5 #include <asm/unistd.h>
6 #include <linux/audit.h>
7 #include <linux/filter.h>
8 #include <linux/seccomp.h>
11 # define SECCOMP_ARCH AUDIT_ARCH_I386
12 #elif defined __x86_64__
13 # define SECCOMP_ARCH AUDIT_ARCH_X86_64
15 # define SECCOMP_ARCH AUDIT_ARCH_ARM
16 #elif defined __arm64__ || defined __aarch64__
17 # define SECCOMP_ARCH AUDIT_ARCH_AARCH64
19 # error unsupported architecture
22 #define SOCK_FILTER_KILL_PROCESS \
23 BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL)
25 #define SOCK_FILTER_DENY_SYSCALL(nr, err) \
26 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ ## nr, 0, 1), \
27 BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | (SECCOMP_RET_DATA & (err)))
29 #define SOCK_FILTER_ALLOW_SYSCALL(nr) \
30 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ ## nr, 0, 1), \
31 BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
33 static const struct sock_filter filter[] = {
34 /* load architecture */
35 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (offsetof (struct seccomp_data, arch))),
36 /* jump forward 1 instruction if architecture matches */
37 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SECCOMP_ARCH, 1, 0),
39 SOCK_FILTER_KILL_PROCESS,
41 /* load syscall number */
42 BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
45 SOCK_FILTER_ALLOW_SYSCALL(close),
46 SOCK_FILTER_ALLOW_SYSCALL(exit),
47 SOCK_FILTER_ALLOW_SYSCALL(exit_group),
50 SOCK_FILTER_DENY_SYSCALL(sync, EBUSY),
51 SOCK_FILTER_DENY_SYSCALL(setsid, EACCES),
52 SOCK_FILTER_DENY_SYSCALL(getpid, EPERM),
53 SOCK_FILTER_DENY_SYSCALL(munlockall, SECCOMP_RET_DATA),
56 SOCK_FILTER_KILL_PROCESS
59 static const struct sock_fprog prog = {
60 .len = sizeof(filter) / sizeof(filter[0]),
61 .filter = (struct sock_filter *) filter,
74 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
77 if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog))
80 if (close(0) || close(1))
83 #define TEST_DENIED_SYSCALL(nr, err, fail) \
84 if (errno = 0, syscall(__NR_ ## nr, 0xbad, 0xf00d, 0xdead, 0xbeef, err, fail) != -1 || err != errno) \
87 TEST_DENIED_SYSCALL(sync, EBUSY, 2);
88 TEST_DENIED_SYSCALL(setsid, EACCES, 3);
89 TEST_DENIED_SYSCALL(getpid, EPERM, 4);
90 TEST_DENIED_SYSCALL(munlockall, SECCOMP_RET_DATA, 5);