|
| 1 | +//go:build linux && amd64 && !openbsd && !unsafe |
| 2 | + |
| 3 | +package security |
| 4 | + |
| 5 | +import ( |
| 6 | + seccomp "github.com/seccomp/libseccomp-golang" |
| 7 | +) |
| 8 | + |
| 9 | +// IsHardened reports whether security sandbox is enabled. |
| 10 | +const IsHardened = true |
| 11 | + |
| 12 | +// Sandbox restrict application access to necessary system calls needed by |
| 13 | +// network connections and standard i/o. |
| 14 | +func Sandbox() error { |
| 15 | + // How to create minimal whitelist: |
| 16 | + // 1. Create empty list of allowed syscalls |
| 17 | + // 2. Set `seccomp.ActLog` as default filter action |
| 18 | + // 3. Compile and run program |
| 19 | + // 4. Use `dmesg` to find logged syscalls (started with _audit_) |
| 20 | + // 5. Translate syscalls numbers to names and add them to allowed list |
| 21 | + // 6. Go to point 3 and repeat until no new audit logs |
| 22 | + // 7. Reset default filter action to `seccomp.ActKillProcess` |
| 23 | + allowedSyscalls := []string{ |
| 24 | + // similar to stdio pledge |
| 25 | + "clone3", "close", "epoll_create1", "epoll_ctl", "epoll_pwait", |
| 26 | + "exit_group", "fcntl", "fstat", "futex", "getpid", "getrandom", |
| 27 | + "getsockopt", "gettid", "mmap", "mprotect", "munmap", "nanosleep", |
| 28 | + "pipe2", "read", "rseq", "rt_sigprocmask", "rt_sigreturn", |
| 29 | + "sched_getaffinity", "sched_yield", "set_robust_list", "setsockopt", |
| 30 | + "sigaltstack", "tgkill", "uname", "write", |
| 31 | + |
| 32 | + // similar to inet pledge |
| 33 | + "connect", "getpeername", "getsockname", "socket", |
| 34 | + |
| 35 | + // similar to rpath pledge |
| 36 | + "getdents64", "newfstatat", "openat", "readlinkat", |
| 37 | + } |
| 38 | + |
| 39 | + // By default goroutines don't play well with seccomp. Program will hang |
| 40 | + // when underlying thread is terminated silently. We need to kill process - |
| 41 | + // see: https://github.com/golang/go/issues/3405#issuecomment-750816828 |
| 42 | + whitelist, err := seccomp.NewFilter(seccomp.ActKillProcess) |
| 43 | + if err != nil { |
| 44 | + return err |
| 45 | + } |
| 46 | + |
| 47 | + for _, callName := range allowedSyscalls { |
| 48 | + callId, err := seccomp.GetSyscallFromName(callName) |
| 49 | + if err != nil { |
| 50 | + return err |
| 51 | + } |
| 52 | + |
| 53 | + whitelist.AddRule(callId, seccomp.ActAllow) |
| 54 | + } |
| 55 | + whitelist.Load() |
| 56 | + |
| 57 | + return nil |
| 58 | +} |
0 commit comments