--- /dev/null
+/**
+ * Enhanced Seccomp Filter DB
+ *
+ * Copyright (c) 2012,2016 Red Hat <pmoore@redhat.com>
+ * Author: Paul Moore <paul@paul-moore.com>
+ */
+
+/*
+ * This library is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; if not, see <http://www.gnu.org/licenses>.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <inttypes.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+
+#include <seccomp.h>
+
+#include "arch.h"
+#include "db.h"
+#include "system.h"
+
+/* state values */
+#define _DB_STA_VALID 0xA1B2C3D4
+#define _DB_STA_FREED 0x1A2B3C4D
+
+/* the priority field is fairly simple - without any user hints, or in the case
+ * of a hint "tie", we give higher priority to syscalls with less chain nodes
+ * (filter is easier to evaluate) */
+#define _DB_PRI_MASK_CHAIN 0x0000FFFF
+#define _DB_PRI_MASK_USER 0x00FF0000
+#define _DB_PRI_USER(x) (((x) << 16) & _DB_PRI_MASK_USER)
+
+/* private structure for tracking the state of the sub-tree "pruning" */
+struct db_prune_state {
+ bool prefix_exist;
+ bool prefix_new;
+ bool matched;
+};
+
+static unsigned int _db_tree_free(struct db_arg_chain_tree *tree);
+
+/**
+ * Do not call this function directly, use _db_tree_free() instead
+ */
+static unsigned int __db_tree_free(struct db_arg_chain_tree *tree)
+{
+ int cnt;
+
+ if (tree == NULL || --(tree->refcnt) > 0)
+ return 0;
+
+ /* we assume the caller has ensured that 'tree->lvl_prv == NULL' */
+ cnt = __db_tree_free(tree->lvl_nxt);
+ cnt += _db_tree_free(tree->nxt_t);
+ cnt += _db_tree_free(tree->nxt_f);
+
+ free(tree);
+ return cnt + 1;
+}
+
+/**
+ * Free a syscall filter argument chain tree
+ * @param tree the argument chain list
+ *
+ * This function frees a tree and returns the number of nodes freed.
+ *
+ */
+static unsigned int _db_tree_free(struct db_arg_chain_tree *tree)
+{
+ struct db_arg_chain_tree *iter;
+
+ if (tree == NULL)
+ return 0;
+
+ iter = tree;
+ while (iter->lvl_prv != NULL)
+ iter = iter->lvl_prv;
+
+ return __db_tree_free(iter);
+}
+
+/**
+ * Remove a node from an argument chain tree
+ * @param tree the pointer to the tree
+ * @param node the node to remove
+ *
+ * This function searches the tree looking for the node and removes it once
+ * found. Returns the number of nodes freed.
+ *
+ */
+static unsigned int _db_tree_remove(struct db_arg_chain_tree **tree,
+ struct db_arg_chain_tree *node)
+{
+ int cnt = 0;
+ struct db_arg_chain_tree *c_iter;
+
+ if (tree == NULL || *tree == NULL || node == NULL)
+ return 0;
+
+ c_iter = *tree;
+ while (c_iter->lvl_prv != NULL)
+ c_iter = c_iter->lvl_prv;
+
+ do {
+ if (c_iter == node || db_chain_zombie(c_iter)) {
+ /* remove from the tree */
+ if (c_iter == *tree) {
+ if (c_iter->lvl_prv != NULL)
+ *tree = c_iter->lvl_prv;
+ else
+ *tree = c_iter->lvl_nxt;
+ }
+ if (c_iter->lvl_prv != NULL)
+ c_iter->lvl_prv->lvl_nxt = c_iter->lvl_nxt;
+ if (c_iter->lvl_nxt != NULL)
+ c_iter->lvl_nxt->lvl_prv = c_iter->lvl_prv;
+
+ /* free and return */
+ c_iter->lvl_prv = NULL;
+ c_iter->lvl_nxt = NULL;
+ cnt += _db_tree_free(c_iter);
+ return cnt;
+ }
+
+ /* check the true/false sub-trees */
+ cnt += _db_tree_remove(&(c_iter->nxt_t), node);
+ cnt += _db_tree_remove(&(c_iter->nxt_f), node);
+
+ c_iter = c_iter->lvl_nxt;
+ } while (c_iter != NULL);
+
+ return cnt;
+}
+
+/**
+ * Traverse a tree checking the action values
+ * @param tree the pointer to the tree
+ * @param action the action
+ *
+ * Traverse the tree inspecting each action to see if it matches the given
+ * action. Returns zero if all actions match the given action, negative values
+ * on failure.
+ *
+ */
+static int _db_tree_act_check(struct db_arg_chain_tree *tree, uint32_t action)
+{
+ int rc;
+ struct db_arg_chain_tree *c_iter;
+
+ if (tree == NULL)
+ return 0;
+
+ c_iter = tree;
+ while (c_iter->lvl_prv != NULL)
+ c_iter = c_iter->lvl_prv;
+
+ do {
+ if (c_iter->act_t_flg && c_iter->act_t != action)
+ return -EEXIST;
+ if (c_iter->act_f_flg && c_iter->act_f != action)
+ return -EEXIST;
+
+ rc = _db_tree_act_check(c_iter->nxt_t, action);
+ if (rc < 0)
+ return rc;
+ rc = _db_tree_act_check(c_iter->nxt_f, action);
+ if (rc < 0)
+ return rc;
+
+ c_iter = c_iter->lvl_nxt;
+ } while (c_iter != NULL);
+
+ return 0;
+}
+
+/**
+ * Checks for a sub-tree match in an existing tree and prunes the tree
+ * @param prev the head of the existing tree or sub-tree
+ * @param existing the starting point into the existing tree
+ * @param new pointer to the new tree
+ * @param state pointer to the pruning state
+ *
+ * This function searches the existing and new trees trying to prune each to
+ * eliminate redundancy. Returns the number of nodes removed from the tree on
+ * success, zero if no changes were made, and negative values if the new tree
+ * should be discarded.
+ *
+ */
+static int _db_tree_sub_prune(struct db_arg_chain_tree **prev,
+ struct db_arg_chain_tree *existing,
+ struct db_arg_chain_tree *new,
+ struct db_prune_state *state)
+{
+ int rc = 0;
+ int rc_tmp;
+ struct db_arg_chain_tree *ec_iter;
+ struct db_arg_chain_tree *ec_iter_tmp;
+ struct db_arg_chain_tree *c_iter;
+ struct db_prune_state state_new;
+
+ if (!state || !existing || !new)
+ return 0;
+
+ ec_iter = existing;
+ c_iter = new;
+ do {
+ if (db_chain_eq(ec_iter, c_iter)) {
+ /* equal */
+
+ if (db_chain_leaf(c_iter)) {
+ /* leaf */
+ if (db_chain_eq_result(ec_iter, c_iter)) {
+ /* identical results */
+ if (prev != NULL)
+ return _db_tree_remove(prev,
+ ec_iter);
+ else
+ return -1;
+ }
+ if (c_iter->act_t_flg && ec_iter->nxt_t) {
+ /* new is shorter (true) */
+ if (prev == NULL)
+ return -1;
+ rc += _db_tree_remove(&(ec_iter->nxt_t),
+ ec_iter->nxt_t);
+ ec_iter->act_t = c_iter->act_t;
+ ec_iter->act_t_flg = true;
+ }
+ if (c_iter->act_f_flg && ec_iter->nxt_f) {
+ /* new is shorter (false) */
+ if (prev == NULL)
+ return -1;
+ rc += _db_tree_remove(&(ec_iter->nxt_f),
+ ec_iter->nxt_f);
+ ec_iter->act_f = c_iter->act_f;
+ ec_iter->act_f_flg = true;
+ }
+
+ return rc;
+ }
+
+ if (c_iter->nxt_t && ec_iter->act_t_flg)
+ /* existing is shorter (true) */
+ return -1;
+ if (c_iter->nxt_f && ec_iter->act_f_flg)
+ /* existing is shorter (false) */
+ return -1;
+
+ if (c_iter->nxt_t) {
+ state_new = *state;
+ state_new.matched = true;
+ rc_tmp = _db_tree_sub_prune((prev ?
