1b2441318SGreg Kroah-Hartman// SPDX-License-Identifier: GPL-2.0
28ac270d1SWill Drewry/*
38ac270d1SWill Drewry * Naive system call dropper built on seccomp_filter.
48ac270d1SWill Drewry *
58ac270d1SWill Drewry * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
68ac270d1SWill Drewry * Author: Will Drewry <wad@chromium.org>
78ac270d1SWill Drewry *
88ac270d1SWill Drewry * The code may be used by anyone for any purpose,
98ac270d1SWill Drewry * and can serve as a starting point for developing
108ac270d1SWill Drewry * applications using prctl(PR_SET_SECCOMP, 2, ...).
118ac270d1SWill Drewry *
128ac270d1SWill Drewry * When run, returns the specified errno for the specified
138ac270d1SWill Drewry * system call number against the given architecture.
148ac270d1SWill Drewry *
158ac270d1SWill Drewry */
168ac270d1SWill Drewry
178ac270d1SWill Drewry#include <errno.h>
188ac270d1SWill Drewry#include <linux/audit.h>
198ac270d1SWill Drewry#include <linux/filter.h>
208ac270d1SWill Drewry#include <linux/seccomp.h>
218ac270d1SWill Drewry#include <linux/unistd.h>
228ac270d1SWill Drewry#include <stdio.h>
238ac270d1SWill Drewry#include <stddef.h>
248ac270d1SWill Drewry#include <stdlib.h>
258ac270d1SWill Drewry#include <sys/prctl.h>
268ac270d1SWill Drewry#include <unistd.h>
278ac270d1SWill Drewry
288ac270d1SWill Drewrystatic int install_filter(int nr, int arch, int error)
298ac270d1SWill Drewry{
308ac270d1SWill Drewry	struct sock_filter filter[] = {
318ac270d1SWill Drewry		BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
328ac270d1SWill Drewry			 (offsetof(struct seccomp_data, arch))),
338ac270d1SWill Drewry		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, arch, 0, 3),
348ac270d1SWill Drewry		BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
358ac270d1SWill Drewry			 (offsetof(struct seccomp_data, nr))),
368ac270d1SWill Drewry		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, nr, 0, 1),
378ac270d1SWill Drewry		BPF_STMT(BPF_RET+BPF_K,
388ac270d1SWill Drewry			 SECCOMP_RET_ERRNO|(error & SECCOMP_RET_DATA)),
398ac270d1SWill Drewry		BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
408ac270d1SWill Drewry	};
418ac270d1SWill Drewry	struct sock_fprog prog = {
428ac270d1SWill Drewry		.len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
438ac270d1SWill Drewry		.filter = filter,
448ac270d1SWill Drewry	};
451ff12050SRicky Zhou	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
461ff12050SRicky Zhou		perror("prctl(NO_NEW_PRIVS)");
471ff12050SRicky Zhou		return 1;
481ff12050SRicky Zhou	}
498ac270d1SWill Drewry	if (prctl(PR_SET_SECCOMP, 2, &prog)) {
501ff12050SRicky Zhou		perror("prctl(PR_SET_SECCOMP)");
518ac270d1SWill Drewry		return 1;
528ac270d1SWill Drewry	}
538ac270d1SWill Drewry	return 0;
548ac270d1SWill Drewry}
558ac270d1SWill Drewry
568ac270d1SWill Drewryint main(int argc, char **argv)
578ac270d1SWill Drewry{
588ac270d1SWill Drewry	if (argc < 5) {
598ac270d1SWill Drewry		fprintf(stderr, "Usage:\n"
608ac270d1SWill Drewry			"dropper <syscall_nr> <arch> <errno> <prog> [<args>]\n"
618ac270d1SWill Drewry			"Hint:	AUDIT_ARCH_I386: 0x%X\n"
628ac270d1SWill Drewry			"	AUDIT_ARCH_X86_64: 0x%X\n"
638ac270d1SWill Drewry			"\n", AUDIT_ARCH_I386, AUDIT_ARCH_X86_64);
648ac270d1SWill Drewry		return 1;
658ac270d1SWill Drewry	}
668ac270d1SWill Drewry	if (install_filter(strtol(argv[1], NULL, 0), strtol(argv[2], NULL, 0),
678ac270d1SWill Drewry			   strtol(argv[3], NULL, 0)))
688ac270d1SWill Drewry		return 1;
698ac270d1SWill Drewry	execv(argv[4], &argv[4]);
708ac270d1SWill Drewry	printf("Failed to execv\n");
718ac270d1SWill Drewry	return 255;
728ac270d1SWill Drewry}
73