]> git.proxmox.com Git - mirror_lxc.git/blob - src/lxc/seccomp.c
projects / mirror_lxc.git / blob
? search:


f90602e1f9a32154b19b3d2ebb5d0aae25ae30d7
[mirror_lxc.git] / src / lxc / seccomp.c
1 /*
2 * lxc: linux Container library
3 *
4 * (C) Copyright Canonical, Inc. 2012
5 *
6 * Authors:
7 * Serge Hallyn <serge.hallyn@canonical.com>
8 *
9 * This library is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public
11 * License as published by the Free Software Foundation; either
12 * version 2.1 of the License, or (at your option) any later version.
13 *
14 * This library is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
18 *
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
22 */
23
24 #ifndef _GNU_SOURCE
25 #define _GNU_SOURCE 1
26 #endif
27 #include <errno.h>
28 #include <seccomp.h>
29 #include <stdio.h>
30 #include <stdlib.h>
31 #include <sys/mount.h>
32 #include <sys/utsname.h>
33
34 #include "config.h"
35 #include "log.h"
36 #include "lxcseccomp.h"
37 #include "utils.h"
38
39 #ifdef __MIPSEL__
40 #define MIPS_ARCH_O32 lxc_seccomp_arch_mipsel
41 #define MIPS_ARCH_N64 lxc_seccomp_arch_mipsel64
42 #else
43 #define MIPS_ARCH_O32 lxc_seccomp_arch_mips
44 #define MIPS_ARCH_N64 lxc_seccomp_arch_mips64
45 #endif
46
47 lxc_log_define(seccomp, lxc);
48
49 static int parse_config_v1(FILE *f, char *line, size_t *line_bufsz, struct lxc_conf *conf)
50 {
51 int ret = 0;
52
53 while (getline(&line, line_bufsz, f) != -1) {
54 int nr;
55
56 ret = sscanf(line, "%d", &nr);
57 if (ret != 1) {
58 ret = -1;
59 break;
60 }
61
62 #if HAVE_SCMP_FILTER_CTX
63 ret = seccomp_rule_add(conf->seccomp_ctx, SCMP_ACT_ALLOW, nr, 0);
64 #else
65 ret = seccomp_rule_add(SCMP_ACT_ALLOW, nr, 0);
66 #endif
67 if (ret < 0) {
68 ERROR("Failed loading allow rule for %d", nr);
69 break;
70 }
71 }
72 free(line);
73
74 return ret;
75 }
76
77 #if HAVE_DECL_SECCOMP_SYSCALL_RESOLVE_NAME_ARCH
78 static const char *get_action_name(uint32_t action)
79 {
80 /* The upper 16 bits indicate the type of the seccomp action. */
81 switch (action & 0xffff0000) {
82 case SCMP_ACT_KILL:
83 return "kill";
84 case SCMP_ACT_ALLOW:
85 return "allow";
86 case SCMP_ACT_TRAP:
87 return "trap";
88 case SCMP_ACT_ERRNO(0):
89 return "errno";
90 }
91
92 return "invalid action";
93 }
94
95 static uint32_t get_v2_default_action(char *line)
96 {
97 uint32_t ret_action = -1;
98
99 while (*line == ' ')
100 line++;
101
102 /* After 'whitelist' or 'blacklist' comes default behavior. */
103 if (strncmp(line, "kill", 4) == 0) {
104 ret_action = SCMP_ACT_KILL;
105 } else if (strncmp(line, "errno", 5) == 0) {
106 int e, ret;
107
108 ret = sscanf(line + 5, "%d", &e);
109 if (ret != 1) {
110 ERROR("Failed to parse errno value from %s", line);
111 return -2;
112 }
113
114 ret_action = SCMP_ACT_ERRNO(e);
115 } else if (strncmp(line, "allow", 5) == 0) {
116 ret_action = SCMP_ACT_ALLOW;
117 } else if (strncmp(line, "trap", 4) == 0) {
118 ret_action = SCMP_ACT_TRAP;
119 } else if (line[0]) {
120 ERROR("Unrecognized seccomp action \"%s\"", line);
121 return -2;
122 }
123
124 return ret_action;
125 }
126
127 static uint32_t get_v2_action(char *line, uint32_t def_action)
128 {
129 char *p;
130 uint32_t ret;
131
132 p = strchr(line, ' ');
133 if (!p)
134 return def_action;
135 p++;
136
137 while (*p == ' ')
138 p++;
139
140 if (!*p || *p == '#')
141 return def_action;
142
143 ret = get_v2_default_action(p);
144 switch (ret) {
145 case -2:
146 return -1;
147 case -1:
148 return def_action;
149 }
150
151 return ret;
152 }
153
154 struct seccomp_v2_rule_args {
155 uint32_t index;
156 uint64_t value;
157 uint64_t mask;
158 enum scmp_compare op;
159 };
160
161 struct seccomp_v2_rule {
162 uint32_t action;
163 uint32_t args_num;
164 struct seccomp_v2_rule_args args_value[6];
165 };
166
167 static enum scmp_compare parse_v2_rule_op(char *s)
168 {
169 if (strcmp(s, "SCMP_CMP_NE") == 0 || strcmp(s, "!=") == 0)
170 return SCMP_CMP_NE;
171 else if (strcmp(s, "SCMP_CMP_LT") == 0 || strcmp(s, "<") == 0)
172 return SCMP_CMP_LT;
173 else if (strcmp(s, "SCMP_CMP_LE") == 0 || strcmp(s, "<=") == 0)
174 return SCMP_CMP_LE;
175 else if (strcmp(s, "SCMP_CMP_EQ") == 0 || strcmp(s, "==") == 0)
176 return SCMP_CMP_EQ;
177 else if (strcmp(s, "SCMP_CMP_GE") == 0 || strcmp(s, ">=") == 0)
178 return SCMP_CMP_GE;
179 else if (strcmp(s, "SCMP_CMP_GT") == 0 || strcmp(s, ">") == 0)
180 return SCMP_CMP_GT;
181 else if (strcmp(s, "SCMP_CMP_MASKED_EQ") == 0 || strcmp(s, "&=") == 0)
182 return SCMP_CMP_MASKED_EQ;
183
184 return _SCMP_CMP_MAX;
185 }
186
187 /*
188 * This function is used to parse the args string into the structure.