+ &ec_iter : NULL),
+ ec_iter->nxt_t,
+ c_iter->nxt_t,
+ &state_new);
+ rc += (rc_tmp > 0 ? rc_tmp : 0);
+ if (state->prefix_new && rc_tmp < 0)
+ return (rc > 0 ? rc : rc_tmp);
+ }
+ if (c_iter->nxt_f) {
+ state_new = *state;
+ state_new.matched = true;
+ rc_tmp = _db_tree_sub_prune((prev ?
+ &ec_iter : NULL),
+ ec_iter->nxt_f,
+ c_iter->nxt_f,
+ &state_new);
+ rc += (rc_tmp > 0 ? rc_tmp : 0);
+ if (state->prefix_new && rc_tmp < 0)
+ return (rc > 0 ? rc : rc_tmp);
+ }
+ } else if (db_chain_lt(ec_iter, c_iter)) {
+ /* less than */
+ if (state->matched || state->prefix_new)
+ goto next;
+ state_new = *state;
+ state_new.prefix_exist = true;
+
+ if (ec_iter->nxt_t) {
+ rc_tmp = _db_tree_sub_prune((prev ?
+ &ec_iter : NULL),
+ ec_iter->nxt_t,
+ c_iter,
+ &state_new);
+ rc += (rc_tmp > 0 ? rc_tmp : 0);
+ }
+ if (ec_iter->nxt_f) {
+ rc_tmp = _db_tree_sub_prune((prev ?
+ &ec_iter : NULL),
+ ec_iter->nxt_f,
+ c_iter,
+ &state_new);
+ rc += (rc_tmp > 0 ? rc_tmp : 0);
+ }
+ } else if (db_chain_gt(ec_iter, c_iter)) {
+ /* greater than */
+ if (state->matched || state->prefix_exist)
+ goto next;
+ state_new = *state;
+ state_new.prefix_new = true;
+
+ if (c_iter->nxt_t) {
+ rc_tmp = _db_tree_sub_prune(NULL,
+ ec_iter,
+ c_iter->nxt_t,
+ &state_new);
+ rc += (rc_tmp > 0 ? rc_tmp : 0);
+ if (rc_tmp < 0)
+ return (rc > 0 ? rc : rc_tmp);
+ }
+ if (c_iter->nxt_f) {
+ rc_tmp = _db_tree_sub_prune(NULL,
+ ec_iter,
+ c_iter->nxt_f,
+ &state_new);
+ rc += (rc_tmp > 0 ? rc_tmp : 0);
+ if (rc_tmp < 0)
+ return (rc > 0 ? rc : rc_tmp);
+ }
+ }
+
+next:
+ /* re-check current node and advance to the next node */
+ if (db_chain_zombie(ec_iter)) {
+ ec_iter_tmp = ec_iter->lvl_nxt;
+ rc += _db_tree_remove(prev, ec_iter);
+ ec_iter = ec_iter_tmp;
+ } else
+ ec_iter = ec_iter->lvl_nxt;
+ } while (ec_iter);
+
+ return rc;
+}
+
+/**
+ * Free and reset the seccomp filter DB
+ * @param db the seccomp filter DB
+ *
+ * This function frees any existing filters and resets the filter DB to a
+ * default state; only the DB architecture is preserved.
+ *
+ */
+static void _db_reset(struct db_filter *db)
+{
+ struct db_sys_list *s_iter;
+ struct db_api_rule_list *r_iter;
+
+ if (db == NULL)
+ return;
+
+ /* free any filters */
+ if (db->syscalls != NULL) {
+ s_iter = db->syscalls;
+ while (s_iter != NULL) {
+ db->syscalls = s_iter->next;
+ _db_tree_free(s_iter->chains);
+ free(s_iter);
+ s_iter = db->syscalls;
+ }
+ db->syscalls = NULL;
+ }
+
+ /* free any rules */
+ if (db->rules != NULL) {
+ /* split the loop first then loop and free */
+ db->rules->prev->next = NULL;
+ r_iter = db->rules;
+ while (r_iter != NULL) {
+ db->rules = r_iter->next;
+ free(r_iter->args);
+ free(r_iter);
+ r_iter = db->rules;
+ }
+ db->rules = NULL;
+ }
+}
+
+/**
+ * Intitalize a seccomp filter DB
+ * @param arch the architecture definition
+ *
+ * This function initializes a seccomp filter DB and readies it for use.
+ * Returns a pointer to the DB on success, NULL on failure.
+ *
+ */
+static struct db_filter *_db_init(const struct arch_def *arch)
+{
+ struct db_filter *db;
+
+ db = malloc(sizeof(*db));
+ if (db == NULL)
+ return NULL;
+
+ /* clear the buffer for the first time and set the arch */
+ memset(db, 0, sizeof(*db));
+ db->arch = arch;
+
+ /* reset the DB to a known state */
+ _db_reset(db);
+
+ return db;
+}
+
+/**
+ * Destroy a seccomp filter DB
+ * @param db the seccomp filter DB
+ *
+ * This function destroys a seccomp filter DB. After calling this function,
+ * the filter should no longer be referenced.
+ *
+ */
+static void _db_release(struct db_filter *db)
+{
+ if (db == NULL)
+ return;
+
+ /* free and reset the DB */
+ _db_reset(db);
+ free(db);
+}
+
+/**
+ * Destroy a seccomp filter snapshot
+ * @param snap the seccomp filter snapshot
+ *
+ * This function destroys a seccomp filter snapshot. After calling this
+ * function, the snapshot should no longer be referenced.
+ *
+ */
+static void _db_snap_release(struct db_filter_snap *snap)
+{
+ unsigned int iter;
+
+ if (snap->filter_cnt > 0) {
+ for (iter = 0; iter < snap->filter_cnt; iter++) {
+ if (snap->filters[iter])
+ _db_release(snap->filters[iter]);
+ }
+ free(snap->filters);
+ }
+ free(snap);
+}
+
+/**
+ * Update the user specified portion of the syscall priority
+ * @param db the seccomp filter db
+ * @param syscall the syscall number
+ * @param priority the syscall priority
+ *
+ * This function sets, or updates, the syscall priority; the highest priority
+ * value between the existing and specified value becomes the new syscall
+ * priority. If the syscall entry does not already exist, a new phantom
+ * syscall entry is created as a placeholder. Returns zero on success,
+ * negative values on failure.
