| 1 | /** |
| 2 | * Enhanced Seccomp Filter DB |
| 3 | * |
| 4 | * Copyright (c) 2012,2016 Red Hat <pmoore@redhat.com> |
| 5 | * Author: Paul Moore <paul@paul-moore.com> |
| 6 | */ |
| 7 | |
| 8 | /* |
| 9 | * This library is free software; you can redistribute it and/or modify it |
| 10 | * under the terms of version 2.1 of the GNU Lesser General Public License as |
| 11 | * published by the Free Software Foundation. |
| 12 | * |
| 13 | * This library is distributed in the hope that it will be useful, but WITHOUT |
| 14 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| 15 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License |
| 16 | * for more details. |
| 17 | * |
| 18 | * You should have received a copy of the GNU Lesser General Public License |
| 19 | * along with this library; if not, see <http://www.gnu.org/licenses>. |
| 20 | */ |
| 21 | |
| 22 | #ifndef _FILTER_DB_H |
| 23 | #define _FILTER_DB_H |
| 24 | |
| 25 | #include <inttypes.h> |
| 26 | #include <stdbool.h> |
| 27 | |
| 28 | #include <seccomp.h> |
| 29 | |
| 30 | #include "arch.h" |
| 31 | |
| 32 | /* XXX - need to provide doxygen comments for the types here */ |
| 33 | |
| 34 | struct db_api_arg { |
| 35 | unsigned int arg; |
| 36 | enum scmp_compare op; |
| 37 | scmp_datum_t mask; |
| 38 | scmp_datum_t datum; |
| 39 | |
| 40 | bool valid; |
| 41 | }; |
| 42 | |
| 43 | struct db_api_rule_list { |
| 44 | uint32_t action; |
| 45 | int syscall; |
| 46 | struct db_api_arg *args; |
| 47 | unsigned int args_cnt; |
| 48 | |
| 49 | struct db_api_rule_list *prev, *next; |
| 50 | }; |
| 51 | |
| 52 | struct db_arg_chain_tree { |
| 53 | /* argument number (a0 = 0, a1 = 1, etc.) */ |
| 54 | unsigned int arg; |
| 55 | /* argument bpf offset */ |
| 56 | unsigned int arg_offset; |
| 57 | |
| 58 | /* comparison operator */ |
| 59 | enum scmp_compare op; |
| 60 | /* syscall argument value */ |
| 61 | uint32_t mask; |
| 62 | uint32_t datum; |
| 63 | |
| 64 | /* actions */ |
| 65 | bool act_t_flg; |
| 66 | bool act_f_flg; |
| 67 | uint32_t act_t; |
| 68 | uint32_t act_f; |
| 69 | |
| 70 | /* list of nodes on this level */ |
| 71 | struct db_arg_chain_tree *lvl_prv, *lvl_nxt; |
| 72 | |
| 73 | /* next node in the chain */ |
| 74 | struct db_arg_chain_tree *nxt_t; |
| 75 | struct db_arg_chain_tree *nxt_f; |
| 76 | |
| 77 | unsigned int refcnt; |
| 78 | }; |
| 79 | #define ARG_MASK_MAX ((uint32_t)-1) |
| 80 | #define db_chain_lt(x,y) \ |
| 81 | (((x)->arg < (y)->arg) || \ |
| 82 | (((x)->arg == (y)->arg) && \ |
| 83 | (((x)->op < (y)->op) || (((x)->mask & (y)->mask) == (y)->mask)))) |
| 84 | #define db_chain_eq(x,y) \ |
| 85 | (((x)->arg == (y)->arg) && \ |
| 86 | ((x)->op == (y)->op) && ((x)->datum == (y)->datum) && \ |
| 87 | ((x)->mask == (y)->mask)) |
| 88 | #define db_chain_gt(x,y) \ |
| 89 | (((x)->arg > (y)->arg) || \ |
| 90 | (((x)->arg == (y)->arg) && \ |
| 91 | (((x)->op > (y)->op) || (((x)->mask & (y)->mask) != (y)->mask)))) |
| 92 | #define db_chain_action(x) \ |
| 93 | (((x)->act_t_flg) || ((x)->act_f_flg)) |
| 94 | #define db_chain_zombie(x) \ |
| 95 | ((x)->nxt_t == NULL && !((x)->act_t_flg) && \ |
| 96 | (x)->nxt_f == NULL && !((x)->act_f_flg)) |
| 97 | #define db_chain_leaf(x) \ |
| 98 | ((x)->nxt_t == NULL && (x)->nxt_f == NULL) |
| 99 | #define db_chain_eq_result(x,y) \ |
| 100 | ((((x)->nxt_t != NULL && (y)->nxt_t != NULL) || \ |
| 101 | ((x)->nxt_t == NULL && (y)->nxt_t == NULL)) && \ |
| 102 | (((x)->nxt_f != NULL && (y)->nxt_f != NULL) || \ |
| 103 | ((x)->nxt_f == NULL && (y)->nxt_f == NULL)) && \ |
| 104 | ((x)->act_t_flg == (y)->act_t_flg) && \ |
| 105 | ((x)->act_f_flg == (y)->act_f_flg) && \ |
| 106 | (((x)->act_t_flg && (x)->act_t == (y)->act_t) || \ |
| 107 | (!((x)->act_t_flg))) && \ |
| 108 | (((x)->act_f_flg && (x)->act_f == (y)->act_f) || \ |
| 109 | (!((x)->act_f_flg)))) |
| 110 | |
| 111 | struct db_sys_list { |
| 112 | /* native syscall number */ |
| 113 | unsigned int num; |
| 114 | |
| 115 | /* priority - higher is better */ |
