Documentation
¶
Overview ¶
Package seccomp provides generation of basic seccomp filters. Currently, only little endian systems are supported.
Index ¶
- Constants
- Variables
- func BuildProgram(rules []RuleSet, defaultAction, badArchAction linux.BPFAction) ([]linux.BPFInstruction, error)
- func Install(rules SyscallRules, denyRules SyscallRules) error
- func MaskedEqual(mask, value uintptr) any
- func SetFilter(instrs []linux.BPFInstruction) error
- func SetFilterInChild(instrs []linux.BPFInstruction) unix.Errno
- type EqualTo
- type GreaterThan
- type GreaterThanOrEqual
- type LessThan
- type LessThanOrEqual
- type MatchAny
- type NotEqual
- type Rule
- type RuleSet
- type SyscallRules
Constants ¶
const ( LINUX_AUDIT_ARCH = linux.AUDIT_ARCH_X86_64 SYS_SECCOMP = 317 )
const RuleIP = 6
RuleIP indicates what rules in the Rule array have to be applied to instruction pointer.
Variables ¶
var DenyNewExecMappings = SyscallRules{ unix.SYS_MMAP: []Rule{ { MatchAny{}, MatchAny{}, MaskedEqual(unix.PROT_EXEC, unix.PROT_EXEC), }, }, unix.SYS_MPROTECT: []Rule{ { MatchAny{}, MatchAny{}, MaskedEqual(unix.PROT_EXEC, unix.PROT_EXEC), }, }, }
DenyNewExecMappings is a set of rules that denies creating new executable mappings and converting existing ones.
var SyscallName = func(sysno uintptr) string { return fmt.Sprintf("syscall_%d", sysno) }
SyscallName gives names to system calls. It is used purely for debugging purposes.
An alternate namer can be provided to the package at initialization time.
Functions ¶
func BuildProgram ¶
func BuildProgram(rules []RuleSet, defaultAction, badArchAction linux.BPFAction) ([]linux.BPFInstruction, error)
BuildProgram builds a BPF program from the given map of actions to matching SyscallRules. The single generated program covers all provided RuleSets.
func Install ¶
func Install(rules SyscallRules, denyRules SyscallRules) error
Install generates BPF code based on the set of syscalls provided. It only allows syscalls that conform to the specification. Syscalls that violate the specification will trigger RET_KILL_PROCESS. If RET_KILL_PROCESS is not supported, violations will trigger RET_TRAP instead. RET_KILL_THREAD is not used because it only kills the offending thread and often keeps the sentry hanging.
denyRules describes forbidden syscalls. rules describes allowed syscalls. denyRules is executed before rules.
Be aware that RET_TRAP sends SIGSYS to the process and it may be ignored, making it possible for the process to continue running after a violation. However, it will leave a SECCOMP audit event trail behind. In any case, the syscall is still blocked from executing.
func MaskedEqual ¶
MaskedEqual specifies a value that matches the input after the input is masked (bitwise &) against the given mask. Can be used to verify that input only includes certain approved flags.
func SetFilter ¶
func SetFilter(instrs []linux.BPFInstruction) error
SetFilter installs the given BPF program.
func SetFilterInChild ¶
func SetFilterInChild(instrs []linux.BPFInstruction) unix.Errno
SetFilterInChild is equivalent to SetFilter, but:
It is safe to call after runtime.syscall_runtime_AfterForkInChild.
It requires that the calling goroutine cannot be moved to another thread, which either requires that runtime.LockOSThread() is in effect or that the caller is in fact in a fork()ed child process.
Since fork()ed child processes cannot perform heap allocation, it returns a unix.Errno rather than an error.
The race instrumentation has to be disabled for all functions that are called in a forked child.
Types ¶
type GreaterThan ¶
type GreaterThan uintptr
GreaterThan specifies a value that needs to be strictly smaller.
func (GreaterThan) String ¶
func (a GreaterThan) String() (s string)
type GreaterThanOrEqual ¶
type GreaterThanOrEqual uintptr
GreaterThanOrEqual specifies a value that needs to be smaller or equal.
func (GreaterThanOrEqual) String ¶
func (a GreaterThanOrEqual) String() (s string)
type LessThanOrEqual ¶
type LessThanOrEqual uintptr
LessThanOrEqual specifies a value that needs to be greater or equal.
func NonNegativeFDCheck ¶
func NonNegativeFDCheck() LessThanOrEqual
NonNegativeFDCheck ensures an FD argument is a non-negative int.
func (LessThanOrEqual) String ¶
func (a LessThanOrEqual) String() (s string)
type Rule ¶
type Rule [7]any // 6 arguments + RIP
Rule stores the allowed syscall arguments.
For example:
rule := Rule {
EqualTo(linux.ARCH_GET_FS | linux.ARCH_SET_FS), // arg0
}
type RuleSet ¶
type RuleSet struct {
Rules SyscallRules
Action linux.BPFAction
// Vsyscall indicates that a check is made for a function being called
// from kernel mappings. This is where the vsyscall page is located
// (and typically) emulated, so this RuleSet will not match any
// functions not dispatched from the vsyscall page.
Vsyscall bool
}
RuleSet is a set of rules and associated action.
type SyscallRules ¶
SyscallRules stores a map of OR'ed argument rules indexed by the syscall number. If the 'Rules' is empty, we treat it as any argument is allowed.
For example:
rules := SyscallRules{
syscall.SYS_FUTEX: []Rule{
{
MatchAny{},
EqualTo(linux.FUTEX_WAIT | linux.FUTEX_PRIVATE_FLAG),
}, // OR
{
MatchAny{},
EqualTo(linux.FUTEX_WAKE | linux.FUTEX_PRIVATE_FLAG),
},
},
syscall.SYS_GETPID: []Rule{},
}
func NewSyscallRules ¶
func NewSyscallRules() SyscallRules
NewSyscallRules returns a new SyscallRules.
func (SyscallRules) AddRule ¶
func (sr SyscallRules) AddRule(sysno uintptr, r Rule)
AddRule adds the given rule. It will create a new entry for a new syscall, otherwise it will append to the existing rules.
func (SyscallRules) Merge ¶
func (sr SyscallRules) Merge(rules SyscallRules)
Merge merges the given SyscallRules.
Source Files