michael@0: // Copyright (c) 2012 The Chromium Authors. All rights reserved.
michael@0: // Use of this source code is governed by a BSD-style license that can be
michael@0: // found in the LICENSE file.
michael@0: 
michael@0: /* This file has been initially imported from
michael@0:  * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/linux_seccomp.h;h=0de0259da39ecdb745e5923b9a6ff3961c13be00;hb=2362c9abea79cae475921bdeee58f9e3910d211c
michael@0:  *
michael@0:  * Contains code for macro for common filters from:
michael@0:  * http://outflux.net/teach-seccomp/step-5/seccomp-bpf.h
michael@0:  *
michael@0:  * Contains code for arch_seccomp_data and arch_sigsys from:
michael@0:  * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/sandbox_bpf.h;h=3d269916070c97b8be8938503b9b799f12d79ca6;hb=2362c9abea79cae475921bdeee58f9e3910d211c
michael@0:  *
michael@0:  * For more information about Seccomp, see also:
michael@0:  * Documentation/prctl/seccomp_filter.txt and
michael@0:  * samples/seccomp in the Linux kernel directory, for any kernel >= 3.5.0.
michael@0:  */
michael@0: 
michael@0: #ifndef SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__
michael@0: #define SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__
michael@0: 
michael@0: struct arch_seccomp_data {
michael@0:   int      nr;
michael@0:   uint32_t arch;
michael@0:   uint64_t instruction_pointer;
michael@0:   uint64_t args[6];
michael@0: };
michael@0: 
michael@0: struct arch_sigsys {
michael@0:   void         *ip;
michael@0:   int          nr;
michael@0:   unsigned int arch;
michael@0: };
michael@0: 
michael@0: // The Seccomp2 kernel ABI is not part of older versions of glibc.
michael@0: // As we can't break compilation with these versions of the library,
michael@0: // we explicitly define all missing symbols.
michael@0: // If we ever decide that we can now rely on system headers, the following
michael@0: // include files should be enabled:
michael@0: // #include <linux/audit.h>
michael@0: // #include <linux/seccomp.h>
michael@0: 
michael@0: #include <asm/unistd.h>
michael@0: #include <linux/filter.h>
michael@0: 
michael@0: // From <linux/elf.h> and <linux/audit.h>
michael@0: // This is necessary as we can't expect recent audit headers.
michael@0: #ifndef EM_ARM
michael@0: #define EM_ARM    40
michael@0: #endif
michael@0: #ifndef EM_386
michael@0: #define EM_386    3
michael@0: #endif
michael@0: #ifndef EM_X86_64
michael@0: #define EM_X86_64 62
michael@0: #endif
michael@0: 
michael@0: #ifndef __AUDIT_ARCH_64BIT
michael@0: #define __AUDIT_ARCH_64BIT 0x80000000
michael@0: #endif
michael@0: #ifndef __AUDIT_ARCH_LE
michael@0: #define __AUDIT_ARCH_LE    0x40000000
michael@0: #endif
michael@0: #ifndef AUDIT_ARCH_ARM
michael@0: #define AUDIT_ARCH_ARM    (EM_ARM|__AUDIT_ARCH_LE)
michael@0: #endif
michael@0: #ifndef AUDIT_ARCH_I386
michael@0: #define AUDIT_ARCH_I386   (EM_386|__AUDIT_ARCH_LE)
michael@0: #endif
michael@0: #ifndef AUDIT_ARCH_X86_64
michael@0: #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE)
michael@0: #endif
michael@0: 
michael@0: // From <linux/prctl.h>
michael@0: // This is necessary as we can't expect recent prctl headers.
