Skip to content

Commit 369be6b

Browse files
Alexandra Iordachealxiord
Alexandra Iordache
authored and
alxiord
committed
seccomp: tighten filters
Blacklist several more syscalls that aren't called by customer code. Fixes #747 Signed-off-by: Alexandra Iordache <[email protected]>
1 parent 4183e03 commit 369be6b

File tree

1 file changed

+52
-173
lines changed

1 file changed

+52
-173
lines changed

‎vmm/src/default_syscalls.rs

Lines changed: 52 additions & 173 deletions
Original file line numberDiff line numberDiff line change
@@ -9,47 +9,27 @@ use seccomp::{
99

1010
/// List of allowed syscalls, necessary for Firecracker to function correctly.
1111
pub const ALLOWED_SYSCALLS: &[i64] = &[
12-
libc::SYS_read,
13-
libc::SYS_write,
14-
libc::SYS_open,
1512
libc::SYS_close,
16-
libc::SYS_stat,
13+
libc::SYS_dup,
14+
libc::SYS_epoll_ctl,
15+
libc::SYS_epoll_pwait,
16+
libc::SYS_exit,
17+
libc::SYS_exit_group,
1718
libc::SYS_fstat,
19+
libc::SYS_futex,
20+
libc::SYS_ioctl,
1821
libc::SYS_lseek,
1922
libc::SYS_mmap,
20-
libc::SYS_mprotect,
2123
libc::SYS_munmap,
22-
libc::SYS_brk,
23-
libc::SYS_rt_sigaction,
24-
libc::SYS_rt_sigprocmask,
25-
libc::SYS_rt_sigreturn,
26-
libc::SYS_ioctl,
24+
libc::SYS_open,
25+
libc::SYS_pipe,
26+
libc::SYS_read,
2727
libc::SYS_readv,
28+
libc::SYS_rt_sigreturn,
29+
libc::SYS_stat,
30+
libc::SYS_timerfd_settime,
31+
libc::SYS_write,
2832
libc::SYS_writev,
29-
libc::SYS_pipe,
30-
libc::SYS_dup,
31-
libc::SYS_socket,
32-
libc::SYS_accept,
33-
libc::SYS_bind,
34-
libc::SYS_listen,
35-
libc::SYS_clone,
36-
libc::SYS_execve,
37-
libc::SYS_exit,
38-
libc::SYS_fcntl,
39-
libc::SYS_readlink,
40-
libc::SYS_sigaltstack,
41-
libc::SYS_prctl,
42-
libc::SYS_arch_prctl,
43-
libc::SYS_futex,
44-
libc::SYS_sched_getaffinity,
45-
libc::SYS_set_tid_address,
46-
libc::SYS_exit_group,
47-
libc::SYS_epoll_ctl,
48-
libc::SYS_epoll_pwait,
49-
libc::SYS_timerfd_create,
50-
libc::SYS_eventfd2,
51-
libc::SYS_epoll_create1,
52-
libc::SYS_getrandom,
5333
];
5434

5535
// See /usr/include/x86_64-linux-gnu/sys/epoll.h
@@ -61,10 +41,6 @@ const O_RDONLY: u64 = 0x00000000;
6141
const O_RDWR: u64 = 0x00000002;
6242
const O_NONBLOCK: u64 = 0x00004000;
6343
const O_CLOEXEC: u64 = 0x02000000;
64-
const F_GETFD: u64 = 1;
65-
const F_SETFD: u64 = 2;
66-
const F_SETFL: u64 = 4;
67-
const FD_CLOEXEC: u64 = 1;
6844

6945
// See /usr/include/linux/futex.h
7046
const FUTEX_WAIT: u64 = 0;
@@ -119,22 +95,11 @@ const MAP_PRIVATE: u64 = 0x02;
11995
const MAP_ANONYMOUS: u64 = 0x20;
12096
const MAP_NORESERVE: u64 = 0x4000;
12197