+ *
+ */
+static int _db_syscall_priority(struct db_filter *db,
+ int syscall, uint8_t priority)
+{
+ unsigned int sys_pri = _DB_PRI_USER(priority);
+ struct db_sys_list *s_new, *s_iter, *s_prev = NULL;
+
+ assert(db != NULL);
+
+ s_iter = db->syscalls;
+ while (s_iter != NULL && s_iter->num < syscall) {
+ s_prev = s_iter;
+ s_iter = s_iter->next;
+ }
+
+ /* matched an existing syscall entry */
+ if (s_iter != NULL && s_iter->num == syscall) {
+ if (sys_pri > (s_iter->priority & _DB_PRI_MASK_USER)) {
+ s_iter->priority &= (~_DB_PRI_MASK_USER);
+ s_iter->priority |= sys_pri;
+ }
+ return 0;
+ }
+
+ /* no existing syscall entry - create a phantom entry */
+ s_new = malloc(sizeof(*s_new));
+ if (s_new == NULL)
+ return -ENOMEM;
+ memset(s_new, 0, sizeof(*s_new));
+ s_new->num = syscall;
+ s_new->priority = sys_pri;
+ s_new->valid = false;
+
+ /* add it before s_iter */
+ if (s_prev != NULL) {
+ s_new->next = s_prev->next;
+ s_prev->next = s_new;
+ } else {
+ s_new->next = db->syscalls;
+ db->syscalls = s_new;
+ }
+
+ return 0;
+}
+
+/**
+ * Free and reset the seccomp filter collection
+ * @param col the seccomp filter collection
+ * @param def_action the default filter action
+ *
+ * This function frees any existing filter DBs and resets the collection to a
+ * default state. In the case of failure the filter collection may be in an
+ * unknown state and should be released. Returns zero on success, negative
+ * values on failure.
+ *
+ */
+int db_col_reset(struct db_filter_col *col, uint32_t def_action)
+{
+ unsigned int iter;
+ struct db_filter *db;
+ struct db_filter_snap *snap;
+
+ if (col == NULL)
+ return -EINVAL;
+
+ /* free any filters */
+ for (iter = 0; iter < col->filter_cnt; iter++)
+ _db_release(col->filters[iter]);
+ col->filter_cnt = 0;
+ if (col->filters)
+ free(col->filters);
+ col->filters = NULL;
+
+ /* set the endianess to undefined */
+ col->endian = 0;
+
+ /* set the default attribute values */
+ col->attr.act_default = def_action;
+ col->attr.act_badarch = SCMP_ACT_KILL;
+ col->attr.nnp_enable = 1;
+ col->attr.tsync_enable = 0;
+
+ /* set the state */
+ col->state = _DB_STA_VALID;
+
+ /* reset the initial db */
+ db = _db_init(arch_def_native);
+ if (db == NULL)
+ return -ENOMEM;
+ if (db_col_db_add(col, db) < 0) {
+ _db_release(db);
+ return -ENOMEM;
+ }
+
+ /* reset the transactions */
+ while (col->snapshots) {
+ snap = col->snapshots;
+ col->snapshots = snap->next;
+ for (iter = 0; iter < snap->filter_cnt; iter++)
+ _db_release(snap->filters[iter]);
+ free(snap->filters);
+ free(snap);
+ }
+
+ return 0;
+}
+
+/**
+ * Intitalize a seccomp filter collection
+ * @param def_action the default filter action
+ *
+ * This function initializes a seccomp filter collection and readies it for
+ * use. Returns a pointer to the collection on success, NULL on failure.
+ *
+ */
+struct db_filter_col *db_col_init(uint32_t def_action)
+{
+ struct db_filter_col *col;
+
+ col = malloc(sizeof(*col));
+ if (col == NULL)
+ return NULL;
+
+ /* clear the buffer for the first time */
+ memset(col, 0, sizeof(*col));
+
+ /* reset the DB to a known state */
+ if (db_col_reset(col, def_action) < 0)
+ goto init_failure;
+
+ return col;
+
+init_failure:
+ db_col_release(col);
+ return NULL;
+}
+
+/**
+ * Destroy a seccomp filter collection
+ * @param col the seccomp filter collection
+ *
+ * This function destroys a seccomp filter collection. After calling this
+ * function, the filter should no longer be referenced.
+ *
+ */
+void db_col_release(struct db_filter_col *col)
+{
+ unsigned int iter;
+
+ if (col == NULL)
+ return;
+
+ /* set the state, just in case */
+ col->state = _DB_STA_FREED;
+
+ /* free any filters */
+ for (iter = 0; iter < col->filter_cnt; iter++)
+ _db_release(col->filters[iter]);
+ col->filter_cnt = 0;
+ if (col->filters)
+ free(col->filters);
+ col->filters = NULL;
+
+ /* free the collection */
+ free(col);
+}
+
+/**
+ * Validate the seccomp action
+ * @param action the seccomp action
+ *
+ * Verify that the given action is a valid seccomp action; return zero if
+ * valid, -EINVAL if invalid.
+ */
+int db_action_valid(uint32_t action)
+{
+ if (action == SCMP_ACT_KILL)
+ return 0;
+ else if (action == SCMP_ACT_TRAP)
+ return 0;
+ else if ((action == SCMP_ACT_ERRNO(action & 0x0000ffff)) &&
+ ((action & 0x0000ffff) < MAX_ERRNO))
+ return 0;
+ else if (action == SCMP_ACT_TRACE(action & 0x0000ffff))
+ return 0;
+ else if (action == SCMP_ACT_ALLOW)
+ return 0;
+
+ return -EINVAL;
+}
+
+/**
+ * Validate a filter collection
+ * @param col the seccomp filter collection
+ *
+ * This function validates a seccomp filter collection. Returns zero if the
+ * collection is valid, negative values on failure.
+ *
+ */
+int db_col_valid(struct db_filter_col *col)
+{
+ if (col != NULL && col->state == _DB_STA_VALID && col->filter_cnt > 0)
+ return 0;
+ return -EINVAL;
+}
+
+/**
+ * Merge two filter collections
+ * @param col_dst the destination filter collection
+ * @param col_src the source filter collection
+ *
+ * This function merges two filter collections into the given destination
+ * collection. The source filter collection is no longer valid if the function
+ * returns successfully. Returns zero on success, negative values on failure.
+ *
+ */
+int db_col_merge(struct db_filter_col *col_dst, struct db_filter_col *col_src)
+{
+ unsigned int iter_a, iter_b;
+ struct db_filter **dbs;
+
+ /* verify that the endianess is a match */
+ if (col_dst->endian != col_src->endian)
+ return -EEXIST;
+
+ /* make sure we don't have any arch/filter collisions */
+ for (iter_a = 0; iter_a < col_dst->filter_cnt; iter_a++) {
+ for (iter_b = 0; iter_b < col_src->filter_cnt; iter_b++) {
+ if (col_dst->filters[iter_a]->arch->token ==
+ col_src->filters[iter_b]->arch->token)
+ return -EEXIST;
+ }
+ }
+
+ /* expand the destination */
+ dbs = realloc(col_dst->filters,
+ sizeof(struct db_filter *) *
+ (col_dst->filter_cnt + col_src->filter_cnt));
+ if (dbs == NULL)
+ return -ENOMEM;
+ col_dst->filters = dbs;
+
+ /* transfer the architecture filters */
+ for (iter_a = col_dst->filter_cnt, iter_b = 0;
+ iter_b < col_src->filter_cnt; iter_a++, iter_b++) {
+ col_dst->filters[iter_a] = col_src->filters[iter_b];
+ col_dst->filter_cnt++;
+ }
+
+ /* free the source */
+ col_src->filter_cnt = 0;
+ db_col_release(col_src);
+
+ return 0;
+}
+
+/**
+ * Check to see if an architecture filter exists in the filter collection
+ * @param col the seccomp filter collection
+ * @param arch_token the architecture token
+ *
+ * Iterate through the given filter collection checking to see if a filter
+ * exists for the specified architecture. Returns -EEXIST if a filter is found,
+ * zero if a matching filter does not exist.
