seccomp_internal.go 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506
  1. // +build linux
  2. // Internal functions for libseccomp Go bindings
  3. // No exported functions
  4. package seccomp
  5. import (
  6. "fmt"
  7. "os"
  8. "syscall"
  9. )
  10. // Unexported C wrapping code - provides the C-Golang interface
  11. // Get the seccomp header in scope
  12. // Need stdlib.h for free() on cstrings
  13. // #cgo pkg-config: libseccomp
  14. /*
  15. #include <stdlib.h>
  16. #include <seccomp.h>
  17. #if SCMP_VER_MAJOR < 2
  18. #error Minimum supported version of Libseccomp is v2.1.0
  19. #elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR < 1
  20. #error Minimum supported version of Libseccomp is v2.1.0
  21. #endif
  22. #define ARCH_BAD ~0
  23. const uint32_t C_ARCH_BAD = ARCH_BAD;
  24. #ifndef SCMP_ARCH_AARCH64
  25. #define SCMP_ARCH_AARCH64 ARCH_BAD
  26. #endif
  27. #ifndef SCMP_ARCH_MIPS
  28. #define SCMP_ARCH_MIPS ARCH_BAD
  29. #endif
  30. #ifndef SCMP_ARCH_MIPS64
  31. #define SCMP_ARCH_MIPS64 ARCH_BAD
  32. #endif
  33. #ifndef SCMP_ARCH_MIPS64N32
  34. #define SCMP_ARCH_MIPS64N32 ARCH_BAD
  35. #endif
  36. #ifndef SCMP_ARCH_MIPSEL
  37. #define SCMP_ARCH_MIPSEL ARCH_BAD
  38. #endif
  39. #ifndef SCMP_ARCH_MIPSEL64
  40. #define SCMP_ARCH_MIPSEL64 ARCH_BAD
  41. #endif
  42. #ifndef SCMP_ARCH_MIPSEL64N32
  43. #define SCMP_ARCH_MIPSEL64N32 ARCH_BAD
  44. #endif
  45. #ifndef SCMP_ARCH_PPC
  46. #define SCMP_ARCH_PPC ARCH_BAD
  47. #endif
  48. #ifndef SCMP_ARCH_PPC64
  49. #define SCMP_ARCH_PPC64 ARCH_BAD
  50. #endif
  51. #ifndef SCMP_ARCH_PPC64LE
  52. #define SCMP_ARCH_PPC64LE ARCH_BAD
  53. #endif
  54. #ifndef SCMP_ARCH_S390
  55. #define SCMP_ARCH_S390 ARCH_BAD
  56. #endif
  57. #ifndef SCMP_ARCH_S390X
  58. #define SCMP_ARCH_S390X ARCH_BAD
  59. #endif
  60. const uint32_t C_ARCH_NATIVE = SCMP_ARCH_NATIVE;
  61. const uint32_t C_ARCH_X86 = SCMP_ARCH_X86;
  62. const uint32_t C_ARCH_X86_64 = SCMP_ARCH_X86_64;
  63. const uint32_t C_ARCH_X32 = SCMP_ARCH_X32;
  64. const uint32_t C_ARCH_ARM = SCMP_ARCH_ARM;
  65. const uint32_t C_ARCH_AARCH64 = SCMP_ARCH_AARCH64;
  66. const uint32_t C_ARCH_MIPS = SCMP_ARCH_MIPS;
  67. const uint32_t C_ARCH_MIPS64 = SCMP_ARCH_MIPS64;
  68. const uint32_t C_ARCH_MIPS64N32 = SCMP_ARCH_MIPS64N32;
  69. const uint32_t C_ARCH_MIPSEL = SCMP_ARCH_MIPSEL;
  70. const uint32_t C_ARCH_MIPSEL64 = SCMP_ARCH_MIPSEL64;
  71. const uint32_t C_ARCH_MIPSEL64N32 = SCMP_ARCH_MIPSEL64N32;
  72. const uint32_t C_ARCH_PPC = SCMP_ARCH_PPC;
  73. const uint32_t C_ARCH_PPC64 = SCMP_ARCH_PPC64;
  74. const uint32_t C_ARCH_PPC64LE = SCMP_ARCH_PPC64LE;
  75. const uint32_t C_ARCH_S390 = SCMP_ARCH_S390;
  76. const uint32_t C_ARCH_S390X = SCMP_ARCH_S390X;
  77. const uint32_t C_ACT_KILL = SCMP_ACT_KILL;
  78. const uint32_t C_ACT_TRAP = SCMP_ACT_TRAP;
  79. const uint32_t C_ACT_ERRNO = SCMP_ACT_ERRNO(0);
  80. const uint32_t C_ACT_TRACE = SCMP_ACT_TRACE(0);
  81. const uint32_t C_ACT_ALLOW = SCMP_ACT_ALLOW;