189 * args string format:[index,value,op,mask] or [index,value,op]
190 * index: the index for syscall arguments (type uint)
191 * value: the value for syscall arguments (type uint64)
192 * op: the operator for syscall arguments(string),
193 a valid list of constants as of libseccomp v2.3.2 is
194 SCMP_CMP_NE,SCMP_CMP_LE,SCMP_CMP_LE, SCMP_CMP_EQ, SCMP_CMP_GE,
195 SCMP_CMP_GT, SCMP_CMP_MASKED_EQ, or !=,<=,==,>=,>,&=
196 * mask: the mask to apply on "value" for SCMP_CMP_MASKED_EQ (type uint64, optional)
197 * Returns 0 on success, < 0 otherwise.
198 */
199 static int get_seccomp_arg_value(char *key, struct seccomp_v2_rule_args *rule_args)
200 {
201 int ret = 0;
202 uint32_t index = 0;
203 uint64_t mask = 0, value = 0;
204 enum scmp_compare op = 0;
205 char *tmp = NULL;
206 char s[31] = {0}, v[24] = {0}, m[24] = {'0'};
207
208 tmp = strchr(key, '[');
209 if (!tmp) {
210 ERROR("Failed to interpret args");
211 return -1;
212 }
213
214 ret = sscanf(tmp, "[%i,%23[^,],%30[^0-9^,],%23[^,]", &index, v, s, m);
215 if ((ret != 3 && ret != 4) || index >= 6) {
216 ERROR("Failed to interpret args value");
217 return -1;
218 }
219
220 ret = lxc_safe_uint64(v, &value, 0);
221 if (ret < 0) {
222 ERROR("Invalid argument value");
223 return -1;
224 }
225
226 ret = lxc_safe_uint64(m, &mask, 0);
227 if (ret < 0) {
228 ERROR("Invalid argument mask");
229 return -1;
230 }
231
232 op = parse_v2_rule_op(s);
233 if (op == _SCMP_CMP_MAX) {
234 ERROR("Failed to interpret args operator value");
235 return -1;
236 }
237
238 rule_args->index = index;
239 rule_args->value = value;
240 rule_args->mask = mask;
241 rule_args->op = op;
242 return 0;
243 }
244
245 /* This function is used to parse the seccomp rule entry.
246 * @line : seccomp rule entry string.
247 * @def_action : default action used in the case if the 'line' contain non valid action.
248 * @rules : output struct.
249 * Returns 0 on success, < 0 otherwise.
250 */
251 static int parse_v2_rules(char *line, uint32_t def_action,
252 struct seccomp_v2_rule *rules)
253 {
254 int i = 0, ret = -1;
255 char *key = NULL, *saveptr = NULL, *tmp = NULL;
256
257 tmp = strdup(line);
258 if (!tmp)
259 return -1;
260
261 /* read optional action which follows the syscall */
262 rules->action = get_v2_action(tmp, def_action);
263 if (rules->action == -1) {
264 ERROR("Failed to interpret action");
265 ret = -1;
266 goto on_error;
267 }
268
269 ret = 0;
270 rules->args_num = 0;
271 if (!strchr(tmp, '['))
272 goto on_error;
273
274 ret = -1;
275 for ((key = strtok_r(tmp, "]", &saveptr)), i = 0; key && i < 6;
276 (key = strtok_r(NULL, "]", &saveptr)), i++) {
277 ret = get_seccomp_arg_value(key, &rules->args_value[i]);
278 if (ret < 0)
279 goto on_error;
280
281 rules->args_num++;
282 }
283
284 ret = 0;
285
286 on_error:
287 free(tmp);
288
289 return ret;
290 }
291 #endif
292
293 #if HAVE_DECL_SECCOMP_SYSCALL_RESOLVE_NAME_ARCH
294 enum lxc_hostarch_t {
295 lxc_seccomp_arch_all = 0,
296 lxc_seccomp_arch_native,
297 lxc_seccomp_arch_i386,
298 lxc_seccomp_arch_x32,
299 lxc_seccomp_arch_amd64,
300 lxc_seccomp_arch_arm,
301 lxc_seccomp_arch_arm64,
302 lxc_seccomp_arch_ppc64,
303 lxc_seccomp_arch_ppc64le,
304 lxc_seccomp_arch_ppc,
305 lxc_seccomp_arch_mips,
306 lxc_seccomp_arch_mips64,
307 lxc_seccomp_arch_mips64n32,
308 lxc_seccomp_arch_mipsel,
309 lxc_seccomp_arch_mipsel64,
310 lxc_seccomp_arch_mipsel64n32,
311 lxc_seccomp_arch_s390x,
312 lxc_seccomp_arch_unknown = 999,
313 };
314
315 int get_hostarch(void)
316 {
317 struct utsname uts;
318 if (uname(&uts) < 0) {
319 SYSERROR("Failed to read host arch");
320 return -1;
321 }
322
323 if (strcmp(uts.machine, "i686") == 0)
324 return lxc_seccomp_arch_i386;
325 /* no x32 kernels */
326 else if (strcmp(uts.machine, "x86_64") == 0)
327 return lxc_seccomp_arch_amd64;
328 else if (strncmp(uts.machine, "armv7", 5) == 0)
329 return lxc_seccomp_arch_arm;
330 else if (strncmp(uts.machine, "aarch64", 7) == 0)
331 return lxc_seccomp_arch_arm64;
332 else if (strncmp(uts.machine, "ppc64le", 7) == 0)
333 return lxc_seccomp_arch_ppc64le;
334 else if (strncmp(uts.machine, "ppc64", 5) == 0)
335 return lxc_seccomp_arch_ppc64;
336 else if (strncmp(uts.machine, "ppc", 3) == 0)
