1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2 #pragma once
3
4 #if HAVE_SECCOMP
5
6 #include <seccomp.h>
7 #include <stdbool.h>
8 #include <stdint.h>
9
10 #include "errno-list.h"
11 #include "parse-util.h"
12 #include "set.h"
13 #include "string-util.h"
14
15 const char* seccomp_arch_to_string(uint32_t c);
16 int seccomp_arch_from_string(const char *n, uint32_t *ret);
17
18 int seccomp_init_for_arch(scmp_filter_ctx *ret, uint32_t arch, uint32_t default_action);
19
20 bool is_seccomp_available(void);
21
22 typedef struct SyscallFilterSet {
23 const char *name;
24 const char *help;
25 const char *value;
26 } SyscallFilterSet;
27
28 enum {
29 /* Please leave DEFAULT first and KNOWN last, but sort the rest alphabetically */
30 SYSCALL_FILTER_SET_DEFAULT,
31 SYSCALL_FILTER_SET_AIO,
32 SYSCALL_FILTER_SET_BASIC_IO,
33 SYSCALL_FILTER_SET_CHOWN,
34 SYSCALL_FILTER_SET_CLOCK,
35 SYSCALL_FILTER_SET_CPU_EMULATION,
36 SYSCALL_FILTER_SET_DEBUG,
37 SYSCALL_FILTER_SET_FILE_SYSTEM,
38 SYSCALL_FILTER_SET_IO_EVENT,
39 SYSCALL_FILTER_SET_IPC,
40 SYSCALL_FILTER_SET_KEYRING,
41 SYSCALL_FILTER_SET_MEMLOCK,
42 SYSCALL_FILTER_SET_MODULE,
43 SYSCALL_FILTER_SET_MOUNT,
44 SYSCALL_FILTER_SET_NETWORK_IO,
45 SYSCALL_FILTER_SET_OBSOLETE,
46 SYSCALL_FILTER_SET_PKEY,
47 SYSCALL_FILTER_SET_PRIVILEGED,
48 SYSCALL_FILTER_SET_PROCESS,
49 SYSCALL_FILTER_SET_RAW_IO,
50 SYSCALL_FILTER_SET_REBOOT,
51 SYSCALL_FILTER_SET_RESOURCES,
52 SYSCALL_FILTER_SET_SETUID,
53 SYSCALL_FILTER_SET_SIGNAL,
54 SYSCALL_FILTER_SET_SWAP,
55 SYSCALL_FILTER_SET_SYNC,
56 SYSCALL_FILTER_SET_SYSTEM_SERVICE,
57 SYSCALL_FILTER_SET_TIMER,
58 SYSCALL_FILTER_SET_KNOWN,
59 _SYSCALL_FILTER_SET_MAX
60 };
61
62 extern const SyscallFilterSet syscall_filter_sets[];
63
64 const SyscallFilterSet *syscall_filter_set_find(const char *name);
65
66 int seccomp_filter_set_add(Hashmap *s, bool b, const SyscallFilterSet *set);
67
68 int seccomp_add_syscall_filter_item(
69 scmp_filter_ctx *ctx,
70 const char *name,
71 uint32_t action,
72 char **exclude,
73 bool log_missing,
74 char ***added);
75
76 int seccomp_load_syscall_filter_set(uint32_t default_action, const SyscallFilterSet *set, uint32_t action, bool log_missing);
77 int seccomp_load_syscall_filter_set_raw(uint32_t default_action, Hashmap* set, uint32_t action, bool log_missing);
78
79 typedef enum SeccompParseFlags {
80 SECCOMP_PARSE_INVERT = 1 << 0,
81 SECCOMP_PARSE_ALLOW_LIST = 1 << 1,
82 SECCOMP_PARSE_LOG = 1 << 2,
83 SECCOMP_PARSE_PERMISSIVE = 1 << 3,
84 } SeccompParseFlags;
85
86 int seccomp_parse_syscall_filter(
87 const char *name,
88 int errno_num,
89 Hashmap *filter,
90 SeccompParseFlags flags,
91 const char *unit,
92 const char *filename, unsigned line);
93
94 int seccomp_restrict_archs(Set *archs);
95 int seccomp_restrict_namespaces(unsigned long retain);
96 int seccomp_protect_sysctl(void);
97 int seccomp_protect_syslog(void);
98 int seccomp_restrict_address_families(Set *address_families, bool allow_list);
99 int seccomp_restrict_realtime(void);
100 int seccomp_memory_deny_write_execute(void);
101 int seccomp_lock_personality(unsigned long personality);
102 int seccomp_protect_hostname(void);
103 int seccomp_restrict_suid_sgid(void);
104
105 extern uint32_t seccomp_local_archs[];
106
107 #define SECCOMP_LOCAL_ARCH_END UINT32_MAX
108
109 /* Note: 0 is safe to use here because although SCMP_ARCH_NATIVE is 0, it would
110 * never be in the seccomp_local_archs array anyway so we can use it as a
111 * marker. */
112 #define SECCOMP_LOCAL_ARCH_BLOCKED 0
113
114 #define SECCOMP_FOREACH_LOCAL_ARCH(arch) \
115 for (unsigned _i = ({ (arch) = seccomp_local_archs[0]; 0; }); \
116 (arch) != SECCOMP_LOCAL_ARCH_END; \
117 (arch) = seccomp_local_archs[++_i]) \
118 if ((arch) != SECCOMP_LOCAL_ARCH_BLOCKED)
119
120 /* EACCES: does not have the CAP_SYS_ADMIN or no_new_privs == 1
121 * ENOMEM: out of memory, failed to allocate space for a libseccomp structure, or would exceed a defined constant
122 * EFAULT: addresses passed as args (by libseccomp) are invalid */
123 #define ERRNO_IS_SECCOMP_FATAL(r) \
124 IN_SET(abs(r), EPERM, EACCES, ENOMEM, EFAULT)
125
126 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(scmp_filter_ctx, seccomp_release, NULL);
127
128 int parse_syscall_archs(char **l, Set **ret_archs);
129
130 uint32_t scmp_act_kill_process(void);
131
132 /* This is a special value to be used where syscall filters otherwise expect errno numbers, will be
133 replaced with real seccomp action. */
134 enum {
135 SECCOMP_ERROR_NUMBER_KILL = INT_MAX - 1,
136 };
137
seccomp_errno_or_action_is_valid(int n)138 static inline bool seccomp_errno_or_action_is_valid(int n) {
139 return n == SECCOMP_ERROR_NUMBER_KILL || errno_is_valid(n);
140 }
141
seccomp_parse_errno_or_action(const char * p)142 static inline int seccomp_parse_errno_or_action(const char *p) {
143 if (streq_ptr(p, "kill"))
144 return SECCOMP_ERROR_NUMBER_KILL;
145 return parse_errno(p);
146 }
147
seccomp_errno_or_action_to_string(int num)148 static inline const char *seccomp_errno_or_action_to_string(int num) {
149 if (num == SECCOMP_ERROR_NUMBER_KILL)
150 return "kill";
151 return errno_to_name(num);
152 }
153
154 int parse_syscall_and_errno(const char *in, char **name, int *error);
155
156 int seccomp_suppress_sync(void);
157
158 #else
159
is_seccomp_available(void)160 static inline bool is_seccomp_available(void) {
161 return false;
162 }
163
164 #endif
165