+ *
+ */
+int db_col_arch_exist(struct db_filter_col *col, uint32_t arch_token)
+{
+ unsigned int iter;
+
+ for (iter = 0; iter < col->filter_cnt; iter++)
+ if (col->filters[iter]->arch->token == arch_token)
+ return -EEXIST;
+
+ return 0;
+}
+
+/**
+ * Get a filter attribute
+ * @param col the seccomp filter collection
+ * @param attr the filter attribute
+ * @param value the filter attribute value
+ *
+ * Get the requested filter attribute and provide it via @value. Returns zero
+ * on success, negative values on failure.
+ *
+ */
+int db_col_attr_get(const struct db_filter_col *col,
+ enum scmp_filter_attr attr, uint32_t *value)
+{
+ int rc = 0;
+
+ switch (attr) {
+ case SCMP_FLTATR_ACT_DEFAULT:
+ *value = col->attr.act_default;
+ break;
+ case SCMP_FLTATR_ACT_BADARCH:
+ *value = col->attr.act_badarch;
+ break;
+ case SCMP_FLTATR_CTL_NNP:
+ *value = col->attr.nnp_enable;
+ break;
+ case SCMP_FLTATR_CTL_TSYNC:
+ *value = col->attr.tsync_enable;
+ break;
+ default:
+ rc = -EEXIST;
+ break;
+ }
+
+ return rc;
+}
+
+/**
+ * Set a filter attribute
+ * @param col the seccomp filter collection
+ * @param attr the filter attribute
+ * @param value the filter attribute value
+ *
+ * Set the requested filter attribute with the given value. Returns zero on
+ * success, negative values on failure.
+ *
+ */
+int db_col_attr_set(struct db_filter_col *col,
+ enum scmp_filter_attr attr, uint32_t value)
+{
+ int rc = 0;
+
+ switch (attr) {
+ case SCMP_FLTATR_ACT_DEFAULT:
+ /* read only */
+ return -EACCES;
+ break;
+ case SCMP_FLTATR_ACT_BADARCH:
+ if (db_action_valid(value) == 0)
+ col->attr.act_badarch = value;
+ else
+ return -EINVAL;
+ break;
+ case SCMP_FLTATR_CTL_NNP:
+ col->attr.nnp_enable = (value ? 1 : 0);
+ break;
+ case SCMP_FLTATR_CTL_TSYNC:
+ rc = sys_chk_seccomp_flag(SECCOMP_FILTER_FLAG_TSYNC);
+ if (rc == 1) {
+ /* supported */
+ rc = 0;
+ col->attr.tsync_enable = (value ? 1 : 0);
+ } else if (rc == 0)
+ /* unsupported */
+ rc = -EOPNOTSUPP;
+ break;
+ default:
+ rc = -EEXIST;
+ break;
+ }
+
+ return rc;
+}
+
+/**
+ * Add a new architecture filter to a filter collection
+ * @param col the seccomp filter collection
+ * @param arch the architecture
+ *
+ * This function adds a new architecture filter DB to an existing seccomp
+ * filter collection assuming there isn't a filter DB already present with the
+ * same architecture. Returns zero on success, negative values on failure.
+ *
+ */
+int db_col_db_new(struct db_filter_col *col, const struct arch_def *arch)
+{
+ int rc;
+ struct db_filter *db;
+
+ db = _db_init(arch);
+ if (db == NULL)
+ return -ENOMEM;
+ rc = db_col_db_add(col, db);
+ if (rc < 0)
+ _db_release(db);
+
+ return rc;
+}
+
+/**
+ * Add a new filter DB to a filter collection
+ * @param col the seccomp filter collection
+ * @param db the seccomp filter DB
+ *
+ * This function adds an existing seccomp filter DB to an existing seccomp
+ * filter collection assuming there isn't a filter DB already present with the
+ * same architecture. Returns zero on success, negative values on failure.
+ *
+ */
+int db_col_db_add(struct db_filter_col *col, struct db_filter *db)
+{
+ struct db_filter **dbs;
+
+ if (col->endian != 0 && col->endian != db->arch->endian)
+ return -EEXIST;
+
+ if (db_col_arch_exist(col, db->arch->token))
+ return -EEXIST;
+
+ dbs = realloc(col->filters,
+ sizeof(struct db_filter *) * (col->filter_cnt + 1));
+ if (dbs == NULL)
+ return -ENOMEM;
+ col->filters = dbs;
+ col->filter_cnt++;
+ col->filters[col->filter_cnt - 1] = db;
+ if (col->endian == 0)
+ col->endian = db->arch->endian;
+
+ return 0;
+}
+
+/**
+ * Remove a filter DB from a filter collection
+ * @param col the seccomp filter collection
+ * @param arch_token the architecture token
+ *
+ * This function removes an existing seccomp filter DB from an existing seccomp
+ * filter collection. Returns zero on success, negative values on failure.
+ *
+ */
+int db_col_db_remove(struct db_filter_col *col, uint32_t arch_token)
+{
+ unsigned int iter;
+ unsigned int found;
+ struct db_filter **dbs;
+
+ if ((col->filter_cnt <= 0) || (db_col_arch_exist(col, arch_token) == 0))
+ return -EINVAL;
+
+ for (found = 0, iter = 0; iter < col->filter_cnt; iter++) {
+ if (found)
+ col->filters[iter - 1] = col->filters[iter];
+ else if (col->filters[iter]->arch->token == arch_token) {
+ _db_release(col->filters[iter]);
+ found = 1;
+ }
+ }
+ col->filters[--col->filter_cnt] = NULL;
+
+ if (col->filter_cnt > 0) {
+ /* NOTE: if we can't do the realloc it isn't fatal, we just
+ * have some extra space allocated */
+ dbs = realloc(col->filters,
+ sizeof(struct db_filter *) * col->filter_cnt);
+ if (dbs != NULL)
+ col->filters = dbs;
+ } else {
+ /* this was the last filter so free all the associated memory
+ * and reset the endian token */
+ free(col->filters);
+ col->filters = NULL;
+ col->endian = 0;
+ }
+
+ return 0;
+}
+
+/**
+ * Test if the argument filter can be skipped because it's a tautology
+ * @param arg argument filter
+ *
+ * If this argument filter applied to the lower 32 bit can be skipped this
+ * function returns false.
+ *
+ */
+static bool _db_arg_cmp_need_lo(const struct db_api_arg *arg)
+{
+ if (arg->op == SCMP_CMP_MASKED_EQ && D64_LO(arg->mask) == 0)
+ return false;
+
+ return true;
+}
+
+/**
+ * Test if the argument filter can be skipped because it's a tautology
+ * @param arg argument filter
+ *
+ * If this argument filter applied to the upper 32 bit can be skipped this
+ * function returns false.
