// Copyright (c) 2012 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. /* This file has been initially imported from * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/linux_seccomp.h;h=0de0259da39ecdb745e5923b9a6ff3961c13be00;hb=2362c9abea79cae475921bdeee58f9e3910d211c * * Contains code for macro for common filters from: * http://outflux.net/teach-seccomp/step-5/seccomp-bpf.h * * Contains code for arch_seccomp_data and arch_sigsys from: * http://git.chromium.org/gitweb/?p=chromium.git;a=blob;f=sandbox/linux/seccomp-bpf/sandbox_bpf.h;h=3d269916070c97b8be8938503b9b799f12d79ca6;hb=2362c9abea79cae475921bdeee58f9e3910d211c * * For more information about Seccomp, see also: * Documentation/prctl/seccomp_filter.txt and * samples/seccomp in the Linux kernel directory, for any kernel >= 3.5.0. */ #ifndef SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__ #define SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__ struct arch_seccomp_data { int nr; uint32_t arch; uint64_t instruction_pointer; uint64_t args[6]; }; struct arch_sigsys { void *ip; int nr; unsigned int arch; }; // The Seccomp2 kernel ABI is not part of older versions of glibc. // As we can't break compilation with these versions of the library, // we explicitly define all missing symbols. // If we ever decide that we can now rely on system headers, the following // include files should be enabled: // #include // #include #include #include // From and // This is necessary as we can't expect recent audit headers. #ifndef EM_ARM #define EM_ARM 40 #endif #ifndef EM_386 #define EM_386 3 #endif #ifndef EM_X86_64 #define EM_X86_64 62 #endif #ifndef __AUDIT_ARCH_64BIT #define __AUDIT_ARCH_64BIT 0x80000000 #endif #ifndef __AUDIT_ARCH_LE #define __AUDIT_ARCH_LE 0x40000000 #endif #ifndef AUDIT_ARCH_ARM #define AUDIT_ARCH_ARM (EM_ARM|__AUDIT_ARCH_LE) #endif #ifndef AUDIT_ARCH_I386 #define AUDIT_ARCH_I386 (EM_386|__AUDIT_ARCH_LE) #endif #ifndef AUDIT_ARCH_X86_64 #define AUDIT_ARCH_X86_64 (EM_X86_64|__AUDIT_ARCH_64BIT|__AUDIT_ARCH_LE) #endif // From // This is necessary as we can't expect recent prctl headers. #ifndef PR_SET_SECCOMP #define PR_SET_SECCOMP 22 #define PR_GET_SECCOMP 21 #endif #ifndef PR_SET_NO_NEW_PRIVS #define PR_SET_NO_NEW_PRIVS 38 #define PR_GET_NO_NEW_PRIVS 39 #endif #ifndef IPC_64 #define IPC_64 0x0100 #endif #ifndef BPF_MOD #define BPF_MOD 0x90 #endif #ifndef BPF_XOR #define BPF_XOR 0xA0 #endif // From // This is necessary as we can't expect recent seccomp headers. #ifndef SECCOMP_MODE_FILTER #define SECCOMP_MODE_DISABLED 0 #define SECCOMP_MODE_STRICT 1 #define SECCOMP_MODE_FILTER 2 // User user-supplied filter (seccomp-bpf) #endif #ifndef SECCOMP_RET_KILL // Return values supported for BPF filter programs. Please note that the // "illegal" SECCOMP_RET_INVALID is not supported by the kernel, should only // ever be used internally, and would result in the kernel killing our process. #define SECCOMP_RET_KILL 0x00000000U // Kill the task immediately #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value #define SECCOMP_RET_TRAP 0x00030000U // Disallow and force a SIGSYS #define SECCOMP_RET_ERRNO 0x00050000U // Returns an errno #define SECCOMP_RET_TRACE 0x7ff00000U // Pass to a tracer or disallow #define SECCOMP_RET_ALLOW 0x7fff0000U // Allow #define SECCOMP_RET_ACTION 0xffff0000U // Masks for the return value #define SECCOMP_RET_DATA 0x0000ffffU // sections #else #define SECCOMP_RET_INVALID 0x00010000U // Illegal return value #endif #ifndef SYS_SECCOMP #define SYS_SECCOMP 1 #endif // Impose some reasonable maximum BPF program size. Realistically, the // kernel probably has much lower limits. But by limiting to less than // 30 bits, we can ease requirements on some of our data types. #define SECCOMP_MAX_PROGRAM_SIZE (1<<30) #if defined(__i386__) #define MIN_SYSCALL 0u #define MAX_PUBLIC_SYSCALL 1024u #define MAX_SYSCALL MAX_PUBLIC_SYSCALL #define SECCOMP_ARCH AUDIT_ARCH_I386 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)]) #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, REG_EAX) #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, REG_EAX) #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, REG_EIP) #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, REG_EBX) #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, REG_ECX) #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, REG_EDX) #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, REG_ESI) #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, REG_EDI) #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, REG_EBP) #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr)) #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch)) #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \ instruction_pointer) + 4) #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \ instruction_pointer) + 0) #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ 8*(nr) + 4) #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ 8*(nr) + 0) #elif defined(__x86_64__) #define MIN_SYSCALL 0u #define MAX_PUBLIC_SYSCALL 1024u #define MAX_SYSCALL MAX_PUBLIC_SYSCALL #define SECCOMP_ARCH AUDIT_ARCH_X86_64 #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)]) #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, REG_RAX) #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, REG_RAX) #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, REG_RIP) #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, REG_RDI) #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, REG_RSI) #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, REG_RDX) #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, REG_R10) #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, REG_R8) #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, REG_R9) #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr)) #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch)) #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \ instruction_pointer) + 4) #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \ instruction_pointer) + 0) #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ 8*(nr) + 4) #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ 8*(nr) + 0) #elif defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__)) // ARM EABI includes "ARM private" system calls starting at |__ARM_NR_BASE|, // and a "ghost syscall private to the kernel", cmpxchg, // at |__ARM_NR_BASE+0x00fff0|. // See in the Linux kernel. #define MIN_SYSCALL ((unsigned int)__NR_SYSCALL_BASE) #define MAX_PUBLIC_SYSCALL (MIN_SYSCALL + 1024u) #define MIN_PRIVATE_SYSCALL ((unsigned int)__ARM_NR_BASE) #define MAX_PRIVATE_SYSCALL (MIN_PRIVATE_SYSCALL + 16u) #define MIN_GHOST_SYSCALL ((unsigned int)__ARM_NR_BASE + 0xfff0u) #define MAX_SYSCALL (MIN_GHOST_SYSCALL + 4u) #define SECCOMP_ARCH AUDIT_ARCH_ARM // ARM sigcontext_t is different from i386/x86_64. // See in the Linux kernel. #define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.arm_##_reg) // ARM EABI syscall convention. #define SECCOMP_RESULT(_ctx) SECCOMP_REG(_ctx, r0) #define SECCOMP_SYSCALL(_ctx) SECCOMP_REG(_ctx, r7) #define SECCOMP_IP(_ctx) SECCOMP_REG(_ctx, pc) #define SECCOMP_PARM1(_ctx) SECCOMP_REG(_ctx, r0) #define SECCOMP_PARM2(_ctx) SECCOMP_REG(_ctx, r1) #define SECCOMP_PARM3(_ctx) SECCOMP_REG(_ctx, r2) #define SECCOMP_PARM4(_ctx) SECCOMP_REG(_ctx, r3) #define SECCOMP_PARM5(_ctx) SECCOMP_REG(_ctx, r4) #define SECCOMP_PARM6(_ctx) SECCOMP_REG(_ctx, r5) #define SECCOMP_NR_IDX (offsetof(struct arch_seccomp_data, nr)) #define SECCOMP_ARCH_IDX (offsetof(struct arch_seccomp_data, arch)) #define SECCOMP_IP_MSB_IDX (offsetof(struct arch_seccomp_data, \ instruction_pointer) + 4) #define SECCOMP_IP_LSB_IDX (offsetof(struct arch_seccomp_data, \ instruction_pointer) + 0) #define SECCOMP_ARG_MSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ 8*(nr) + 4) #define SECCOMP_ARG_LSB_IDX(nr) (offsetof(struct arch_seccomp_data, args) + \ 8*(nr) + 0) #else #error Unsupported target platform #endif /* Macros to common filters */ #define VALIDATE_ARCHITECTURE \ BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_ARCH_IDX), \ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_ARCH, 1, 0), \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) #define EXAMINE_SYSCALL \ BPF_STMT(BPF_LD+BPF_W+BPF_ABS, SECCOMP_NR_IDX) #define ALLOW_SYSCALL(name) \ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) #if defined(__arm__) && (defined(__thumb__) || defined(__ARM_EABI__)) #define ALLOW_ARM_SYSCALL(name) \ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __ARM_NR_##name, 0, 1), \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) #endif #define DENY_KILL_SYSCALL(name) \ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) #define DENY_SYSCALL(name, err) \ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO + err) #define KILL_PROCESS \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) #define TRAP_PROCESS \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP) #define ALLOW_PROCESS \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) #define TRACE_PROCESS \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRACE) #define ERRNO_PROCESS \ BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO) #endif // SANDBOX_LINUX_SECCOMP_BPF_LINUX_SECCOMP_H__