337 return lxc_seccomp_arch_ppc;
338 else if (strncmp(uts.machine, "mips64", 6) == 0)
339 return MIPS_ARCH_N64;
340 else if (strncmp(uts.machine, "mips", 4) == 0)
341 return MIPS_ARCH_O32;
342 else if (strncmp(uts.machine, "s390x", 5) == 0)
343 return lxc_seccomp_arch_s390x;
344
345 return lxc_seccomp_arch_unknown;
346 }
347
348 scmp_filter_ctx get_new_ctx(enum lxc_hostarch_t n_arch,
349 uint32_t default_policy_action, bool *needs_merge)
350 {
351 int ret;
352 uint32_t arch;
353 scmp_filter_ctx ctx;
354
355 switch (n_arch) {
356 case lxc_seccomp_arch_i386:
357 arch = SCMP_ARCH_X86;
358 break;
359 case lxc_seccomp_arch_x32:
360 arch = SCMP_ARCH_X32;
361 break;
362 case lxc_seccomp_arch_amd64:
363 arch = SCMP_ARCH_X86_64;
364 break;
365 case lxc_seccomp_arch_arm:
366 arch = SCMP_ARCH_ARM;
367 break;
368 #ifdef SCMP_ARCH_AARCH64
369 case lxc_seccomp_arch_arm64:
370 arch = SCMP_ARCH_AARCH64;
371 break;
372 #endif
373 #ifdef SCMP_ARCH_PPC64LE
374 case lxc_seccomp_arch_ppc64le:
375 arch = SCMP_ARCH_PPC64LE;
376 break;
377 #endif
378 #ifdef SCMP_ARCH_PPC64
379 case lxc_seccomp_arch_ppc64:
380 arch = SCMP_ARCH_PPC64;
381 break;
382 #endif
383 #ifdef SCMP_ARCH_PPC
384 case lxc_seccomp_arch_ppc:
385 arch = SCMP_ARCH_PPC;
386 break;
387 #endif
388 #ifdef SCMP_ARCH_MIPS
389 case lxc_seccomp_arch_mips:
390 arch = SCMP_ARCH_MIPS;
391 break;
392 case lxc_seccomp_arch_mips64:
393 arch = SCMP_ARCH_MIPS64;
394 break;
395 case lxc_seccomp_arch_mips64n32:
396 arch = SCMP_ARCH_MIPS64N32;
397 break;
398 case lxc_seccomp_arch_mipsel:
399 arch = SCMP_ARCH_MIPSEL;
400 break;
401 case lxc_seccomp_arch_mipsel64:
402 arch = SCMP_ARCH_MIPSEL64;
403 break;
404 case lxc_seccomp_arch_mipsel64n32:
405 arch = SCMP_ARCH_MIPSEL64N32;
406 break;
407 #endif
408 #ifdef SCMP_ARCH_S390X
409 case lxc_seccomp_arch_s390x:
410 arch = SCMP_ARCH_S390X;
411 break;
412 #endif
413 default:
414 return NULL;
415 }
416
417 ctx = seccomp_init(default_policy_action);
418 if (!ctx) {
419 ERROR("Error initializing seccomp context");
420 return NULL;
421 }
422
423 ret = seccomp_attr_set(ctx, SCMP_FLTATR_CTL_NNP, 0);
424 if (ret < 0) {
425 errno = -ret;
426 SYSERROR("Failed to turn off no-new-privs");
427 seccomp_release(ctx);
428 return NULL;
429 }
430
431 #ifdef SCMP_FLTATR_ATL_TSKIP
432 ret = seccomp_attr_set(ctx, SCMP_FLTATR_ATL_TSKIP, 1);
433 if (ret < 0) {
434 errno = -ret;
435 SYSWARN("Failed to turn on seccomp nop-skip, continuing");
436 }
437 #endif
438
439 ret = seccomp_arch_exist(ctx, arch);
440 if (ret < 0) {
441 if (ret != -EEXIST) {
442 errno = -ret;
443 SYSERROR("Failed to determine whether arch %d is "
444 "already present in the main seccomp context",
445 (int)n_arch);
446 seccomp_release(ctx);
447 return NULL;
448 }
449
450 ret = seccomp_arch_add(ctx, arch);
451 if (ret != 0) {
452 errno = -ret;
453 SYSERROR("Failed to add arch %d to main seccomp context",
454 (int)n_arch);
455 seccomp_release(ctx);
456 return NULL;
457 }
458 TRACE("Added arch %d to main seccomp context", (int)n_arch);
459
460 ret = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
461 if (ret != 0) {
462 ERROR("Failed to remove native arch from main seccomp context");
463 seccomp_release(ctx);
464 return NULL;
465 }
466 TRACE("Removed native arch from main seccomp context");
467
468 *needs_merge = true;
469 } else {
470 *needs_merge = false;
471 TRACE("Arch %d already present in main seccomp context", (int)n_arch);
472 }
473
474 return ctx;
475 }
476
477 bool do_resolve_add_rule(uint32_t arch, char *line, scmp_filter_ctx ctx,
478 struct seccomp_v2_rule *rule)
479 {
480 int i, nr, ret;
481 struct scmp_arg_cmp arg_cmp[6];
482
483 ret = seccomp_arch_exist(ctx, arch);
484 if (arch && ret != 0) {
485 errno = -ret;
486 SYSERROR("Seccomp: rule and context arch do not match (arch %d)", arch);
487 return false;
488 }
489
490 /*get the syscall name*/
491 char *p = strchr(line, ' ');
492 if (p)
493 *p = '\0';
494
495 if (strncmp(line, "reject_force_umount", 19) == 0) {
496 ret = seccomp_rule_add_exact(ctx, SCMP_ACT_ERRNO(EACCES),
497 SCMP_SYS(umount2), 1,
498 SCMP_A1(SCMP_CMP_MASKED_EQ, MNT_FORCE, MNT_FORCE));
499 if (ret < 0) {
500 errno = -ret;