michael@0: #ifndef PR_SET_SECCOMP
michael@0: #define PR_SET_SECCOMP               22
michael@0: #define PR_GET_SECCOMP               21
michael@0: #endif
michael@0: #ifndef PR_SET_NO_NEW_PRIVS
michael@0: #define PR_SET_NO_NEW_PRIVS          38
michael@0: #define PR_GET_NO_NEW_PRIVS          39
michael@0: #endif
michael@0: #ifndef IPC_64
michael@0: #define IPC_64                   0x0100
michael@0: #endif
michael@0: 
michael@0: #ifndef BPF_MOD
michael@0: #define BPF_MOD                    0x90
michael@0: #endif
michael@0: #ifndef BPF_XOR
michael@0: #define BPF_XOR                    0xA0
michael@0: #endif
michael@0: 
michael@0: // From <linux/seccomp.h>
michael@0: // This is necessary as we can't expect recent seccomp headers.
michael@0: #ifndef SECCOMP_MODE_FILTER
michael@0: #define SECCOMP_MODE_DISABLED         0
michael@0: #define SECCOMP_MODE_STRICT           1
michael@0: #define SECCOMP_MODE_FILTER           2  // User user-supplied filter (seccomp-bpf)
michael@0: #endif
michael@0: 
michael@0: #ifndef SECCOMP_RET_KILL
michael@0: // Return values supported for BPF filter programs. Please note that the
michael@0: // "illegal" SECCOMP_RET_INVALID is not supported by the kernel, should only
michael@0: // ever be used internally, and would result in the kernel killing our process.
michael@0: #define SECCOMP_RET_KILL    0x00000000U  // Kill the task immediately
michael@0: #define SECCOMP_RET_INVALID 0x00010000U  // Illegal return value
michael@0: #define SECCOMP_RET_TRAP    0x00030000U  // Disallow and force a SIGSYS
michael@0: #define SECCOMP_RET_ERRNO   0x00050000U  // Returns an errno
michael@0: #define SECCOMP_RET_TRACE   0x7ff00000U  // Pass to a tracer or disallow
michael@0: #define SECCOMP_RET_ALLOW   0x7fff0000U  // Allow
michael@0: #define SECCOMP_RET_ACTION  0xffff0000U  // Masks for the return value
michael@0: #define SECCOMP_RET_DATA    0x0000ffffU  //   sections
michael@0: #else
michael@0: #define SECCOMP_RET_INVALID 0x00010000U  // Illegal return value
michael@0: #endif
michael@0: 
michael@0: #ifndef SYS_SECCOMP
michael@0: #define SYS_SECCOMP                   1
michael@0: #endif
michael@0: 
michael@0: // Impose some reasonable maximum BPF program size. Realistically, the
michael@0: // kernel probably has much lower limits. But by limiting to less than
michael@0: // 30 bits, we can ease requirements on some of our data types.
michael@0: #define SECCOMP_MAX_PROGRAM_SIZE (1<<30)
michael@0: 
michael@0: #if defined(__i386__)
michael@0: #define MIN_SYSCALL         0u
michael@0: #define MAX_PUBLIC_SYSCALL  1024u
michael@0: #define MAX_SYSCALL         MAX_PUBLIC_SYSCALL
michael@0: #define SECCOMP_ARCH        AUDIT_ARCH_I386
michael@0: 
michael@0: #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)])
michael@0: #define SECCOMP_RESULT(_ctx)    SECCOMP_REG(_ctx, REG_EAX)
michael@0: #define SECCOMP_SYSCALL(_ctx)   SECCOMP_REG(_ctx, REG_EAX)
michael@0: #define SECCOMP_IP(_ctx)        SECCOMP_REG(_ctx, REG_EIP)
michael@0: #define SECCOMP_PARM1(_ctx)     SECCOMP_REG(_ctx, REG_EBX)
michael@0: #define SECCOMP_PARM2(_ctx)     SECCOMP_REG(_ctx, REG_ECX)
