3)
207 #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, r4)
208 #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, r5)
209 #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr))
210 #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch))
211 #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \
212 instruction_pointer) + 4)
213 #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \
214 instruction_pointer) + 0)
215 #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
216 8*(nr) + 4)
217 #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \
218 8*(nr) + 0)
220 #else
221 #error Unsupported target platform
223 #endif
225 /* Macros to common filters */
226 #define VALIDATE_ARCHITECTURE \
227 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_ARCH_IDX), \
228 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_ARCH, 1, 0), \
229 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
231 #define EXAMINE_SYSCALL \
232 BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_NR_IDX)
234 #define ALLOW_SYSCALL(name) \
235 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
236 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
238 #if defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__))
239 #define ALLOW_ARM_SYSCALL(name) \
240 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __ARM_NR_##name, 0, 1), \
241 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
242 #endif
244 #define DENY_KILL_SYSCALL(name) \
245 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
246 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
248 #define DENY_SYSCALL(name, err) \
249 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
250 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO + err)
252 #define KILL_PROCESS \
253 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
255 #define TRAP_PROCESS \
256 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP)
258 #define ALLOW_PROCESS \
259 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
261 #define TRACE_PROCESS \
262 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRACE)
264 #define ERRNO_PROCESS \
265 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO)
267 #endif // SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__