  82. // If TSync is not supported, make sure it doesn't map to a supported filter attribute
  83. // Don't worry about major version < 2, the minimum version checks should catch that case
  84. #if SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR < 2
  85. #define SCMP_FLTATR_CTL_TSYNC _SCMP_CMP_MIN
  86. #endif
  87. const uint32_t C_ATTRIBUTE_DEFAULT = (uint32_t)SCMP_FLTATR_ACT_DEFAULT;
  88. const uint32_t C_ATTRIBUTE_BADARCH = (uint32_t)SCMP_FLTATR_ACT_BADARCH;
  89. const uint32_t C_ATTRIBUTE_NNP = (uint32_t)SCMP_FLTATR_CTL_NNP;
  90. const uint32_t C_ATTRIBUTE_TSYNC = (uint32_t)SCMP_FLTATR_CTL_TSYNC;
  91. const int C_CMP_NE = (int)SCMP_CMP_NE;
  92. const int C_CMP_LT = (int)SCMP_CMP_LT;
  93. const int C_CMP_LE = (int)SCMP_CMP_LE;
  94. const int C_CMP_EQ = (int)SCMP_CMP_EQ;
  95. const int C_CMP_GE = (int)SCMP_CMP_GE;
  96. const int C_CMP_GT = (int)SCMP_CMP_GT;
  97. const int C_CMP_MASKED_EQ = (int)SCMP_CMP_MASKED_EQ;
  98. const int C_VERSION_MAJOR = SCMP_VER_MAJOR;
  99. const int C_VERSION_MINOR = SCMP_VER_MINOR;
  100. const int C_VERSION_MICRO = SCMP_VER_MICRO;
  101. typedef struct scmp_arg_cmp* scmp_cast_t;
  102. // Wrapper to create an scmp_arg_cmp struct
  103. void*
  104. make_struct_arg_cmp(
  105. unsigned int arg,
  106. int compare,
  107. uint64_t a,
  108. uint64_t b
  109. )
  110. {
  111. struct scmp_arg_cmp *s = malloc(sizeof(struct scmp_arg_cmp));
  112. s->arg = arg;
  113. s->op = compare;
  114. s->datum_a = a;
  115. s->datum_b = b;
  116. return s;
  117. }
  118. */
  119. import "C"
  120. // Nonexported types
  121. type scmpFilterAttr uint32
  122. // Nonexported constants
  123. const (
  124. filterAttrActDefault scmpFilterAttr = iota
  125. filterAttrActBadArch scmpFilterAttr = iota
  126. filterAttrNNP scmpFilterAttr = iota
  127. filterAttrTsync scmpFilterAttr = iota
  128. )
  129. const (
  130. // An error return from certain libseccomp functions
  131. scmpError C.int = -1
  132. // Comparison boundaries to check for architecture validity
  133. archStart ScmpArch = ArchNative
  134. archEnd ScmpArch = ArchS390X
  135. // Comparison boundaries to check for action validity
  136. actionStart ScmpAction = ActKill
  137. actionEnd ScmpAction = ActAllow
  138. // Comparison boundaries to check for comparison operator validity
  139. compareOpStart ScmpCompareOp = CompareNotEqual
  140. compareOpEnd ScmpCompareOp = CompareMaskedEqual
  141. )
  142. var (
  143. // Error thrown on bad filter context
  144. errBadFilter = fmt.Errorf("filter is invalid or uninitialized")
  145. // Constants representing library major, minor, and micro versions
  146. verMajor = int(C.C_VERSION_MAJOR)
  147. verMinor = int(C.C_VERSION_MINOR)
  148. verMicro = int(C.C_VERSION_MICRO)
  149. )
  150. // Nonexported functions
  151. // Check if library version is greater than or equal to the given one
  152. func checkVersionAbove(major, minor, micro int) bool {
  153. return (verMajor > major) ||
  154. (verMajor == major && verMinor > minor) ||