| 116 | unsigned int priority; |
| 117 | |
| 118 | /* the argument chain heads */ |
| 119 | struct db_arg_chain_tree *chains; |
| 120 | unsigned int node_cnt; |
| 121 | |
| 122 | /* action in the case of no argument chains */ |
| 123 | uint32_t action; |
| 124 | |
| 125 | struct db_sys_list *next; |
| 126 | /* temporary use only by the BPF generator */ |
| 127 | struct db_sys_list *pri_prv, *pri_nxt; |
| 128 | |
| 129 | bool valid; |
| 130 | }; |
| 131 | |
| 132 | struct db_filter_attr { |
| 133 | /* action to take if we don't match an explicit allow/deny */ |
| 134 | uint32_t act_default; |
| 135 | /* action to take if we don't match the architecture */ |
| 136 | uint32_t act_badarch; |
| 137 | /* NO_NEW_PRIVS related attributes */ |
| 138 | uint32_t nnp_enable; |
| 139 | /* SECCOMP_FILTER_FLAG_TSYNC related attributes */ |
| 140 | uint32_t tsync_enable; |
| 141 | }; |
| 142 | |
| 143 | struct db_filter { |
| 144 | /* target architecture */ |
| 145 | const struct arch_def *arch; |
| 146 | |
| 147 | /* syscall filters, kept as a sorted single-linked list */ |
| 148 | struct db_sys_list *syscalls; |
| 149 | |
| 150 | /* list of rules used to build the filters, kept in order */ |
| 151 | struct db_api_rule_list *rules; |
| 152 | }; |
| 153 | |
| 154 | struct db_filter_snap { |
| 155 | /* individual filters */ |
| 156 | struct db_filter **filters; |
| 157 | unsigned int filter_cnt; |
| 158 | |
| 159 | struct db_filter_snap *next; |
| 160 | }; |
| 161 | |
| 162 | struct db_filter_col { |
| 163 | /* verification / state */ |
| 164 | int state; |
| 165 | |
| 166 | /* attributes */ |
| 167 | struct db_filter_attr attr; |
| 168 | |
| 169 | /* individual filters */ |
| 170 | int endian; |
| 171 | struct db_filter **filters; |
| 172 | unsigned int filter_cnt; |
| 173 | |
| 174 | /* transaction snapshots */ |
| 175 | struct db_filter_snap *snapshots; |
| 176 | }; |
| 177 | |
| 178 | /** |
| 179 | * Iterate over each item in the DB list |
| 180 | * @param iter the iterator |
| 181 | * @param list the list |
| 182 | * |
| 183 | * This macro acts as for()/while() conditional and iterates the following |
| 184 | * statement for each item in the given list. |
| 185 | * |
| 186 | */ |
| 187 | #define db_list_foreach(iter,list) \ |
| 188 | for (iter = (list); iter != NULL; iter = iter->next) |
| 189 | |
| 190 | int db_action_valid(uint32_t action); |
| 191 | |
| 192 | struct db_filter_col *db_col_init(uint32_t def_action); |
| 193 | int db_col_reset(struct db_filter_col *col, uint32_t def_action); |
| 194 | void db_col_release(struct db_filter_col *col); |
| 195 | |
| 196 | int db_col_valid(struct db_filter_col *col); |
| 197 | |
| 198 | int db_col_merge(struct db_filter_col *col_dst, struct db_filter_col *col_src); |
| 199 | |
| 200 | int db_col_arch_exist(struct db_filter_col *col, uint32_t arch_token); |
| 201 | |
| 202 | int db_col_attr_get(const struct db_filter_col *col, |
| 203 | enum scmp_filter_attr attr, uint32_t *value); |
| 204 | int db_col_attr_set(struct db_filter_col *col, |
| 205 | enum scmp_filter_attr attr, uint32_t value); |
| 206 | |
| 207 | int db_col_db_new(struct db_filter_col *col, const struct arch_def *arch); |
| 208 | int db_col_db_add(struct db_filter_col *col, struct db_filter *db); |
| 209 | int db_col_db_remove(struct db_filter_col *col, uint32_t arch_token); |
| 210 | |
| 211 | int db_col_rule_add(struct db_filter_col *col, |
| 212 | bool strict, uint32_t action, int syscall, |
| 213 | unsigned int arg_cnt, const struct scmp_arg_cmp *arg_array); |
| 214 | |
| 215 | int db_col_syscall_priority(struct db_filter_col *col, |
| 216 | int syscall, uint8_t priority); |
| 217 | |
| 218 | int db_col_transaction_start(struct db_filter_col *col); |
| 219 | void db_col_transaction_abort(struct db_filter_col *col); |
| 220 | void db_col_transaction_commit(struct db_filter_col *col); |
| 221 | |
| 222 | int db_rule_add(struct db_filter *db, const struct db_api_rule_list *rule); |
| 223 | |
| 224 | #endif |