501 SYSERROR("Failed loading rule to reject force umount");
502 return false;
503 }
504
505 INFO("Set seccomp rule to reject force umounts");
506 return true;
507 }
508
509 nr = seccomp_syscall_resolve_name(line);
510 if (nr == __NR_SCMP_ERROR) {
511 WARN("Failed to resolve syscall \"%s\"", line);
512 WARN("This syscall will NOT be handled by seccomp");
513 return true;
514 }
515
516 if (nr < 0) {
517 WARN("Got negative return value %d for syscall \"%s\"", nr, line);
518 WARN("This syscall will NOT be handled by seccomp");
519 return true;
520 }
521
522 memset(&arg_cmp, 0, sizeof(arg_cmp));
523 for (i = 0; i < rule->args_num; i++) {
524 INFO("arg_cmp[%d]: SCMP_CMP(%u, %llu, %llu, %llu)", i,
525 rule->args_value[i].index,
526 (long long unsigned int)rule->args_value[i].op,
527 (long long unsigned int)rule->args_value[i].mask,
528 (long long unsigned int)rule->args_value[i].value);
529
530 if (SCMP_CMP_MASKED_EQ == rule->args_value[i].op)
531 arg_cmp[i] = SCMP_CMP(rule->args_value[i].index,
532 rule->args_value[i].op,
533 rule->args_value[i].mask,
534 rule->args_value[i].value);
535 else
536 arg_cmp[i] = SCMP_CMP(rule->args_value[i].index,
537 rule->args_value[i].op,
538 rule->args_value[i].value);
539 }
540
541 ret = seccomp_rule_add_exact_array(ctx, rule->action, nr,
542 rule->args_num, arg_cmp);
543 if (ret < 0) {
544 errno = -ret;
545 SYSERROR("Failed loading rule for %s (nr %d action %d (%s))",
546 line, nr, rule->action, get_action_name(rule->action));
547 return false;
548 }
549
550 return true;
551 }
552
553 /*
554 * v2 consists of
555 * [x86]
556 * open
557 * read
558 * write
559 * close
560 * # a comment
561 * [x86_64]
562 * open
563 * read
564 * write
565 * close
566 */
567 static int parse_config_v2(FILE *f, char *line, size_t *line_bufsz, struct lxc_conf *conf)
568 {
569 int ret;
570 char *p;
571 enum lxc_hostarch_t cur_rule_arch, native_arch;
572 bool blacklist = false;
573 uint32_t default_policy_action = -1, default_rule_action = -1;
574 struct seccomp_v2_rule rule;
575 struct scmp_ctx_info {
576 uint32_t architectures[3];
577 scmp_filter_ctx contexts[3];
578 bool needs_merge[3];
579 } ctx;
580
581 if (strncmp(line, "blacklist", 9) == 0)
582 blacklist = true;
583 else if (strncmp(line, "whitelist", 9) != 0) {
584 ERROR("Bad seccomp policy style \"%s\"", line);
585 return -1;
586 }
587
588 p = strchr(line, ' ');
589 if (p) {
590 default_policy_action = get_v2_default_action(p + 1);
591 if (default_policy_action == -2)
592 return -1;
593 }
594
595 /* for blacklist, allow any syscall which has no rule */
596 if (blacklist) {
597 if (default_policy_action == -1)
598 default_policy_action = SCMP_ACT_ALLOW;
599
600 if (default_rule_action == -1)
601 default_rule_action = SCMP_ACT_KILL;
602 } else {
603 if (default_policy_action == -1)
604 default_policy_action = SCMP_ACT_KILL;
605
606 if (default_rule_action == -1)
607 default_rule_action = SCMP_ACT_ALLOW;
608 }
609
610 memset(&ctx, 0, sizeof(ctx));
611 ctx.architectures[0] = SCMP_ARCH_NATIVE;
612 ctx.architectures[1] = SCMP_ARCH_NATIVE;
613 ctx.architectures[2] = SCMP_ARCH_NATIVE;
614 native_arch = get_hostarch();
615 cur_rule_arch = native_arch;
616 if (native_arch == lxc_seccomp_arch_amd64) {
617 cur_rule_arch = lxc_seccomp_arch_all;
618
619 ctx.architectures[0] = SCMP_ARCH_X86;
620 ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_i386,
621 default_policy_action,
622 &ctx.needs_merge[0]);
623 if (!ctx.contexts[0])
624 goto bad;
625
626 ctx.architectures[1] = SCMP_ARCH_X32;
627 ctx.contexts[1] = get_new_ctx(lxc_seccomp_arch_x32,
628 default_policy_action,
629 &ctx.needs_merge[1]);
630 if (!ctx.contexts[1])
631 goto bad;
632
633 ctx.architectures[2] = SCMP_ARCH_X86_64;
634 ctx.contexts[2] = get_new_ctx(lxc_seccomp_arch_amd64,
635 default_policy_action,
636 &ctx.needs_merge[2]);
637 if (!ctx.contexts[2])
638 goto bad;
639 #ifdef SCMP_ARCH_PPC
640 } else if (native_arch == lxc_seccomp_arch_ppc64) {
641 cur_rule_arch = lxc_seccomp_arch_all;
642
643 ctx.architectures[0] = SCMP_ARCH_PPC;
644 ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_ppc,
645 default_policy_action,
646 &ctx.needs_merge[0]);
647 if (!ctx.contexts[0])