122-
// See /usr/include/x86_64-linux-gnu/bits/socket.h
123-
const PF_LOCAL: u64 = 1;
124-
12598
/// The default context containing the white listed syscall rules required by `Firecracker` to
12699
/// function.
127100
pub fn default_context() -> Result<SeccompFilterContext, Error> {
128101
Ok(SeccompFilterContext::new(
129102
vec![
130-
(
131-
libc::SYS_accept,
132-
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
133-
),
134-
(
135-
libc::SYS_bind,
136-
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
137-
),
138103
(
139104
libc::SYS_close,
140105
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
@@ -143,16 +108,6 @@ pub fn default_context() -> Result<SeccompFilterContext, Error> {
143108
libc::SYS_dup,
144109
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
145110
),
146-
(
147-
libc::SYS_epoll_create1,
148-
(
149-
0,
150-
vec![SeccompRule::new(
151-
vec![SeccompCondition::new(0, SeccompCmpOp::Eq, 0)?],
152-
SeccompAction::Allow,
153-
)],
154-
),
155-
),
156111
(
157112
libc::SYS_epoll_ctl,
158113
(
@@ -174,47 +129,12 @@ pub fn default_context() -> Result<SeccompFilterContext, Error> {
174129
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
175130
),
176131
(
177-
libc::SYS_eventfd2,
178-
(
179-
0,
180-
vec![SeccompRule::new(
181-
vec![
182-
SeccompCondition::new(0, SeccompCmpOp::Eq, 0)?,
183-
SeccompCondition::new(1, SeccompCmpOp::Eq, 0)?,
184-
],
185-
SeccompAction::Allow,
186-
)],
187-
),
132+
libc::SYS_exit,
133+
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
188134
),
189135
(
190-
libc::SYS_fcntl,
191-
(
192-
0,
193-
vec![
194-
SeccompRule::new(
195-
vec![
196-
SeccompCondition::new(1, SeccompCmpOp::Eq, F_SETFL)?,
197-
SeccompCondition::new(
198-
2,
199-
SeccompCmpOp::Eq,
200-
O_RDONLY | O_NONBLOCK | O_CLOEXEC,
201-
)?,
202-
],
203-
SeccompAction::Allow,
204-
),
205-
SeccompRule::new(
206-
vec![
207-
SeccompCondition::new(1, SeccompCmpOp::Eq, F_SETFD)?,
208-
SeccompCondition::new(2, SeccompCmpOp::Eq, FD_CLOEXEC)?,
209-
],
210-
SeccompAction::Allow,
211-
),
212-
SeccompRule::new(
213-
vec![SeccompCondition::new(1, SeccompCmpOp::Eq, F_GETFD)?],
214-
SeccompAction::Allow,
215-
),
216-
],
217-
),
136+
libc::SYS_exit_group,
137+
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
218138
),
219139
(
220140
libc::SYS_fstat,
@@ -404,10 +324,6 @@ pub fn default_context() -> Result<SeccompFilterContext, Error> {
404324
],
405325
),
406326
),
407-
(
408-
libc::SYS_listen,
409-
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
410-
),
411327
(
412328
libc::SYS_lseek,
413329
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
@@ -495,20 +411,6 @@ pub fn default_context() -> Result<SeccompFilterContext, Error> {
495411
],
496412
),
497413
),
498-
(
499-
libc::SYS_mprotect,
500-
(
501-
0,
502-
vec![SeccompRule::new(
503-
vec![SeccompCondition::new(
504-
2,
505-
SeccompCmpOp::Eq,
506-
PROT_READ | PROT_WRITE,
507-
)?],
508-
SeccompAction::Allow,
509-
)],
510-
),
511-
),
512414
(
513415
libc::SYS_munmap,
514416
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
@@ -570,23 +472,15 @@ pub fn default_context() -> Result<SeccompFilterContext, Error> {
570472
libc::SYS_read,
571473
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
572474
),
573-
(
574-
libc::SYS_readlink,
575-
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
576-
),
577475
(
578476
libc::SYS_readv,
579477
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
580478
),
479+
// SYS_rt_sigreturn is needed in case a fault does occur, so that the signal handler
480+
// can return. Otherwise we get stuck in a fault loop.
581481
(
582-
libc::SYS_socket,
583-
(
584-
0,
585-
vec![SeccompRule::new(
586-
vec![SeccompCondition::new(0, SeccompCmpOp::Eq, PF_LOCAL)?],
587-
SeccompAction::Allow,
588-
)],
589-
),
482+
libc::SYS_rt_sigreturn,
483+
(0, vec![SeccompRule::new(vec![], SeccompAction::Allow)]),
590484
),
591485
(
592486
libc::SYS_stat,
@@ -616,60 +510,45 @@ mod tests {
616510
extern crate libc;
617511
extern crate seccomp;
618512