+ *
+ */
+static bool _db_arg_cmp_need_hi(const struct db_api_arg *arg)
+{
+ if (arg->op == SCMP_CMP_MASKED_EQ && D64_HI(arg->mask) == 0)
+ return false;
+
+ return true;
+}
+
+/**
+ * Fixup the node based on the op/mask
+ * @param node the chain node
+ *
+ * Ensure the datum is masked as well.
+ *
+ */
+static void _db_node_mask_fixup(struct db_arg_chain_tree *node)
+{
+ node->datum &= node->mask;
+}
+
+/**
+ * Generate a new filter rule for a 64 bit system
+ * @param arch the architecture definition
+ * @param action the filter action
+ * @param syscall the syscall number
+ * @param chain argument filter chain
+ *
+ * This function generates a new syscall filter for a 64 bit system. Returns
+ * zero on success, negative values on failure.
+ *
+ */
+static struct db_sys_list *_db_rule_gen_64(const struct arch_def *arch,
+ uint32_t action,
+ unsigned int syscall,
+ struct db_api_arg *chain)
+{
+ unsigned int iter;
+ int chain_len_max;
+ struct db_sys_list *s_new;
+ struct db_arg_chain_tree *c_iter_hi = NULL, *c_iter_lo = NULL;
+ struct db_arg_chain_tree *c_prev_hi = NULL, *c_prev_lo = NULL;
+ bool tf_flag;
+
+ s_new = malloc(sizeof(*s_new));
+ if (s_new == NULL)
+ return NULL;
+ memset(s_new, 0, sizeof(*s_new));
+ s_new->num = syscall;
+ s_new->valid = true;
+ /* run through the argument chain */
+ chain_len_max = arch_arg_count_max(arch);
+ if (chain_len_max < 0)
+ goto gen_64_failure;
+ for (iter = 0; iter < chain_len_max; iter++) {
+ if (chain[iter].valid == 0)
+ continue;
+
+ /* TODO: handle the case were either hi or lo isn't needed */
+
+ /* skip generating instruction which are no-ops */
+ if (!_db_arg_cmp_need_hi(&chain[iter]) &&
+ !_db_arg_cmp_need_lo(&chain[iter]))
+ continue;
+
+ c_iter_hi = malloc(sizeof(*c_iter_hi));
+ if (c_iter_hi == NULL)
+ goto gen_64_failure;
+ memset(c_iter_hi, 0, sizeof(*c_iter_hi));
+ c_iter_hi->refcnt = 1;
+ c_iter_lo = malloc(sizeof(*c_iter_lo));
+ if (c_iter_lo == NULL) {
+ free(c_iter_hi);
+ goto gen_64_failure;
+ }
+ memset(c_iter_lo, 0, sizeof(*c_iter_lo));
+ c_iter_lo->refcnt = 1;
+
+ /* link this level to the previous level */
+ if (c_prev_lo != NULL) {
+ if (!tf_flag) {
+ c_prev_lo->nxt_f = c_iter_hi;
+ c_prev_hi->nxt_f = c_iter_hi;
+ c_iter_hi->refcnt++;
+ } else
+ c_prev_lo->nxt_t = c_iter_hi;
+ } else
+ s_new->chains = c_iter_hi;
+ s_new->node_cnt += 2;
+
+ /* set the arg, op, and datum fields */
+ c_iter_hi->arg = chain[iter].arg;
+ c_iter_lo->arg = chain[iter].arg;
+ c_iter_hi->arg_offset = arch_arg_offset_hi(arch,
+ c_iter_hi->arg);
+ c_iter_lo->arg_offset = arch_arg_offset_lo(arch,
+ c_iter_lo->arg);
+ switch (chain[iter].op) {
+ case SCMP_CMP_GT:
+ c_iter_hi->op = SCMP_CMP_GE;
+ c_iter_lo->op = SCMP_CMP_GT;
+ tf_flag = true;
+ break;
+ case SCMP_CMP_NE:
+ c_iter_hi->op = SCMP_CMP_EQ;
+ c_iter_lo->op = SCMP_CMP_EQ;
+ tf_flag = false;
+ break;
+ case SCMP_CMP_LT:
+ c_iter_hi->op = SCMP_CMP_GE;
+ c_iter_lo->op = SCMP_CMP_GE;
+ tf_flag = false;
+ break;
+ case SCMP_CMP_LE:
+ c_iter_hi->op = SCMP_CMP_GE;
+ c_iter_lo->op = SCMP_CMP_GT;
+ tf_flag = false;
+ break;
+ default:
+ c_iter_hi->op = chain[iter].op;
+ c_iter_lo->op = chain[iter].op;
+ tf_flag = true;
+ }
+ c_iter_hi->mask = D64_HI(chain[iter].mask);
+ c_iter_lo->mask = D64_LO(chain[iter].mask);
+ c_iter_hi->datum = D64_HI(chain[iter].datum);
+ c_iter_lo->datum = D64_LO(chain[iter].datum);
+
+ /* fixup the mask/datum */
+ _db_node_mask_fixup(c_iter_hi);
+ _db_node_mask_fixup(c_iter_lo);
+
+ /* link the hi and lo chain nodes */
+ c_iter_hi->nxt_t = c_iter_lo;
+
+ c_prev_hi = c_iter_hi;
+ c_prev_lo = c_iter_lo;
+ }
+ if (c_iter_lo != NULL) {
+ /* set the leaf node */
+ if (!tf_flag) {
+ c_iter_lo->act_f_flg = true;
+ c_iter_lo->act_f = action;
+ c_iter_hi->act_f_flg = true;
+ c_iter_hi->act_f = action;
+ } else {
+ c_iter_lo->act_t_flg = true;
+ c_iter_lo->act_t = action;
+ }
+ } else
+ s_new->action = action;
+
+ return s_new;
+
+gen_64_failure:
+ /* free the new chain and its syscall struct */
+ _db_tree_free(s_new->chains);
+ free(s_new);
+ return NULL;
+}
+
+/**
+ * Generate a new filter rule for a 32 bit system
+ * @param arch the architecture definition
+ * @param action the filter action
+ * @param syscall the syscall number
+ * @param chain argument filter chain
+ *
+ * This function generates a new syscall filter for a 32 bit system. Returns
+ * zero on success, negative values on failure.