648 goto bad;
649
650 ctx.architectures[2] = SCMP_ARCH_PPC64;
651 ctx.contexts[2] = get_new_ctx(lxc_seccomp_arch_ppc64,
652 default_policy_action,
653 &ctx.needs_merge[2]);
654 if (!ctx.contexts[2])
655 goto bad;
656 #endif
657 #ifdef SCMP_ARCH_ARM
658 } else if (native_arch == lxc_seccomp_arch_arm64) {
659 cur_rule_arch = lxc_seccomp_arch_all;
660
661 ctx.architectures[0] = SCMP_ARCH_ARM;
662 ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_arm,
663 default_policy_action,
664 &ctx.needs_merge[0]);
665 if (!ctx.contexts[0])
666 goto bad;
667
668 #ifdef SCMP_ARCH_AARCH64
669 ctx.architectures[2] = SCMP_ARCH_AARCH64;
670 ctx.contexts[2] = get_new_ctx(lxc_seccomp_arch_arm64,
671 default_policy_action,
672 &ctx.needs_merge[2]);
673 if (!ctx.contexts[2])
674 goto bad;
675 #endif
676 #endif
677 #ifdef SCMP_ARCH_MIPS
678 } else if (native_arch == lxc_seccomp_arch_mips64) {
679 cur_rule_arch = lxc_seccomp_arch_all;
680
681 ctx.architectures[0] = SCMP_ARCH_MIPS;
682 ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_mips,
683 default_policy_action,
684 &ctx.needs_merge[0]);
685 if (!ctx.contexts[0])
686 goto bad;
687
688 ctx.architectures[1] = SCMP_ARCH_MIPS64N32;
689 ctx.contexts[1] = get_new_ctx(lxc_seccomp_arch_mips64n32,
690 default_policy_action,
691 &ctx.needs_merge[1]);
692 if (!ctx.contexts[1])
693 goto bad;
694
695 ctx.architectures[2] = SCMP_ARCH_MIPS64;
696 ctx.contexts[2] = get_new_ctx(lxc_seccomp_arch_mips64,
697 default_policy_action,
698 &ctx.needs_merge[2]);
699 if (!ctx.contexts[2])
700 goto bad;
701 } else if (native_arch == lxc_seccomp_arch_mipsel64) {
702 cur_rule_arch = lxc_seccomp_arch_all;
703
704 ctx.architectures[0] = SCMP_ARCH_MIPSEL;
705 ctx.contexts[0] = get_new_ctx(lxc_seccomp_arch_mipsel,
706 default_policy_action,
707 &ctx.needs_merge[0]);
708 if (!ctx.contexts[0])
709 goto bad;
710
711 ctx.architectures[1] = SCMP_ARCH_MIPSEL64N32;
712 ctx.contexts[1] = get_new_ctx(lxc_seccomp_arch_mipsel64n32,
713 default_policy_action,
714 &ctx.needs_merge[1]);
715 if (!ctx.contexts[1])
716 goto bad;
717
718 ctx.architectures[2] = SCMP_ARCH_MIPSEL64;
719 ctx.contexts[2] = get_new_ctx(lxc_seccomp_arch_mipsel64,
720 default_policy_action,
721 &ctx.needs_merge[2]);
722 if (!ctx.contexts[2])
723 goto bad;
724 #endif
725 }
726
727 if (default_policy_action != SCMP_ACT_KILL) {
728 ret = seccomp_reset(conf->seccomp_ctx, default_policy_action);
729 if (ret != 0) {
730 ERROR("Error re-initializing Seccomp");
731 return -1;
732 }
733
734 ret = seccomp_attr_set(conf->seccomp_ctx, SCMP_FLTATR_CTL_NNP, 0);
735 if (ret < 0) {
736 errno = -ret;
737 SYSERROR("Failed to turn off no-new-privs");
738 return -1;
739 }
740
741 #ifdef SCMP_FLTATR_ATL_TSKIP
742 ret = seccomp_attr_set(conf->seccomp_ctx, SCMP_FLTATR_ATL_TSKIP, 1);
743 if (ret < 0) {
744 errno = -ret;
745 SYSWARN("Failed to turn on seccomp nop-skip, continuing");
746 }
747 #endif
748 }
749
750 while (getline(&line, line_bufsz, f) != -1) {
751 if (line[0] == '#')
752 continue;
753
754 if (line[0] == '\0')
755 continue;
756
757 remove_trailing_newlines(line);
758
759 INFO("Processing \"%s\"", line);
760 if (line[0] == '[') {
761 /* Read the architecture for next set of rules. */
762 if (strcmp(line, "[x86]") == 0 ||
763 strcmp(line, "[X86]") == 0) {
764 if (native_arch != lxc_seccomp_arch_i386 &&
765 native_arch != lxc_seccomp_arch_amd64) {
766 cur_rule_arch = lxc_seccomp_arch_unknown;
767 continue;
768 }
769
770 cur_rule_arch = lxc_seccomp_arch_i386;
771 } else if (strcmp(line, "[x32]") == 0 ||
772 strcmp(line, "[X32]") == 0) {
773 if (native_arch != lxc_seccomp_arch_amd64) {
774 cur_rule_arch = lxc_seccomp_arch_unknown;
775 continue;
776 }
777
778 cur_rule_arch = lxc_seccomp_arch_x32;
779 } else if (strcmp(line, "[X86_64]") == 0 ||
780 strcmp(line, "[x86_64]") == 0) {
781 if (native_arch != lxc_seccomp_arch_amd64) {
782 cur_rule_arch = lxc_seccomp_arch_unknown;
783 continue;
784 }
785
786 cur_rule_arch = lxc_seccomp_arch_amd64;
787 } else if (strcmp(line, "[all]") == 0 ||
788 strcmp(line, "[ALL]") == 0) {
789 cur_rule_arch = lxc_seccomp_arch_all;
790 }
791 #ifdef SCMP_ARCH_ARM
792 else if (strcmp(line, "[arm]") == 0 ||