michael@0: #define SECCOMP_PARM3(_ctx)     SECCOMP_REG(_ctx, REG_EDX)
michael@0: #define SECCOMP_PARM4(_ctx)     SECCOMP_REG(_ctx, REG_ESI)
michael@0: #define SECCOMP_PARM5(_ctx)     SECCOMP_REG(_ctx, REG_EDI)
michael@0: #define SECCOMP_PARM6(_ctx)     SECCOMP_REG(_ctx, REG_EBP)
michael@0: #define SECCOMP_NR_IDX          (offsetof(struct arch_seccomp_data, nr))
michael@0: #define SECCOMP_ARCH_IDX        (offsetof(struct arch_seccomp_data, arch))
michael@0: #define SECCOMP_IP_MSB_IDX      (offsetof(struct arch_seccomp_data,           \
michael@0:                                           instruction_pointer) + 4)
michael@0: #define SECCOMP_IP_LSB_IDX      (offsetof(struct arch_seccomp_data,           \
michael@0:                                           instruction_pointer) + 0)
michael@0: #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) +   \
michael@0:                                  8*(nr) + 4)
michael@0: #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) +   \
michael@0:                                  8*(nr) + 0)
michael@0: 
michael@0: #elif defined(__x86_64__)
michael@0: #define MIN_SYSCALL         0u
michael@0: #define MAX_PUBLIC_SYSCALL  1024u
michael@0: #define MAX_SYSCALL         MAX_PUBLIC_SYSCALL
michael@0: #define SECCOMP_ARCH        AUDIT_ARCH_X86_64
michael@0: 
michael@0: #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)])
michael@0: #define SECCOMP_RESULT(_ctx)    SECCOMP_REG(_ctx, REG_RAX)
michael@0: #define SECCOMP_SYSCALL(_ctx)   SECCOMP_REG(_ctx, REG_RAX)
michael@0: #define SECCOMP_IP(_ctx)        SECCOMP_REG(_ctx, REG_RIP)
michael@0: #define SECCOMP_PARM1(_ctx)     SECCOMP_REG(_ctx, REG_RDI)
michael@0: #define SECCOMP_PARM2(_ctx)     SECCOMP_REG(_ctx, REG_RSI)
michael@0: #define SECCOMP_PARM3(_ctx)     SECCOMP_REG(_ctx, REG_RDX)
michael@0: #define SECCOMP_PARM4(_ctx)     SECCOMP_REG(_ctx, REG_R10)
michael@0: #define SECCOMP_PARM5(_ctx)     SECCOMP_REG(_ctx, REG_R8)
michael@0: #define SECCOMP_PARM6(_ctx)     SECCOMP_REG(_ctx, REG_R9)
michael@0: #define SECCOMP_NR_IDX          (offsetof(struct arch_seccomp_data, nr))
michael@0: #define SECCOMP_ARCH_IDX        (offsetof(struct arch_seccomp_data, arch))
michael@0: #define SECCOMP_IP_MSB_IDX      (offsetof(struct arch_seccomp_data,           \
michael@0:                                           instruction_pointer) + 4)
michael@0: #define SECCOMP_IP_LSB_IDX      (offsetof(struct arch_seccomp_data,           \
michael@0:                                           instruction_pointer) + 0)
michael@0: #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) +   \
michael@0:                                  8*(nr) + 4)
michael@0: #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) +   \
michael@0:                                  8*(nr) + 0)
michael@0: 
michael@0: #elif defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__))
michael@0: // ARM EABI includes "ARM private" system calls starting at |__ARM_NR_BASE|,
michael@0: // and a "ghost syscall private to the kernel", cmpxchg,
michael@0: // at |__ARM_NR_BASE+0x00fff0|.
michael@0: // See </arch/arm/include/asm/unistd.h> in the Linux kernel.