  155. (verMajor == major && verMinor == minor && verMicro >= micro)
  156. }
  157. // Init function: Verify library version is appropriate
  158. func init() {
  159. if !checkVersionAbove(2, 1, 0) {
  160. fmt.Fprintf(os.Stderr, "Libseccomp version too low: minimum supported is 2.1.0, detected %d.%d.%d", C.C_VERSION_MAJOR, C.C_VERSION_MINOR, C.C_VERSION_MICRO)
  161. os.Exit(-1)
  162. }
  163. }
  164. // Filter helpers
  165. // Filter finalizer - ensure that kernel context for filters is freed
  166. func filterFinalizer(f *ScmpFilter) {
  167. f.Release()
  168. }
  169. // Get a raw filter attribute
  170. func (f *ScmpFilter) getFilterAttr(attr scmpFilterAttr) (C.uint32_t, error) {
  171. f.lock.Lock()
  172. defer f.lock.Unlock()
  173. if !f.valid {
  174. return 0x0, errBadFilter
  175. }
  176. if !checkVersionAbove(2, 2, 0) && attr == filterAttrTsync {
  177. return 0x0, fmt.Errorf("the thread synchronization attribute is not supported in this version of the library")
  178. }
  179. var attribute C.uint32_t
  180. retCode := C.seccomp_attr_get(f.filterCtx, attr.toNative(), &attribute)
  181. if retCode != 0 {
  182. return 0x0, syscall.Errno(-1 * retCode)
  183. }
  184. return attribute, nil
  185. }
  186. // Set a raw filter attribute
  187. func (f *ScmpFilter) setFilterAttr(attr scmpFilterAttr, value C.uint32_t) error {
  188. f.lock.Lock()
  189. defer f.lock.Unlock()
  190. if !f.valid {
  191. return errBadFilter
  192. }
  193. if !checkVersionAbove(2, 2, 0) && attr == filterAttrTsync {
  194. return fmt.Errorf("the thread synchronization attribute is not supported in this version of the library")
  195. }
  196. retCode := C.seccomp_attr_set(f.filterCtx, attr.toNative(), value)
  197. if retCode != 0 {
  198. return syscall.Errno(-1 * retCode)
  199. }
  200. return nil
  201. }
  202. // DOES NOT LOCK OR CHECK VALIDITY
  203. // Assumes caller has already done this
  204. // Wrapper for seccomp_rule_add_... functions
  205. func (f *ScmpFilter) addRuleWrapper(call ScmpSyscall, action ScmpAction, exact bool, cond C.scmp_cast_t) error {
  206. var length C.uint
  207. if cond != nil {
  208. length = 1
  209. } else {
  210. length = 0
  211. }
  212. var retCode C.int
  213. if exact {
  214. retCode = C.seccomp_rule_add_exact_array(f.filterCtx, action.toNative(), C.int(call), length, cond)
  215. } else {
  216. retCode = C.seccomp_rule_add_array(f.filterCtx, action.toNative(), C.int(call), length, cond)
  217. }
  218. if syscall.Errno(-1*retCode) == syscall.EFAULT {
  219. return fmt.Errorf("unrecognized syscall")
  220. } else if syscall.Errno(-1*retCode) == syscall.EPERM {
  221. return fmt.Errorf("requested action matches default action of filter")
  222. } else if retCode != 0 {
  223. return syscall.Errno(-1 * retCode)
  224. }
  225. return nil
  226. }
  227. // Generic add function for filter rules
  228. func (f *ScmpFilter) addRuleGeneric(call ScmpSyscall, action ScmpAction, exact bool, conds []ScmpCondition) error {
  229. f.lock.Lock()
  230. defer f.lock.Unlock()