793 strcmp(line, "[ARM]") == 0) {
794 if (native_arch != lxc_seccomp_arch_arm &&
795 native_arch != lxc_seccomp_arch_arm64) {
796 cur_rule_arch = lxc_seccomp_arch_unknown;
797 continue;
798 }
799
800 cur_rule_arch = lxc_seccomp_arch_arm;
801 }
802 #endif
803 #ifdef SCMP_ARCH_AARCH64
804 else if (strcmp(line, "[arm64]") == 0 ||
805 strcmp(line, "[ARM64]") == 0) {
806 if (native_arch != lxc_seccomp_arch_arm64) {
807 cur_rule_arch = lxc_seccomp_arch_unknown;
808 continue;
809 }
810
811 cur_rule_arch = lxc_seccomp_arch_arm64;
812 }
813 #endif
814 #ifdef SCMP_ARCH_PPC64LE
815 else if (strcmp(line, "[ppc64le]") == 0 ||
816 strcmp(line, "[PPC64LE]") == 0) {
817 if (native_arch != lxc_seccomp_arch_ppc64le) {
818 cur_rule_arch = lxc_seccomp_arch_unknown;
819 continue;
820 }
821
822 cur_rule_arch = lxc_seccomp_arch_ppc64le;
823 }
824 #endif
825 #ifdef SCMP_ARCH_PPC64
826 else if (strcmp(line, "[ppc64]") == 0 ||
827 strcmp(line, "[PPC64]") == 0) {
828 if (native_arch != lxc_seccomp_arch_ppc64) {
829 cur_rule_arch = lxc_seccomp_arch_unknown;
830 continue;
831 }
832
833 cur_rule_arch = lxc_seccomp_arch_ppc64;
834 }
835 #endif
836 #ifdef SCMP_ARCH_PPC
837 else if (strcmp(line, "[ppc]") == 0 ||
838 strcmp(line, "[PPC]") == 0) {
839 if (native_arch != lxc_seccomp_arch_ppc &&
840 native_arch != lxc_seccomp_arch_ppc64) {
841 cur_rule_arch = lxc_seccomp_arch_unknown;
842 continue;
843 }
844
845 cur_rule_arch = lxc_seccomp_arch_ppc;
846 }
847 #endif
848 #ifdef SCMP_ARCH_MIPS
849 else if (strcmp(line, "[mips64]") == 0 ||
850 strcmp(line, "[MIPS64]") == 0) {
851 if (native_arch != lxc_seccomp_arch_mips64) {
852 cur_rule_arch = lxc_seccomp_arch_unknown;
853 continue;
854 }
855
856 cur_rule_arch = lxc_seccomp_arch_mips64;
857 } else if (strcmp(line, "[mips64n32]") == 0 ||
858 strcmp(line, "[MIPS64N32]") == 0) {
859 if (native_arch != lxc_seccomp_arch_mips64) {
860 cur_rule_arch = lxc_seccomp_arch_unknown;
861 continue;
862 }
863
864 cur_rule_arch = lxc_seccomp_arch_mips64n32;
865 } else if (strcmp(line, "[mips]") == 0 ||
866 strcmp(line, "[MIPS]") == 0) {
867 if (native_arch != lxc_seccomp_arch_mips &&
868 native_arch != lxc_seccomp_arch_mips64) {
869 cur_rule_arch = lxc_seccomp_arch_unknown;
870 continue;
871 }
872
873 cur_rule_arch = lxc_seccomp_arch_mips;
874 } else if (strcmp(line, "[mipsel64]") == 0 ||
875 strcmp(line, "[MIPSEL64]") == 0) {
876 if (native_arch != lxc_seccomp_arch_mipsel64) {
877 cur_rule_arch = lxc_seccomp_arch_unknown;
878 continue;
879 }
880
881 cur_rule_arch = lxc_seccomp_arch_mipsel64;
882 } else if (strcmp(line, "[mipsel64n32]") == 0 ||
883 strcmp(line, "[MIPSEL64N32]") == 0) {
884 if (native_arch != lxc_seccomp_arch_mipsel64) {
885 cur_rule_arch = lxc_seccomp_arch_unknown;
886 continue;
887 }
888
889 cur_rule_arch = lxc_seccomp_arch_mipsel64n32;
890 } else if (strcmp(line, "[mipsel]") == 0 ||
891 strcmp(line, "[MIPSEL]") == 0) {
892 if (native_arch != lxc_seccomp_arch_mipsel &&
893 native_arch != lxc_seccomp_arch_mipsel64) {
894 cur_rule_arch = lxc_seccomp_arch_unknown;
895 continue;
896 }
897
898 cur_rule_arch = lxc_seccomp_arch_mipsel;
899 }
900 #endif
901 #ifdef SCMP_ARCH_S390X
902 else if (strcmp(line, "[s390x]") == 0 ||
903 strcmp(line, "[S390X]") == 0) {
904 if (native_arch != lxc_seccomp_arch_s390x) {
905 cur_rule_arch = lxc_seccomp_arch_unknown;
906 continue;
907 }
908
909 cur_rule_arch = lxc_seccomp_arch_s390x;
910 }
911 #endif
912 else {
913 goto bad_arch;
914 }
915
916 continue;
917 }
918
919 /* irrelevant arch - i.e. arm on i386 */
920 if (cur_rule_arch == lxc_seccomp_arch_unknown)
921 continue;
922
923 memset(&rule, 0, sizeof(rule));
924 /* read optional action which follows the syscall */
925 ret = parse_v2_rules(line, default_rule_action, &rule);
926 if (ret != 0) {
927 ERROR("Failed to interpret seccomp rule");
928 goto bad_rule;
929 }
930
931 if (!do_resolve_add_rule(SCMP_ARCH_NATIVE, line,
932 conf->seccomp_ctx, &rule))
933 goto bad_rule;
934
935 INFO("Added native rule for arch %d for %s action %d(%s)",
936 SCMP_ARCH_NATIVE, line, rule.action,
937 get_action_name(rule.action));
938
939 if (ctx.architectures[0] != SCMP_ARCH_NATIVE) {
940 if (!do_resolve_add_rule(ctx.architectures[0], line,