michael@0: #define MIN_SYSCALL         ((unsigned int)__NR_SYSCALL_BASE)
michael@0: #define MAX_PUBLIC_SYSCALL  (MIN_SYSCALL + 1024u)
michael@0: #define MIN_PRIVATE_SYSCALL ((unsigned int)__ARM_NR_BASE)
michael@0: #define MAX_PRIVATE_SYSCALL (MIN_PRIVATE_SYSCALL + 16u)
michael@0: #define MIN_GHOST_SYSCALL   ((unsigned int)__ARM_NR_BASE + 0xfff0u)
michael@0: #define MAX_SYSCALL         (MIN_GHOST_SYSCALL + 4u)
michael@0: 
michael@0: #define SECCOMP_ARCH AUDIT_ARCH_ARM
michael@0: 
michael@0: // ARM sigcontext_t is different from i386/x86_64.
michael@0: // See </arch/arm/include/asm/sigcontext.h> in the Linux kernel.
michael@0: #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.arm_##_reg)
michael@0: // ARM EABI syscall convention.
michael@0: #define SECCOMP_RESULT(_ctx)    SECCOMP_REG(_ctx, r0)
michael@0: #define SECCOMP_SYSCALL(_ctx)   SECCOMP_REG(_ctx, r7)
michael@0: #define SECCOMP_IP(_ctx)        SECCOMP_REG(_ctx, pc)
michael@0: #define SECCOMP_PARM1(_ctx)     SECCOMP_REG(_ctx, r0)
michael@0: #define SECCOMP_PARM2(_ctx)     SECCOMP_REG(_ctx, r1)
michael@0: #define SECCOMP_PARM3(_ctx)     SECCOMP_REG(_ctx, r2)
michael@0: #define SECCOMP_PARM4(_ctx)     SECCOMP_REG(_ctx, r3)
michael@0: #define SECCOMP_PARM5(_ctx)     SECCOMP_REG(_ctx, r4)
michael@0: #define SECCOMP_PARM6(_ctx)     SECCOMP_REG(_ctx, r5)
michael@0: #define SECCOMP_NR_IDX          (offsetof(struct arch_seccomp_data, nr))
michael@0: #define SECCOMP_ARCH_IDX        (offsetof(struct arch_seccomp_data, arch))
michael@0: #define SECCOMP_IP_MSB_IDX      (offsetof(struct arch_seccomp_data,           \
michael@0:                                           instruction_pointer) + 4)
michael@0: #define SECCOMP_IP_LSB_IDX      (offsetof(struct arch_seccomp_data,           \
michael@0:                                           instruction_pointer) + 0)
michael@0: #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) +   \
michael@0:                                  8*(nr) + 4)
michael@0: #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) +   \
michael@0:                                  8*(nr) + 0)
michael@0: 
michael@0: #else
michael@0: #error Unsupported target platform
michael@0: 
michael@0: #endif
michael@0: 
michael@0: /* Macros to common filters */
michael@0: #define VALIDATE_ARCHITECTURE \
michael@0:         BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_ARCH_IDX), \
michael@0:         BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_ARCH, 1, 0), \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
michael@0: 
michael@0: #define EXAMINE_SYSCALL \
michael@0:         BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_NR_IDX)
michael@0: 
michael@0: #define ALLOW_SYSCALL(name) \
michael@0:         BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
michael@0: 
michael@0: #if defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__))
michael@0: #define ALLOW_ARM_SYSCALL(name) \
michael@0:         BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __ARM_NR_##name, 0, 1), \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
michael@0: #endif
michael@0: 
michael@0: #define DENY_KILL_SYSCALL(name) \
michael@0:         BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
michael@0: 
michael@0: #define DENY_SYSCALL(name, err) \
michael@0:         BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO + err)
michael@0: 
michael@0: #define KILL_PROCESS \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
michael@0: 
michael@0: #define TRAP_PROCESS \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP)
michael@0: 
michael@0: #define ALLOW_PROCESS \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
michael@0: 
michael@0: #define TRACE_PROCESS \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRACE)
michael@0: 
michael@0: #define ERRNO_PROCESS \
michael@0:         BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO)
michael@0: 
michael@0: #endif  // SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__