script_core 0.1.1 → 0.2.4

data/ext/enterprise_script_service/libseccomp/src/arch-s390.c

@@ -27,16 +27,16 @@ const struct arch_def arch_def_s390 = {
 };
 
 /**
- * Convert a multiplexed pseudo socket syscall into a direct syscall
- * @param socketcall the multiplexed pseudo syscall number
+ * Convert a multiplexed pseudo syscall into a direct syscall
+ * @param syscall the multiplexed pseudo syscall number
  *
  * Return the related direct syscall number, __NR_SCMP_UNDEF is there is
  * no related syscall, or __NR_SCMP_ERROR otherwise.
  *
  */
-static int _s390_sock_demux(int socketcall)
+static int _s390_syscall_demux(int syscall)
 {
-	switch (socketcall) {
+	switch (syscall) {
 	case -101:
 		/* socket */
 		return 359;
@@ -97,6 +97,43 @@ static int _s390_sock_demux(int socketcall)
 	case -120:
 		/* sendmmsg */
 		return 345;
+	case -201:
+		/* semop - not defined */
+		return __NR_SCMP_UNDEF;
+	case -202:
+		/* semget */
+		return 393;
+	case -203:
+		/* semctl */
+		return 394;
+	case -204:
+		/* semtimedop - not defined */
+		return __NR_SCMP_UNDEF;
+	case -211:
+		/* msgsnd */
+		return 400;
+	case -212:
+		/* msgrcv */
+		return 401;
+	case -213:
+		/* msgget */
+		return 399;
+	case -214:
+		/* msgctl */
+		return 402;
+	case -221:
+		/* shmat */
+		return 397;
+	case -222:
+		/* shmdt */
+		return 398;
+	case -223:
+		/* shmget */
+		return 395;
+	case -224:
+		/* shmctl */
+		return 396;
+
 	}
 
 	return __NR_SCMP_ERROR;
@@ -110,7 +147,7 @@ static int _s390_sock_demux(int socketcall)
  * there is no related pseudo syscall, or __NR_SCMP_ERROR otherwise.
  *
  */
-static int _s390_sock_mux(int syscall)
+static int _s390_syscall_mux(int syscall)
 {
 	switch (syscall) {
 	case 337:
@@ -164,6 +201,36 @@ static int _s390_sock_mux(int syscall)
 	case 373:
 		/* shutdown */
 		return -113;
+	case 393:
+		/* semget */
+		return -202;
+	case 394:
+		/* semctl */
+		return -203;
+	case 400:
+		/* msgsnd */
+		return -211;
+	case 401:
+		/* msgrcv */
+		return -212;
+	case 399:
+		/* msgget */
+		return -213;
+	case 402:
+		/* msgctl */
+		return -214;
+	case 397:
+		/* shmat */
+		return -221;
+	case 398:
+		/* shmdt */
+		return -222;
+	case 395:
+		/* shmget */
+		return -223;
+	case 396:
+		/* shmctl */
+		return -224;
 	}
 
 	return __NR_SCMP_ERROR;
@@ -228,7 +295,7 @@ int s390_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
 
 		/* determine both the muxed and direct syscall numbers */
 		if (sys > 0) {
-			sys_a = _s390_sock_mux(sys);
+			sys_a = _s390_syscall_mux(sys);
 			if (sys_a == __NR_SCMP_ERROR) {
 				rc = __NR_SCMP_ERROR;
 				goto add_return;
@@ -236,7 +303,7 @@ int s390_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
 			sys_b = sys;
 		} else {
 			sys_a = sys;
-			sys_b = _s390_sock_demux(sys);
+			sys_b = _s390_syscall_demux(sys);
 			if (sys_b == __NR_SCMP_ERROR) {
 				rc = __NR_SCMP_ERROR;
 				goto add_return;
@@ -291,24 +358,81 @@ int s390_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
 			if (rc < 0)
 				goto add_return;
 		}
-	} else if (sys <= -200 && sys >= -224) {
-		/* multiplexed ipc syscalls */
+	} else if ((sys <= -200 && sys >= -224) || (sys >= 393 && sys <= 402)) {
+		/* (-200 to -224) : multiplexed ipc syscalls
+		   (393 to 402) : direct ipc syscalls */
+
+		/* strict check for the multiplexed socket syscalls */
 		for (iter = 0; iter < ARG_COUNT_MAX; iter++) {
 			if ((rule->args[iter].valid != 0) && (rule->strict)) {
 				rc = -EINVAL;
 				goto add_return;
 			}
 		}
-		rule->args[0].arg = 0;
-		rule->args[0].op = SCMP_CMP_EQ;
-		rule->args[0].mask = DATUM_MAX;
-		rule->args[0].datum = abs(sys) % 200;
-		rule->args[0].valid = 1;
-		rule->syscall = __s390_NR_ipc;
 