+ *
+ */
+static struct db_sys_list *_db_rule_gen_32(const struct arch_def *arch,
+ uint32_t action,
+ unsigned int syscall,
+ struct db_api_arg *chain)
+{
+ unsigned int iter;
+ int chain_len_max;
+ struct db_sys_list *s_new;
+ struct db_arg_chain_tree *c_iter = NULL, *c_prev = NULL;
+ bool tf_flag;
+
+ s_new = malloc(sizeof(*s_new));
+ if (s_new == NULL)
+ return NULL;
+ memset(s_new, 0, sizeof(*s_new));
+ s_new->num = syscall;
+ s_new->valid = true;
+ /* run through the argument chain */
+ chain_len_max = arch_arg_count_max(arch);
+ if (chain_len_max < 0)
+ goto gen_32_failure;
+ for (iter = 0; iter < chain_len_max; iter++) {
+ if (chain[iter].valid == 0)
+ continue;
+
+ /* skip generating instructions which are no-ops */
+ if (!_db_arg_cmp_need_lo(&chain[iter]))
+ continue;
+
+ c_iter = malloc(sizeof(*c_iter));
+ if (c_iter == NULL)
+ goto gen_32_failure;
+ memset(c_iter, 0, sizeof(*c_iter));
+ c_iter->refcnt = 1;
+ c_iter->arg = chain[iter].arg;
+ c_iter->arg_offset = arch_arg_offset(arch, c_iter->arg);
+ c_iter->op = chain[iter].op;
+ /* implicitly strips off the upper 32 bit */
+ c_iter->mask = chain[iter].mask;
+ c_iter->datum = chain[iter].datum;
+
+ /* link in the new node and update the chain */
+ if (c_prev != NULL) {
+ if (tf_flag)
+ c_prev->nxt_t = c_iter;
+ else
+ c_prev->nxt_f = c_iter;
+ } else
+ s_new->chains = c_iter;
+ s_new->node_cnt++;
+
+ /* rewrite the op to reduce the op/datum combos */
+ switch (c_iter->op) {
+ case SCMP_CMP_NE:
+ c_iter->op = SCMP_CMP_EQ;
+ tf_flag = false;
+ break;
+ case SCMP_CMP_LT:
+ c_iter->op = SCMP_CMP_GE;
+ tf_flag = false;
+ break;
+ case SCMP_CMP_LE:
+ c_iter->op = SCMP_CMP_GT;
+ tf_flag = false;
+ break;
+ default:
+ tf_flag = true;
+ }
+
+ /* fixup the mask/datum */
+ _db_node_mask_fixup(c_iter);
+
+ c_prev = c_iter;
+ }
+ if (c_iter != NULL) {
+ /* set the leaf node */
+ if (tf_flag) {
+ c_iter->act_t_flg = true;
+ c_iter->act_t = action;
+ } else {
+ c_iter->act_f_flg = true;
+ c_iter->act_f = action;
+ }
+ } else
+ s_new->action = action;
+
+ return s_new;
+
+gen_32_failure:
+ /* free the new chain and its syscall struct */
+ _db_tree_free(s_new->chains);
+ free(s_new);
+ return NULL;
+}
+
+/**
+ * Add a new rule to the seccomp filter DB
+ * @param db the seccomp filter db
+ * @param rule the filter rule
+ *
+ * This function adds a new syscall filter to the seccomp filter DB, adding to
+ * the existing filters for the syscall, unless no argument specific filters
+ * are present (filtering only on the syscall). When adding new chains, the
+ * shortest chain, or most inclusive filter match, will be entered into the
+ * filter DB. Returns zero on success, negative values on failure.
+ *
+ */
+int db_rule_add(struct db_filter *db, const struct db_api_rule_list *rule)
+{
+ int rc = -ENOMEM;
+ int syscall = rule->syscall;
+ uint32_t action = rule->action;
+ struct db_api_arg *chain = rule->args;
+ struct db_sys_list *s_new, *s_iter, *s_prev = NULL;
+ struct db_arg_chain_tree *c_iter = NULL, *c_prev = NULL;
+ struct db_arg_chain_tree *ec_iter;
+ struct db_prune_state state;
+ bool rm_flag = false;
+ unsigned int new_chain_cnt = 0;
+ unsigned int n_cnt;
+
+ assert(db != NULL);
+
+ /* do all our possible memory allocation up front so we don't have to
+ * worry about failure once we get to the point where we start updating
+ * the filter db */
+ if (db->arch->size == ARCH_SIZE_64)
+ s_new = _db_rule_gen_64(db->arch, action, syscall, chain);
+ else if (db->arch->size == ARCH_SIZE_32)
+ s_new = _db_rule_gen_32(db->arch, action, syscall, chain);
+ else
+ return -EFAULT;
+ if (s_new == NULL)
+ return -ENOMEM;
+ new_chain_cnt = s_new->node_cnt;
+
+ /* no more failures allowed after this point that would result in the
+ * stored filter being in an inconsistent state */
+
+ /* find a matching syscall/chain or insert a new one */
+ s_iter = db->syscalls;
+ while (s_iter != NULL && s_iter->num < syscall) {
+ s_prev = s_iter;
+ s_iter = s_iter->next;
+ }
+add_reset:
+ s_new->node_cnt = new_chain_cnt;
+ s_new->priority = _DB_PRI_MASK_CHAIN - s_new->node_cnt;
+ c_prev = NULL;
+ c_iter = s_new->chains;
+ if (s_iter != NULL)
+ ec_iter = s_iter->chains;
+ else
+ ec_iter = NULL;
+ if (s_iter == NULL || s_iter->num != syscall) {
+ /* new syscall, add before s_iter */
+ if (s_prev != NULL) {
+ s_new->next = s_prev->next;
+ s_prev->next = s_new;
+ } else {
+ s_new->next = db->syscalls;
+ db->syscalls = s_new;
+ }
+ return 0;
+ } else if (s_iter->chains == NULL) {
+ if (rm_flag || !s_iter->valid) {
+ /* we are here because our previous pass cleared the
+ * entire syscall chain when searching for a subtree
+ * match or the existing syscall entry is a phantom,
+ * so either way add the new chain */
+ s_iter->chains = s_new->chains;
+ s_iter->action = s_new->action;
+ s_iter->node_cnt = s_new->node_cnt;
+ if (s_iter->valid)
+ s_iter->priority = s_new->priority;
+ s_iter->valid = true;
+ free(s_new);
+ rc = 0;
+ goto add_priority_update;
+ } else
+ /* syscall exists without any chains - existing filter
+ * is at least as large as the new entry so cleanup and
+ * exit */
+ goto add_free_ok;
+ } else if (s_iter->chains != NULL && s_new->chains == NULL) {
+ /* syscall exists with chains but the new filter has no chains
+ * so we need to clear the existing chains and exit */
+ _db_tree_free(s_iter->chains);
+ s_iter->chains = NULL;
+ s_iter->node_cnt = 0;
+ s_iter->action = action;
+ goto add_free_ok;
+ }
+
+ /* check for sub-tree matches */
+ memset(&state, 0, sizeof(state));
+ rc = _db_tree_sub_prune(&(s_iter->chains), ec_iter, c_iter, &state);
+ if (rc > 0) {
+ rm_flag = true;
+ s_iter->node_cnt -= rc;
+ goto add_reset;
+ } else if (rc < 0)
+ goto add_free_ok;
+
+ /* syscall exists and has at least one existing chain - start at the
+ * top and walk the two chains */
+ do {
+ /* insert the new rule into the existing tree */
+ if (db_chain_eq(c_iter, ec_iter)) {
+ /* found a matching node on this chain level */
+ if (db_chain_action(c_iter) &&
+ db_chain_action(ec_iter)) {
+ /* both are "action" nodes */
+ if (c_iter->act_t_flg && ec_iter->act_t_flg) {
