index : 0x2lib

        

            
            
        
        
0
1/*
2This example is a bit sophisticated, because I'm showing a way how to
3set up a white-list using metaprogramming capabilities from Jai.
4
5For generating a white-list of syscalls you can use my tool in
6`tools/seccomp_collect_syscalls.py`.
7
8This records via `strace` syscalls and prints a ready to use array you can copy/paste here.
9Sometimes you want to only restrict syscalls from a specific point, in that case the same
10tool looks after a specific marker and only after that it will record syscalls.
11
12You can just print this marker in any place of your program:
13
14    log("---- SECCOMP BOUNDARY ----");
15
16
17Look at `sec_seccomp_init()` how to set this up.
18
19*/
20
21
22
23run :: () {
24    log("Seccomp pre init. Writing to a FD is allowed!");
25    sec_seccomp_init();
26    log("Seccomp post init. Writing to a FD is NOT allowed!");
27    log("If you can read this, something went wrong!");
28}
29
30
31#scope_file
32
33
34SECCOMP_ARMED :: true;
35
36/** Copy pasta from seccomp_collect_syscalls.py */
37SECCOMP_ALLOWED_SYSCALLS :: string.[
38    "READ",
39    "PREAD64",
40    "SET_ROBUST_LIST",
41    "BRK",
42    "RT_SIGACTION",
43    "RSEQ",
44    "ACCESS",
45    //! "WRITE",   /** Disallow writing to a FD so we can test it! */
46    "ARCH_PRCTL",
47    "PRLIMIT64",
48    "READLINKAT",
49    "CLOSE",
50    "SECCOMP",
51    "SET_TID_ADDRESS",
52    "FSTAT",
53    "PRCTL",
54    "FUTEX",
55    "GETRANDOM",
56    "MUNMAP",
57    "NEWFSTATAT",
58    "MMAP",
59    "OPENAT",
60    "MPROTECT",
61    "EXECVE",
62];
63
64
65sec_seccomp_init :: () {
66    SECCOMP_TEMPLATE :: "had_error |= seccomp_rule_add(ctx, .ALLOW, .%);\n";
67
68    #if SECCOMP_ARMED {
69        /** Tell seccomp what to do if a violation happened. */
70        ctx := seccomp_init(.KILL_PROCESS);
71    } else {
72        /** For development, you can just log violations. You can view them here:
73
74                ausearch -m SECCOMP
75
76        */
77        ctx := seccomp_init(.LOG);
78    }
79    defer seccomp_release(ctx);
80
81    if !ctx { log_error("Init failed"); exit(1); }
82
83    had_error := false;
84
85    /** This generates the `seccomp_rule_add()` functions based of the white-list. */
86    #insert -> string {
87        buf: String_Builder;
88        for SECCOMP_ALLOWED_SYSCALLS {
89            template := tprint(SECCOMP_TEMPLATE, it);
90            append(*buf, template);
91        }
92        s := builder_to_string(*buf);
93        return s;
94    }
95
96    /** You can also add rules here. */
97    had_error |= seccomp_rule_add(ctx, .ALLOW, .EXIT);
98    had_error |= seccomp_rule_add(ctx, .ALLOW, .EXIT_GROUP);
99
100    if had_error {
101        log_error("Could not add rules.");
102        exit(1);
103    }
104
105    if seccomp_load(ctx) < 0 {
106        log_error("Could not load context into kernel");
107        exit(1);
108    }
109
110    #if SECCOMP_ARMED then log("Seccomp is armed.");
111    else log("Seccomp is in log mode! NOT ARMED!");
112
113    /** After this point every syscall not in the white-list is blocked. */
114}
115
116
117#import "Basic";
118#import,file "../0x2_Seccomp.jai";
119
120