941 ctx.contexts[0], &rule))
942 goto bad_rule;
943
944 INFO("Added compat rule for arch %d for %s action %d(%s)",
945 ctx.architectures[0], line, rule.action,
946 get_action_name(rule.action));
947 }
948
949 if (ctx.architectures[1] != SCMP_ARCH_NATIVE) {
950 if (!do_resolve_add_rule(ctx.architectures[1], line,
951 ctx.contexts[1], &rule))
952 goto bad_rule;
953
954 INFO("Added compat rule for arch %d for %s action %d(%s)",
955 ctx.architectures[1], line, rule.action,
956 get_action_name(rule.action));
957 }
958
959 if (ctx.architectures[2] != SCMP_ARCH_NATIVE) {
960 if (!do_resolve_add_rule(ctx.architectures[2], line,
961 ctx.contexts[2], &rule))
962 goto bad_rule;
963
964 INFO("Added native rule for arch %d for %s action %d(%s)",
965 ctx.architectures[2], line, rule.action,
966 get_action_name(rule.action));
967 }
968 }
969
970 INFO("Merging compat seccomp contexts into main context");
971 if (ctx.contexts[0]) {
972 if (ctx.needs_merge[0]) {
973 ret = seccomp_merge(conf->seccomp_ctx, ctx.contexts[0]);
974 if (ret < 0) {
975 ERROR("Failed to merge first compat seccomp "
976 "context into main context");
977 goto bad;
978 }
979
980 TRACE("Merged first compat seccomp context into main context");
981 } else {
982 seccomp_release(ctx.contexts[0]);
983 ctx.contexts[0] = NULL;
984 }
985 }
986
987 if (ctx.contexts[1]) {
988 if (ctx.needs_merge[1]) {
989 ret = seccomp_merge(conf->seccomp_ctx, ctx.contexts[1]);
990 if (ret < 0) {
991 ERROR("Failed to merge first compat seccomp "
992 "context into main context");
993 goto bad;
994 }
995
996 TRACE("Merged second compat seccomp context into main context");
997 } else {
998 seccomp_release(ctx.contexts[1]);
999 ctx.contexts[1] = NULL;
1000 }
1001 }
1002
1003 if (ctx.contexts[2]) {
1004 if (ctx.needs_merge[2]) {
1005 ret = seccomp_merge(conf->seccomp_ctx, ctx.contexts[2]);
1006 if (ret < 0) {
1007 ERROR("Failed to merge third compat seccomp "
1008 "context into main context");
1009 goto bad;
1010 }
1011
1012 TRACE("Merged third compat seccomp context into main context");
1013 } else {
1014 seccomp_release(ctx.contexts[2]);
1015 ctx.contexts[2] = NULL;
1016 }
1017 }
1018
1019 free(line);
1020 return 0;
1021
1022 bad_arch:
1023 ERROR("Unsupported architecture \"%s\"", line);
1024
1025 bad_rule:
1026 bad:
1027 if (ctx.contexts[0])
1028 seccomp_release(ctx.contexts[0]);
1029
1030 if (ctx.contexts[1])
1031 seccomp_release(ctx.contexts[1]);
1032
1033 if (ctx.contexts[2])
1034 seccomp_release(ctx.contexts[2]);
1035
1036 free(line);
1037
1038 return -1;
1039 }
1040 #else /* HAVE_DECL_SECCOMP_SYSCALL_RESOLVE_NAME_ARCH */
1041 static int parse_config_v2(FILE *f, char *line, struct lxc_conf *conf)
1042 {
1043 return -1;
1044 }
1045 #endif /* HAVE_DECL_SECCOMP_SYSCALL_RESOLVE_NAME_ARCH */
1046
1047 /*
1048 * The first line of the config file has a policy language version
1049 * the second line has some directives
1050 * then comes policy subject to the directives
1051 * right now version must be '1' or '2'
1052 * the directives must include 'whitelist'(version == 1 or 2) or 'blacklist'
1053 * (version == 2) and can include 'debug' (though debug is not yet supported).
1054 */
1055 static int parse_config(FILE *f, struct lxc_conf *conf)
1056 {
1057 char *line = NULL;
1058 size_t line_bufsz = 0;
1059 int ret, version;
1060
1061 ret = fscanf(f, "%d\n", &version);
1062 if (ret != 1 || (version != 1 && version != 2)) {
1063 ERROR("Invalid version");
1064 return -1;
1065 }
1066
1067 if (getline(&line, &line_bufsz, f) == -1) {
1068 ERROR("Invalid config file");
1069 goto bad_line;
1070 }
1071
1072 if (version == 1 && !strstr(line, "whitelist")) {
1073 ERROR("Only whitelist policy is supported");
1074 goto bad_line;
1075 }
1076
1077 if (strstr(line, "debug")) {
1078 ERROR("Debug not yet implemented");
1079 goto bad_line;
1080 }
1081
1082 if (version == 1)
1083 return parse_config_v1(f, line, &line_bufsz, conf);
1084
1085 return parse_config_v2(f, line, &line_bufsz, conf);
1086
1087 bad_line:
1088 free(line);
1089 return -1;
1090 }
1091
1092 /*
1093 * use_seccomp: return true if we should try and apply a seccomp policy
1094 * if defined for the container.