+ if (ec_iter->act_t != action)
+ goto add_free_exist;
+ } else if (c_iter->act_t_flg) {
+ ec_iter->act_t_flg = true;
+ ec_iter->act_t = action;
+ }
+ if (c_iter->act_f_flg && ec_iter->act_f_flg) {
+ if (ec_iter->act_f != action)
+ goto add_free_exist;
+ } else if (c_iter->act_f_flg) {
+ ec_iter->act_f_flg = true;
+ ec_iter->act_f = action;
+ }
+ if (ec_iter->act_t_flg == ec_iter->act_f_flg &&
+ ec_iter->act_t == ec_iter->act_f) {
+ n_cnt = _db_tree_remove(
+ &(s_iter->chains),
+ ec_iter);
+ s_iter->node_cnt -= n_cnt;
+ goto add_free_ok;
+ }
+ } else if (db_chain_action(c_iter)) {
+ /* new is shorter */
+ if (c_iter->act_t_flg) {
+ rc = _db_tree_act_check(ec_iter->nxt_t,
+ action);
+ if (rc < 0)
+ goto add_free;
+ n_cnt = _db_tree_free(ec_iter->nxt_t);
+ ec_iter->nxt_t = NULL;
+ ec_iter->act_t_flg = true;
+ ec_iter->act_t = action;
+ } else {
+ rc = _db_tree_act_check(ec_iter->nxt_f,
+ action);
+ if (rc < 0)
+ goto add_free;
+ n_cnt = _db_tree_free(ec_iter->nxt_f);
+ ec_iter->nxt_f = NULL;
+ ec_iter->act_f_flg = true;
+ ec_iter->act_f = action;
+ }
+ s_iter->node_cnt -= n_cnt;
+ }
+ if (c_iter->nxt_t != NULL) {
+ if (ec_iter->nxt_t != NULL) {
+ /* jump to the next level */
+ c_prev = c_iter;
+ c_iter = c_iter->nxt_t;
+ ec_iter = ec_iter->nxt_t;
+ s_new->node_cnt--;
+ } else if (ec_iter->act_t_flg) {
+ /* existing is shorter */
+ if (ec_iter->act_t == action)
+ goto add_free_ok;
+ goto add_free_exist;
+ } else {
+ /* add a new branch */
+ c_prev = c_iter;
+ ec_iter->nxt_t = c_iter->nxt_t;
+ s_iter->node_cnt +=
+ (s_new->node_cnt - 1);
+ goto add_free_match;
+ }
+ } else if (c_iter->nxt_f != NULL) {
+ if (ec_iter->nxt_f != NULL) {
+ /* jump to the next level */
+ c_prev = c_iter;
+ c_iter = c_iter->nxt_f;
+ ec_iter = ec_iter->nxt_f;
+ s_new->node_cnt--;
+ } else if (ec_iter->act_f_flg) {
+ /* existing is shorter */
+ if (ec_iter->act_f == action)
+ goto add_free_ok;
+ goto add_free_exist;
+ } else {
+ /* add a new branch */
+ c_prev = c_iter;
+ ec_iter->nxt_f = c_iter->nxt_f;
+ s_iter->node_cnt +=
+ (s_new->node_cnt - 1);
+ goto add_free_match;
+ }
+ } else
+ goto add_free_ok;
+ } else {
+ /* need to check other nodes on this level */
+ if (db_chain_lt(c_iter, ec_iter)) {
+ if (ec_iter->lvl_prv == NULL) {
+ /* add to the start of the level */
+ ec_iter->lvl_prv = c_iter;
+ c_iter->lvl_nxt = ec_iter;
+ if (ec_iter == s_iter->chains)
+ s_iter->chains = c_iter;
+ s_iter->node_cnt += s_new->node_cnt;
+ goto add_free_match;
+ } else
+ ec_iter = ec_iter->lvl_prv;
+ } else {
+ if (ec_iter->lvl_nxt == NULL) {
+ /* add to the end of the level */
+ ec_iter->lvl_nxt = c_iter;
+ c_iter->lvl_prv = ec_iter;
+ s_iter->node_cnt += s_new->node_cnt;
+ goto add_free_match;
+ } else if (db_chain_lt(c_iter,
+ ec_iter->lvl_nxt)) {
+ /* add new chain in between */
+ c_iter->lvl_nxt = ec_iter->lvl_nxt;
+ ec_iter->lvl_nxt->lvl_prv = c_iter;
+ ec_iter->lvl_nxt = c_iter;
+ c_iter->lvl_prv = ec_iter;
+ s_iter->node_cnt += s_new->node_cnt;
+ goto add_free_match;
+ } else
+ ec_iter = ec_iter->lvl_nxt;
+ }
+ }
+ } while ((c_iter != NULL) && (ec_iter != NULL));
+
+ /* we should never be here! */
+ return -EFAULT;
+
+add_free_exist:
+ rc = -EEXIST;
+ goto add_free;
+add_free_ok:
+ rc = 0;
+add_free:
+ /* free the new chain and its syscall struct */
+ _db_tree_free(s_new->chains);
+ free(s_new);
+ goto add_priority_update;
+add_free_match:
+ /* free the matching portion of new chain */
+ if (c_prev != NULL) {
+ c_prev->nxt_t = NULL;
+ c_prev->nxt_f = NULL;
+ _db_tree_free(s_new->chains);
+ }
+ free(s_new);
+ rc = 0;
+add_priority_update:
+ /* update the priority */
+ if (s_iter != NULL) {
+ s_iter->priority &= (~_DB_PRI_MASK_CHAIN);
+ s_iter->priority |= (_DB_PRI_MASK_CHAIN - s_iter->node_cnt);
+ }
+ return rc;
+}
+
+/**
+ * Set the priority of a given syscall
+ * @param col the filter collection
+ * @param syscall the syscall number
+ * @param priority priority value, higher value == higher priority
+ *
+ * This function sets the priority of the given syscall; this value is used
+ * when generating the seccomp filter code such that higher priority syscalls
+ * will incur less filter code overhead than the lower priority syscalls in the
+ * filter. Returns zero on success, negative values on failure.
+ *
+ */
+int db_col_syscall_priority(struct db_filter_col *col,
+ int syscall, uint8_t priority)
+{
+ int rc = 0, rc_tmp;
+ unsigned int iter;
+ int sc_tmp;
+ struct db_filter *filter;
+
+ for (iter = 0; iter < col->filter_cnt; iter++) {
+ filter = col->filters[iter];
+ sc_tmp = syscall;
+
+ rc_tmp = arch_syscall_translate(filter->arch, &sc_tmp);
+ if (rc_tmp < 0)
+ goto priority_failure;
+
+ /* if this is a pseudo syscall (syscall < 0) then we need to
+ * rewrite the syscall for some arch specific reason */
+ if (sc_tmp < 0) {
+ /* we set this as a strict op - we don't really care
+ * since priorities are a "best effort" thing - as we
+ * want to catch the -EDOM error and bail on this
+ * architecture */
+ rc_tmp = arch_syscall_rewrite(filter->arch, &sc_tmp);
+ if (rc_tmp == -EDOM)
+ continue;
+ if (rc_tmp < 0)
+ goto priority_failure;
+ }
+
+ rc_tmp = _db_syscall_priority(filter, sc_tmp, priority);
+
+priority_failure:
+ if (rc == 0 && rc_tmp < 0)
+ rc = rc_tmp;
+ }
+
+ return rc;
+}
+
+/**
+ * Add a new rule to the current filter
+ * @param col the filter collection
+ * @param strict the strict flag
+ * @param action the filter action
+ * @param syscall the syscall number
+ * @param arg_cnt the number of argument filters in the argument filter chain
+ * @param arg_array the argument filter chain, (uint, enum scmp_compare, ulong)
+ *
+ * This function adds a new argument/comparison/value to the seccomp filter for
+ * a syscall; multiple arguments can be specified and they will be chained
+ * together (essentially AND'd together) in the filter. When the strict flag
+ * is true the function will fail if the exact rule can not be added to the
+ * filter, if the strict flag is false the function will not fail if the
+ * function needs to adjust the rule due to architecture specifics. Returns
+ * zero on success, negative values on failure.