  231. if !f.valid {
  232. return errBadFilter
  233. }
  234. if len(conds) == 0 {
  235. if err := f.addRuleWrapper(call, action, exact, nil); err != nil {
  236. return err
  237. }
  238. } else {
  239. // We don't support conditional filtering in library version v2.1
  240. if !checkVersionAbove(2, 2, 1) {
  241. return fmt.Errorf("conditional filtering requires libseccomp version >= 2.2.1")
  242. }
  243. for _, cond := range conds {
  244. cmpStruct := C.make_struct_arg_cmp(C.uint(cond.Argument), cond.Op.toNative(), C.uint64_t(cond.Operand1), C.uint64_t(cond.Operand2))
  245. defer C.free(cmpStruct)
  246. if err := f.addRuleWrapper(call, action, exact, C.scmp_cast_t(cmpStruct)); err != nil {
  247. return err
  248. }
  249. }
  250. }
  251. return nil
  252. }
  253. // Generic Helpers
  254. // Helper - Sanitize Arch token input
  255. func sanitizeArch(in ScmpArch) error {
  256. if in < archStart || in > archEnd {
  257. return fmt.Errorf("unrecognized architecture")
  258. }
  259. if in.toNative() == C.C_ARCH_BAD {
  260. return fmt.Errorf("architecture is not supported on this version of the library")
  261. }
  262. return nil
  263. }
  264. func sanitizeAction(in ScmpAction) error {
  265. inTmp := in & 0x0000FFFF
  266. if inTmp < actionStart || inTmp > actionEnd {
  267. return fmt.Errorf("unrecognized action")
  268. }
  269. if inTmp != ActTrace && inTmp != ActErrno && (in&0xFFFF0000) != 0 {
  270. return fmt.Errorf("highest 16 bits must be zeroed except for Trace and Errno")
  271. }
  272. return nil
  273. }
  274. func sanitizeCompareOp(in ScmpCompareOp) error {
  275. if in < compareOpStart || in > compareOpEnd {
  276. return fmt.Errorf("unrecognized comparison operator")
  277. }
  278. return nil
  279. }
  280. func archFromNative(a C.uint32_t) (ScmpArch, error) {
  281. switch a {
  282. case C.C_ARCH_X86:
  283. return ArchX86, nil
  284. case C.C_ARCH_X86_64:
  285. return ArchAMD64, nil
  286. case C.C_ARCH_X32:
  287. return ArchX32, nil
  288. case C.C_ARCH_ARM:
  289. return ArchARM, nil
  290. case C.C_ARCH_NATIVE:
  291. return ArchNative, nil
  292. case C.C_ARCH_AARCH64:
  293. return ArchARM64, nil
  294. case C.C_ARCH_MIPS:
  295. return ArchMIPS, nil
  296. case C.C_ARCH_MIPS64:
  297. return ArchMIPS64, nil
  298. case C.C_ARCH_MIPS64N32:
  299. return ArchMIPS64N32, nil
  300. case C.C_ARCH_MIPSEL:
  301. return ArchMIPSEL, nil
  302. case C.C_ARCH_MIPSEL64:
  303. return ArchMIPSEL64, nil
  304. case C.C_ARCH_MIPSEL64N32:
  305. return ArchMIPSEL64N32, nil
  306. case C.C_ARCH_PPC:
  307. return ArchPPC, nil
  308. case C.C_ARCH_PPC64:
  309. return ArchPPC64, nil
  310. case C.C_ARCH_PPC64LE:
  311. return ArchPPC64LE, nil
  312. case C.C_ARCH_S390:
  313. return ArchS390, nil
  314. case C.C_ARCH_S390X:
  315. return ArchS390X, nil
  316. default:
  317. return 0x0, fmt.Errorf("unrecognized architecture")
  318. }
  319. }
  320. // Only use with sanitized arches, no error handling
  321. func (a ScmpArch) toNative() C.uint32_t {