513+
use super::*;
514+
619515
#[test]
620516
#[cfg(target_env = "musl")]
621517
fn test_basic_seccomp() {
622-
assert!(
623-
seccomp::setup_seccomp(seccomp::SeccompLevel::Basic(super::ALLOWED_SYSCALLS)).is_ok()
624-
);
518+
let mut rules = ALLOWED_SYSCALLS.to_vec();
519+
rules.extend(vec![
520+
libc::SYS_clone,
521+
libc::SYS_mprotect,
522+
libc::SYS_rt_sigprocmask,
523+
libc::SYS_set_tid_address,
524+
libc::SYS_sigaltstack,
525+
]);
526+
assert!(seccomp::setup_seccomp(seccomp::SeccompLevel::Basic(&rules)).is_ok());
625527
}
626528

627529
#[test]
628530
#[cfg(target_env = "musl")]
629531
fn test_advanced_seccomp() {
630532
// Sets up context with additional rules required by the test.
631-
let mut context = super::default_context().unwrap();
632-
assert!(context
633-
.add_rules(
634-
libc::SYS_exit,
635-
None,
636-
vec![seccomp::SeccompRule::new(
637-
vec![],
638-
seccomp::SeccompAction::Allow,
639-
)],
640-
)
641-
.is_ok());
642-
assert!(context
643-
.add_rules(
644-
libc::SYS_rt_sigprocmask,
645-
None,
646-
vec![seccomp::SeccompRule::new(
647-
vec![],
648-
seccomp::SeccompAction::Allow,
649-
)],
650-
)
651-
.is_ok());
652-
assert!(context
653-
.add_rules(
654-
libc::SYS_set_tid_address,
655-
None,
656-
vec![seccomp::SeccompRule::new(
657-
vec![],
658-
seccomp::SeccompAction::Allow,
659-
)],
660-
)
661-
.is_ok());
662-
assert!(context
663-
.add_rules(
664-
libc::SYS_sigaltstack,
665-
None,
666-
vec![seccomp::SeccompRule::new(
667-
vec![],
668-
seccomp::SeccompAction::Allow,
669-
)],
670-
)
671-
.is_ok());
672-
533+
let mut context = default_context().unwrap();
534+
for rule in vec![
535+
libc::SYS_clone,
536+
libc::SYS_mprotect,
537+
libc::SYS_rt_sigprocmask,
538+
libc::SYS_set_tid_address,
539+
libc::SYS_sigaltstack,
540+
] {
541+
assert!(context
542+
.add_rules(
543+
rule,
544+
None,
545+
vec![seccomp::SeccompRule::new(
546+
vec![],
547+
seccomp::SeccompAction::Allow,
548+
)],
549+
)
550+
.is_ok());
551+
}
673552
assert!(seccomp::setup_seccomp(seccomp::SeccompLevel::Advanced(context)).is_ok());
674553
}
675554
}

0 commit comments

Comments
 (0)