+ *
+ */
+int db_col_rule_add(struct db_filter_col *col,
+ bool strict, uint32_t action, int syscall,
+ unsigned int arg_cnt, const struct scmp_arg_cmp *arg_array)
+{
+ int rc = 0, rc_tmp;
+ unsigned int iter;
+ unsigned int chain_len;
+ unsigned int arg_num;
+ size_t chain_size;
+ struct db_api_arg *chain = NULL;
+ struct scmp_arg_cmp arg_data;
+
+ /* collect the arguments for the filter rule */
+ chain_len = ARG_COUNT_MAX;
+ chain_size = sizeof(*chain) * chain_len;
+ chain = malloc(chain_size);
+ if (chain == NULL)
+ return -ENOMEM;
+ memset(chain, 0, chain_size);
+ for (iter = 0; iter < arg_cnt; iter++) {
+ arg_data = arg_array[iter];
+ arg_num = arg_data.arg;
+ if (arg_num < chain_len && chain[arg_num].valid == 0) {
+ chain[arg_num].valid = 1;
+ chain[arg_num].arg = arg_num;
+ chain[arg_num].op = arg_data.op;
+ /* XXX - we should check datum/mask size against the
+ * arch definition, e.g. 64 bit datum on x86 */
+ switch (chain[arg_num].op) {
+ case SCMP_CMP_NE:
+ case SCMP_CMP_LT:
+ case SCMP_CMP_LE:
+ case SCMP_CMP_EQ:
+ case SCMP_CMP_GE:
+ case SCMP_CMP_GT:
+ chain[arg_num].mask = DATUM_MAX;
+ chain[arg_num].datum = arg_data.datum_a;
+ break;
+ case SCMP_CMP_MASKED_EQ:
+ chain[arg_num].mask = arg_data.datum_a;
+ chain[arg_num].datum = arg_data.datum_b;
+ break;
+ default:
+ rc = -EINVAL;
+ goto add_return;
+ }
+ } else {
+ rc = -EINVAL;
+ goto add_return;
+ }
+ }
+
+ for (iter = 0; iter < col->filter_cnt; iter++) {
+ rc_tmp = arch_filter_rule_add(col, col->filters[iter], strict,
+ action, syscall,
+ chain_len, chain);
+ if (rc == 0 && rc_tmp < 0)
+ rc = rc_tmp;
+ }
+
+add_return:
+ if (chain != NULL)
+ free(chain);
+ return rc;
+}
+
+/**
+ * Start a new seccomp filter transaction
+ * @param col the filter collection
+ *
+ * This function starts a new seccomp filter transaction for the given filter
+ * collection. Returns zero on success, negative values on failure.
+ *
+ */
+int db_col_transaction_start(struct db_filter_col *col)
+{
+ unsigned int iter;
+ size_t args_size;
+ struct db_filter_snap *snap;
+ struct db_filter *filter_o, *filter_s;
+ struct db_api_rule_list *rule_o, *rule_s;
+
+ /* allocate the snapshot */
+ snap = malloc(sizeof(*snap));
+ if (snap == NULL)
+ return -ENOMEM;
+ snap->filters = malloc(sizeof(struct db_filter *) * col->filter_cnt);
+ if (snap->filters == NULL) {
+ free(snap);
+ return -ENOMEM;
+ }
+ snap->filter_cnt = col->filter_cnt;
+ for (iter = 0; iter < snap->filter_cnt; iter++)
+ snap->filters[iter] = NULL;
+ snap->next = NULL;
+
+ /* create a snapshot of the current filter state */
+ for (iter = 0; iter < col->filter_cnt; iter++) {
+ /* allocate a new filter */
+ filter_o = col->filters[iter];
+ filter_s = _db_init(filter_o->arch);
+ if (filter_s == NULL)
+ goto trans_start_failure;
+ snap->filters[iter] = filter_s;
+
+ /* create a filter snapshot from existing rules */
+ rule_o = filter_o->rules;
+ if (rule_o == NULL)
+ continue;
+ do {
+ /* copy the rule */
+ rule_s = malloc(sizeof(*rule_s));
+ if (rule_s == NULL)
+ goto trans_start_failure;
+ args_size = sizeof(*rule_s->args) * rule_o->args_cnt;
+ rule_s->args = malloc(args_size);
+ if (rule_s->args == NULL) {
+ free(rule_s);
+ goto trans_start_failure;
+ }
+ rule_s->action = rule_o->action;
+ rule_s->syscall = rule_o->syscall;
+ rule_s->args_cnt = rule_o->args_cnt;
+ memcpy(rule_s->args, rule_o->args, args_size);
+ if (filter_s->rules != NULL) {
+ rule_s->prev = filter_s->rules->prev;
+ rule_s->next = filter_s->rules;
+ filter_s->rules->prev->next = rule_s;
+ filter_s->rules->prev = rule_s;
+ } else {
+ rule_s->prev = rule_s;
+ rule_s->next = rule_s;
+ filter_s->rules = rule_s;
+ }
+
+ /* insert the rule into the filter */
+ if (db_rule_add(filter_s, rule_o) != 0)
+ goto trans_start_failure;
+
+ /* next rule */
+ rule_o = rule_o->next;
+ } while (rule_o != filter_o->rules);
+ }
+
+ /* add the snapshot to the list */
+ snap->next = col->snapshots;
+ col->snapshots = snap;
+
+ return 0;
+
+trans_start_failure:
+ _db_snap_release(snap);
+ return -ENOMEM;
+}
+
+/**
+ * Abort the top most seccomp filter transaction
+ * @param col the filter collection
+ *
+ * This function aborts the most recent seccomp filter transaction.
+ *
+ */
+void db_col_transaction_abort(struct db_filter_col *col)
+{
+ int iter;
+ unsigned int filter_cnt;
+ struct db_filter **filters;
+ struct db_filter_snap *snap;
+
+ if (col->snapshots == NULL)
+ return;
+
+ /* replace the current filter with the last snapshot */
+ snap = col->snapshots;
+ col->snapshots = snap->next;
+ filter_cnt = col->filter_cnt;
+ filters = col->filters;
+ col->filter_cnt = snap->filter_cnt;
+ col->filters = snap->filters;
+ free(snap);
+
+ /* free the filter we swapped out */
+ for (iter = 0; iter < filter_cnt; iter++)
+ _db_release(filters[iter]);
+ free(filters);
+}
+
+/**
+ * Commit the top most seccomp filter transaction
+ * @param col the filter collection
+ *
+ * This function commits the most recent seccomp filter transaction.
+ *
+ */
+void db_col_transaction_commit(struct db_filter_col *col)
+{
+ struct db_filter_snap *snap;
+
+ snap = col->snapshots;
+ col->snapshots = snap->next;
+ _db_snap_release(snap);
+}
projects / linux-seccomp.git / blobdiff