  322. switch a {
  323. case ArchX86:
  324. return C.C_ARCH_X86
  325. case ArchAMD64:
  326. return C.C_ARCH_X86_64
  327. case ArchX32:
  328. return C.C_ARCH_X32
  329. case ArchARM:
  330. return C.C_ARCH_ARM
  331. case ArchARM64:
  332. return C.C_ARCH_AARCH64
  333. case ArchMIPS:
  334. return C.C_ARCH_MIPS
  335. case ArchMIPS64:
  336. return C.C_ARCH_MIPS64
  337. case ArchMIPS64N32:
  338. return C.C_ARCH_MIPS64N32
  339. case ArchMIPSEL:
  340. return C.C_ARCH_MIPSEL
  341. case ArchMIPSEL64:
  342. return C.C_ARCH_MIPSEL64
  343. case ArchMIPSEL64N32:
  344. return C.C_ARCH_MIPSEL64N32
  345. case ArchPPC:
  346. return C.C_ARCH_PPC
  347. case ArchPPC64:
  348. return C.C_ARCH_PPC64
  349. case ArchPPC64LE:
  350. return C.C_ARCH_PPC64LE
  351. case ArchS390:
  352. return C.C_ARCH_S390
  353. case ArchS390X:
  354. return C.C_ARCH_S390X
  355. case ArchNative:
  356. return C.C_ARCH_NATIVE
  357. default:
  358. return 0x0
  359. }
  360. }
  361. // Only use with sanitized ops, no error handling
  362. func (a ScmpCompareOp) toNative() C.int {
  363. switch a {
  364. case CompareNotEqual:
  365. return C.C_CMP_NE
  366. case CompareLess:
  367. return C.C_CMP_LT
  368. case CompareLessOrEqual:
  369. return C.C_CMP_LE
  370. case CompareEqual:
  371. return C.C_CMP_EQ
  372. case CompareGreaterEqual:
  373. return C.C_CMP_GE
  374. case CompareGreater:
  375. return C.C_CMP_GT
  376. case CompareMaskedEqual:
  377. return C.C_CMP_MASKED_EQ
  378. default:
  379. return 0x0
  380. }
  381. }
  382. func actionFromNative(a C.uint32_t) (ScmpAction, error) {
  383. aTmp := a & 0xFFFF
  384. switch a & 0xFFFF0000 {
  385. case C.C_ACT_KILL:
  386. return ActKill, nil
  387. case C.C_ACT_TRAP:
  388. return ActTrap, nil
  389. case C.C_ACT_ERRNO:
  390. return ActErrno.SetReturnCode(int16(aTmp)), nil
  391. case C.C_ACT_TRACE:
  392. return ActTrace.SetReturnCode(int16(aTmp)), nil
  393. case C.C_ACT_ALLOW:
  394. return ActAllow, nil
  395. default:
  396. return 0x0, fmt.Errorf("unrecognized action")
  397. }
  398. }
  399. // Only use with sanitized actions, no error handling
  400. func (a ScmpAction) toNative() C.uint32_t {
  401. switch a & 0xFFFF {
  402. case ActKill:
  403. return C.C_ACT_KILL
  404. case ActTrap:
  405. return C.C_ACT_TRAP
  406. case ActErrno:
  407. return C.C_ACT_ERRNO | (C.uint32_t(a) >> 16)
  408. case ActTrace:
  409. return C.C_ACT_TRACE | (C.uint32_t(a) >> 16)
  410. case ActAllow:
  411. return C.C_ACT_ALLOW
  412. default:
  413. return 0x0
  414. }
  415. }
  416. // Internal only, assumes safe attribute
  417. func (a scmpFilterAttr) toNative() uint32 {
  418. switch a {
  419. case filterAttrActDefault:
  420. return uint32(C.C_ATTRIBUTE_DEFAULT)
  421. case filterAttrActBadArch:
  422. return uint32(C.C_ATTRIBUTE_BADARCH)
  423. case filterAttrNNP:
  424. return uint32(C.C_ATTRIBUTE_NNP)
  425. case filterAttrTsync:
  426. return uint32(C.C_ATTRIBUTE_TSYNC)
  427. default:
  428. return 0x0
  429. }
  430. }