seccomp : log non authorized syscall

Signed-off-by: hanen mizouni <[email protected]>

include/packetgraph/common.h

@@ -65,5 +65,5 @@ static inline enum pg_side pg_flip_side(enum pg_side side)
  * @return 0 if the filter has been correctly build, -1 on the contrary.
  */
 int pg_init_seccomp(void);
-
+int init_seccomp_filters(void);
 #endif /* _PG_COMMON_H */

include/packetgraph/seccomp-bpf.h

@@ -34,6 +34,8 @@ struct seccomp_data {
 };
 #endif
 
+extern int errno;
+
 #define syscall_nr (offsetof(struct seccomp_data, nr))
 #define arch_nr (offsetof(struct seccomp_data, arch))
 
@@ -61,5 +63,9 @@ struct seccomp_data {
 #define KILL_PROCESS \
  BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
 
+#define TRAP_PROCESS \
+ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_getppid, 0, 1), \
+ BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP)
+
 #endif /* SECCOMP_BPF_H */
 

src/seccomp.c

@@ -17,8 +17,11 @@
 
 #include <packetgraph/common.h>
 #include <packetgraph/seccomp-bpf.h>
+#include <errno.h>
+#include <signal.h>
+#include <string.h>
 
-int pg_init_seccomp(void)
+int init_seccomp_filters(void)
 {
  struct sock_filter filter[] = {
  VALIDATE_ARCHITECTURE,
@@ -81,17 +84,59 @@ int pg_init_seccomp(void)
  ALLOW_SYSCALL(gettimeofday),
  ALLOW_SYSCALL(stat),
  ALLOW_SYSCALL(clock_gettime),
+ ALLOW_SYSCALL(mprotect),
+ ALLOW_SYSCALL(rt_sigreturn),
+ ALLOW_SYSCALL(epoll_create),
+ ALLOW_SYSCALL(epoll_ctl),
+ ALLOW_SYSCALL(epoll_wait),
+ ALLOW_SYSCALL(getsockopt),
+ ALLOW_SYSCALL(setsockopt),
+ ALLOW_SYSCALL(readlink),
+ ALLOW_SYSCALL(prlimit64),
+ ALLOW_SYSCALL(memfd_create),
+ ALLOW_SYSCALL(timerfd_create),
+ ALLOW_SYSCALL(uname),
+ ALLOW_SYSCALL(iopl),
 
- KILL_PROCESS,
+ TRAP_PROCESS,
  };
  struct sock_fprog prog = {
  .len = (unsigned short)(sizeof(filter) / sizeof(*filter)),
  .filter = filter,
  };
-
- if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
+ if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
  return -1;
- if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
+ if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) == 0)
  return -1;
  return 0;
 }
+/*
+ * * Catch violations so we see, which system call caused the problems
+ * *
+ */
+static void catchViolation(int sig, siginfo_t *si, void *void_context)
+{
+ int old_errno = errno;
+
+ printf("Attempted banned syscall number [%d] and sig [%d]\n",
+ si->si_syscall, sig);
+ errno = old_errno;
+}
+/*
+ * * Setup error handling
+ * *
+ */
+static void init_error_handling(void)
+{
+ struct sigaction sa = { .sa_sigaction = catchViolation,
+ .sa_flags = SA_SIGINFO | SA_NODEFER };
+
+ if (sigaction(SIGSYS, &sa, NULL))
+ printf("Failed to configure SIGSYS handler [%s]\n",
+ strerror(errno));
+}
+int pg_init_seccomp(void)
+{
+ init_error_handling();
+ return init_seccomp_filters();
+}