1095 * This will return false if
1096 * 1. seccomp is not enabled in the kernel
1097 * 2. a seccomp policy is already enabled for this task
1098 */
1099 static bool use_seccomp(const struct lxc_conf *conf)
1100 {
1101 int ret, v;
1102 FILE *f;
1103 size_t line_bufsz = 0;
1104 char *line = NULL;
1105 bool already_enabled = false, found = false;
1106
1107 if (conf->seccomp_allow_nesting > 0)
1108 return true;
1109
1110 f = fopen("/proc/self/status", "r");
1111 if (!f)
1112 return true;
1113
1114 while (getline(&line, &line_bufsz, f) != -1) {
1115 if (strncmp(line, "Seccomp:", 8) == 0) {
1116 found = true;
1117
1118 ret = sscanf(line + 8, "%d", &v);
1119 if (ret == 1 && v != 0)
1120 already_enabled = true;
1121
1122 break;
1123 }
1124 }
1125 free(line);
1126 fclose(f);
1127
1128 if (!found) {
1129 INFO("Seccomp is not enabled in the kernel");
1130 return false;
1131 }
1132
1133 if (already_enabled) {
1134 INFO("Already seccomp-confined, not loading new policy");
1135 return false;
1136 }
1137
1138 return true;
1139 }
1140
1141 int lxc_read_seccomp_config(struct lxc_conf *conf)
1142 {
1143 int ret;
1144 FILE *f;
1145
1146 if (!conf->seccomp)
1147 return 0;
1148
1149 if (!use_seccomp(conf))
1150 return 0;
1151
1152 #if HAVE_SCMP_FILTER_CTX
1153 /* XXX for debug, pass in SCMP_ACT_TRAP */
1154 conf->seccomp_ctx = seccomp_init(SCMP_ACT_KILL);
1155 ret = !conf->seccomp_ctx;
1156 #else
1157 ret = seccomp_init(SCMP_ACT_KILL) < 0;
1158 #endif
1159 if (ret) {
1160 ERROR("Failed initializing seccomp");
1161 return -1;
1162 }
1163
1164 /* turn off no-new-privs. We don't want it in lxc, and it breaks
1165 * with apparmor */
1166 #if HAVE_SCMP_FILTER_CTX
1167 ret = seccomp_attr_set(conf->seccomp_ctx, SCMP_FLTATR_CTL_NNP, 0);
1168 #else
1169 ret = seccomp_attr_set(SCMP_FLTATR_CTL_NNP, 0);
1170 #endif
1171 if (ret < 0) {
1172 errno = -ret;
1173 SYSERROR("Failed to turn off no-new-privs");
1174 return -1;
1175 }
1176
1177 #ifdef SCMP_FLTATR_ATL_TSKIP
1178 ret = seccomp_attr_set(conf->seccomp_ctx, SCMP_FLTATR_ATL_TSKIP, 1);
1179 if (ret < 0) {
1180 errno = -ret;
1181 SYSWARN("Failed to turn on seccomp nop-skip, continuing");
1182 }
1183 #endif
1184
1185 f = fopen(conf->seccomp, "r");
1186 if (!f) {
1187 SYSERROR("Failed to open seccomp policy file %s", conf->seccomp);
1188 return -1;
1189 }
1190
1191 ret = parse_config(f, conf);
1192 fclose(f);
1193
1194 return ret;
1195 }
1196
1197 int lxc_seccomp_load(struct lxc_conf *conf)
1198 {
1199 int ret;
1200
1201 if (!conf->seccomp)
1202 return 0;
1203
1204 if (!use_seccomp(conf))
1205 return 0;
1206
1207 #if HAVE_SCMP_FILTER_CTX
1208 ret = seccomp_load(conf->seccomp_ctx);
1209 #else
1210 ret = seccomp_load();
1211 #endif
1212 if (ret < 0) {
1213 errno = -ret;
1214 SYSERROR("Error loading the seccomp policy");
1215 return -1;
1216 }
1217
1218 /* After load seccomp filter into the kernel successfully, export the current seccomp
1219 * filter to log file */
1220 #if HAVE_SCMP_FILTER_CTX
1221 if ((lxc_log_get_level() <= LXC_LOG_LEVEL_TRACE ||
1222 conf->loglevel <= LXC_LOG_LEVEL_TRACE) &&
1223 lxc_log_fd >= 0) {
1224 ret = seccomp_export_pfc(conf->seccomp_ctx, lxc_log_fd);
1225 /* Just give an warning when export error */
1226 if (ret < 0) {
1227 errno = -ret;
1228 SYSWARN("Failed to export seccomp filter to log file");
1229 }
1230 }
1231 #endif
1232
1233 return 0;
1234 }
1235
1236 void lxc_seccomp_free(struct lxc_conf *conf)
1237 {
1238 free(conf->seccomp);
1239 conf->seccomp = NULL;
1240
1241 #if HAVE_SCMP_FILTER_CTX
1242 if (conf->seccomp_ctx) {
1243 seccomp_release(conf->seccomp_ctx);
1244 conf->seccomp_ctx = NULL;
1245 }
1246 #endif
1247 }
LXC mirror