index : 0x2lib

        

            
            
        
        
0#!/bin/python
1
2# This program records syscalls. Either from a specific point in your program
3# or just from the start.
4#
5# It works in two steps: Recording syscalls and creating an white-list, ready to paste into your
6# Jai code.
7#
8# In case you want to only restrict syscalls from a specific point on, set this marker
9# in any place of your program:
10#
11#     ```
12#     log("---- SECCOMP BOUNDARY ----");
13#     ```
14#
15#
16# First step, recording:
17#
18#     ```
19#     ./seccomp_collect_syscalls.py -r your_program <optional args for your program>
20#     ```
21#
22# After that, it depends if you have a boundary marker in your program.
23# With boundary marker:
24#
25#     ```
26#     ./seccomp_collect_syscalls.py -p strace.txt
27#     ```
28#
29# Without boundary marker:
30#
31#     ```
32#     ./seccomp_collect_syscalls.py -i -p strace.txt
33#     ```
34#
35# Well, you can pass `-i` even with a boundary marker, it will ignore it anyway.
36
37
38import subprocess
39
40import os
41from sys import exit, argv
42from pathlib import Path
43
44
45ignore_marker = False
46
47
48HELP = """Usage: syscalls.py [OPTIONS] [FP]
49
50OPTIONS
51    -r <program path>           Records syscalls
52    -p <strace output file>     Prints the used syscalls from your 'strace.txt'.
53                                If the path is omitted, it looks after 'strace.txt'
54                                in your current directory.
55
56    -i                          Ignore boundary marker when using `-p`
57"""
58
59STRACE_OUTPUT_FP = Path("strace.txt")
60SCMP_BOUNDARY_MARKER = "---- SECCOMP BOUNDARY ----"
61
62
63
64def main(args):
65    global ignore_marker
66
67    if len(args) == 1:
68        print(HELP)
69        exit(1)
70
71    if "h" in args[1] or "help" in args[1]:
72        print(HELP)
73        exit(0)
74
75    if args[1] == "-r":
76        if len(args) < 3:
77            print("Need filepath to program")
78            exit(1)
79
80        strace_run(args[2:])
81
82    if args[1] == "-p":
83        fp = STRACE_OUTPUT_FP if len(args) == 2 else args[2]
84        fp = Path(fp)
85        ignore_marker = "-i" in args
86        gather_unique_syscalls(fp)
87
88    print("Unknown argument")
89    exit(1)
90
91
92def strace_run(program):
93    cmd = [
94        "strace",
95        "-o",
96        STRACE_OUTPUT_FP,
97        *program
98    ]
99    run_command(cmd)
100    exit(0)
101
102
103def gather_unique_syscalls(fp):
104    global ignore_marker
105
106    if not fp.exists():
107        print("File does not exist:", fp)
108        exit(1)
109
110    content = open_file_or_exit(fp)
111    boundary_idx = next(
112        (i for i, s in enumerate(content) if SCMP_BOUNDARY_MARKER in s), None
113    )
114
115    if not ignore_marker:
116        if boundary_idx == None:
117            print("Cannot find seccomp boundary marker")
118            exit(1)
119
120        boundary_idx += 1
121        content = content[boundary_idx:]
122    else:
123        boundary_idx = 0
124
125    syscalls = set()
126
127    for i, line in enumerate(content):
128        idx = line.find("(")
129
130        if idx == -1:
131            syscall = f"[ERR: at line {i + boundary_idx}]"
132            continue
133        else:
134            syscall = line[:idx]
135
136        syscalls.add(syscall)
137
138    program_fn = os.path.basename(__file__)
139    print(f"/** Copy pasta from {program_fn} */")
140    print("SECCOMP_ALLOWED_SYSCALLS :: string.[")
141
142    for item in syscalls:
143        code = f'    "{item.upper()}",'
144        print(code)
145
146    print("];")
147    exit(0)
148
149
150def run_command(cmd):
151    try:
152        subprocess.run(cmd, text=True, check=True)
153    except subprocess.CalledProcessError as e:
154        print(f"Command failed {e.returncode}: {e.stderr}")
155        exit(1)
156
157
158def open_file_or_exit(fp):
159    try:
160        with open(fp, 'r', encoding="utf8") as f:
161            return f.readlines()
162    except Exception as e:
163        print(e)
164        exit(1)
165
166
167if __name__ == "__main__":
168    args = argv
169
170    try:
171        main(args)
172    except KeyboardInterrupt:
173        print("Terminated by user")
174        exit(1)
175
176
177
178# ------------------------------------------------------------------------------
179# This software is available under 2 licenses -- choose whichever you prefer.
180# ------------------------------------------------------------------------------
181# ALTERNATIVE A - MIT License
182# Copyright (c) 2026  Adam Blazeowsky
183# Permission is hereby granted, free of charge, to any person obtaining a copy of
184# this software and associated documentation files (the "Software"), to deal in
185# the Software without restriction, including without limitation the rights to
186# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
187# of the Software, and to permit persons to whom the Software is furnished to do
188# so, subject to the following conditions:
189# The above copyright notice and this permission notice shall be included in all
190# copies or substantial portions of the Software.
191# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
192# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
193# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
194# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
195# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
196# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
197# SOFTWARE.
198# ------------------------------------------------------------------------------
199# ALTERNATIVE B - Public Domain (www.unlicense.org)
200# This is free and unencumbered software released into the public domain.
201# Anyone is free to copy, modify, publish, use, compile, sell, or distribute this
202# software, either in source code form or as a compiled binary, for any purpose,
203# commercial or non-commercial, and by any means.
204# In jurisdictions that recognize copyright laws, the author or authors of this
205# software dedicate any and all copyright interest in the software to the public
206# domain. We make this dedication for the benefit of the public at large and to
207# the detriment of our heirs and successors. We intend this dedication to be an
208# overt act of relinquishment in perpetuity of all present and future rights to
209# this software under copyright law.
210# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
211# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
212# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
213# AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
214# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
215# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
216# ------------------------------------------------------------------------------
217
218