commit 8b12170f23f4042610b3574b8edf3794fef245b4 Author: Cristian Toader cristian.matei.toader@gmail.com Date: Tue Jul 23 10:49:56 2013 +0300
added support for numeric parameters, tested with rt_sigaction --- src/common/sandbox.c | 22 +++++++++++++++++----- src/common/sandbox.h | 8 +++++++- 2 files changed, 24 insertions(+), 6 deletions(-)
diff --git a/src/common/sandbox.c b/src/common/sandbox.c index f757c8d..7c73215 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -28,14 +28,25 @@
#include <sys/mman.h> #include <sys/syscall.h> +#include <bits/signum.h> #include <seccomp.h> #include <signal.h> #include <unistd.h>
static ParFilter param_filter[] = { // Example entries - {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0}, - {SCMP_SYS(execve), (intptr_t)("/usr/local/bin/tor"), 0} + {SCMP_SYS(execve), PARAM_PTR, (intptr_t)("/usr/local/bin/tor"), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGINT), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGTERM), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGPIPE), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR1), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGUSR2), 0}, + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGHUP), 0}, +#ifdef SIGXFSZ + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGXFSZ), 0}, +#endif + {SCMP_SYS(rt_sigaction), PARAM_NUM, (intptr_t)(SIGCHLD), 0}, + };
/** Variable used for storing all syscall numbers that will be allowed with the @@ -101,7 +112,6 @@ static int general_filter[] = { SCMP_SYS(prctl), SCMP_SYS(read), SCMP_SYS(rename), - SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigprocmask), SCMP_SYS(rt_sigreturn), #ifdef __NR_sigreturn @@ -166,7 +176,7 @@ get_prot_param(char *param)
for (i = 0; i < filter_size; i++) { if (param_filter[i].prot && !strncmp(param, (char*) param_filter[i].param, - MAX_PARAM_LEN)) { + MAX_PARAM_LEN) && param_filter[i].ptype == PARAM_PTR) { return (char*)(param_filter[i].param); } } @@ -188,7 +198,7 @@ add_param_filter(scmp_filter_ctx ctx)
// for each parameter filter for (i = 0; i < filter_size; i++) { - if (!param_filter[i].prot) { + if (!param_filter[i].prot && param_filter[i].ptype == PARAM_PTR) { // allocating protected memory region for parameter param_size = 1 + strnlen((char*) param_filter[i].param, MAX_PARAM_LEN); if (param_size == MAX_PARAM_LEN) { @@ -213,6 +223,8 @@ add_param_filter(scmp_filter_ctx ctx) } } // if not protected
+ param_filter[i].prot = 1; + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, param_filter[i].syscall, 1, SCMP_A0(SCMP_CMP_EQ, param_filter[i].param)); if (rc != 0) { diff --git a/src/common/sandbox.h b/src/common/sandbox.h index bfb7a73..de5699e 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -34,9 +34,15 @@
#define MAX_PARAM_LEN 32
+#define PARAM_PTR 0 +#define PARAM_NUM 1 + typedef struct { int syscall; - intptr_t param; // TODO: make this intptr_t to support multiple types + + char ptype; + intptr_t param; + char prot; } ParFilter;