-		rc = db_rule_add(db, rule);
-		if (rc < 0)
-			goto add_return;
+		/* determine both the muxed and direct syscall numbers */
+		if (sys > 0) {
+			sys_a = _s390_syscall_mux(sys);
+			if (sys_a == __NR_SCMP_ERROR) {
+				rc = __NR_SCMP_ERROR;
+				goto add_return;
+			}
+			sys_b = sys;
+		} else {
+			sys_a = sys;
+			sys_b = _s390_syscall_demux(sys);
+			if (sys_b == __NR_SCMP_ERROR) {
+				rc = __NR_SCMP_ERROR;
+				goto add_return;
+			}
+		}
+
+		/* use rule_a for the multiplexed syscall and use rule_b for
+		 * the direct wired syscall */
+
+		if (sys_a == __NR_SCMP_UNDEF) {
+			rule_a = NULL;
+			rule_b = rule;
+		} else if (sys_b == __NR_SCMP_UNDEF) {
+			rule_a = rule;
+			rule_b = NULL;
+		} else {
+			/* need two rules, dup the first and link together */
+			rule_a = rule;
+			rule_dup = db_rule_dup(rule_a);
+			rule_b = rule_dup;
+			if (rule_b == NULL)
+				goto add_return;
+			rule_b->prev = rule_a;
+			rule_b->next = NULL;
+			rule_a->next = rule_b;
+		}
+
+		/* multiplexed socket syscalls */
+		if (rule_a != NULL) {
+			rule_a->syscall = __s390_NR_ipc;
+			rule_a->args[0].arg = 0;
+			rule_a->args[0].op = SCMP_CMP_EQ;
+			rule_a->args[0].mask = DATUM_MAX;
+			rule_a->args[0].datum = (-sys_a) % 200;
+			rule_a->args[0].valid = 1;
+		}
+
+		/* direct wired socket syscalls */
+		if (rule_b != NULL)
+			rule_b->syscall = sys_b;
+
+		/* we should be protected by a transaction checkpoint */
+		if (rule_a != NULL) {
+			rc = db_rule_add(db, rule_a);
+			if (rc < 0)
+				goto add_return;
+		}
+		if (rule_b != NULL) {
+			rc = db_rule_add(db, rule_b);
+			if (rc < 0)
+				goto add_return;
+		}
 	} else if (sys >= 0) {
 		/* normal syscall processing */
 		rc = db_rule_add(db, rule);

data/ext/enterprise_script_service/libseccomp/src/arch-s390x-syscalls.c

@@ -10,7 +10,7 @@
 #include "arch.h"
 #include "arch-s390x.h"
 
-/* NOTE: based on Linux 4.15-rc7 */
+/* NOTE: based on Linux v5.4-rc4 */
 const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "_llseek", __PNR__llseek },
 	{ "_newselect", __PNR__newselect },
@@ -42,11 +42,17 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "chown32", __PNR_chown32 },
 	{ "chroot", 61 },
 	{ "clock_adjtime", 337 },
+	{ "clock_adjtime64", __PNR_clock_adjtime64 },
 	{ "clock_getres", 261 },
+	{ "clock_getres_time64", __PNR_clock_getres_time64 },
 	{ "clock_gettime", 260 },
+	{ "clock_gettime64", __PNR_clock_gettime64 },
 	{ "clock_nanosleep", 262 },
+	{ "clock_nanosleep_time64", __PNR_clock_nanosleep_time64 },
 	{ "clock_settime", 259 },
+	{ "clock_settime64", __PNR_clock_settime64 },
 	{ "clone", 120 },
+	{ "clone3", 435 },
 	{ "close", 6 },
 	{ "connect", 362 },
 	{ "copy_file_range", 375 },
@@ -90,7 +96,11 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "flock", 143 },
 	{ "fork", 2 },
 	{ "fremovexattr", 235 },
+	{ "fsconfig", 431 },
 	{ "fsetxattr", 226 },
+	{ "fsmount", 432 },
+	{ "fsopen", 430 },
+	{ "fspick", 433 },
 	{ "fstat", 108 },
 	{ "fstat64", __PNR_fstat64 },
 	{ "fstatat64", __PNR_fstatat64 },
@@ -101,6 +111,7 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "ftruncate", 93 },
 	{ "ftruncate64", __PNR_ftruncate64 },
 	{ "futex", 238 },
+	{ "futex_time64", __PNR_futex_time64 },
 	{ "futimesat", 292 },
 	{ "get_kernel_syms", 130 },
 	{ "get_mempolicy", 269 },
@@ -153,8 +164,12 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "io_destroy", 244 },
 	{ "io_getevents", 245 },
 	{ "io_pgetevents", 382 },
+	{ "io_pgetevents_time64", __PNR_io_pgetevents_time64 },
 	{ "io_setup", 243 },
 	{ "io_submit", 246 },
+	{ "io_uring_setup", 425 },
+	{ "io_uring_enter", 426 },
+	{ "io_uring_register", 427 },
 	{ "ioctl", 54 },
 	{ "ioperm", __PNR_ioperm},
 	{ "iopl", __PNR_iopl },
@@ -198,6 +213,7 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "mmap2", __PNR_mmap2 },
 	{ "modify_ldt", __PNR_modify_ldt },
 	{ "mount", 21 },
+	{ "move_mount", 429 },
 	{ "move_pages", 310 },
 	{ "mprotect", 125 },
 	{ "mpx", __PNR_mpx },
@@ -205,13 +221,15 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "mq_notify", 275 },
 	{ "mq_open", 271 },
 	{ "mq_timedreceive", 274 },
+	{ "mq_timedreceive_time64", __PNR_mq_timedreceive_time64 },
 	{ "mq_timedsend", 273 },
+	{ "mq_timedsend_time64", __PNR_mq_timedsend_time64 },
 	{ "mq_unlink", 272 },
 	{ "mremap", 163 },
-	{ "msgctl", __PNR_msgctl },
-	{ "msgget", __PNR_msgget },
-	{ "msgrcv", __PNR_msgrcv },
-	{ "msgsnd", __PNR_msgsnd },
+	{ "msgctl", 402 },
+	{ "msgget", 399 },
+	{ "msgrcv", 401 },
+	{ "msgsnd", 400 },
 	{ "msync", 144 },
 	{ "multiplexer", __PNR_multiplexer },
 	{ "munlock", 151 },
@@ -230,6 +248,7 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "oldwait4", __PNR_oldwait4 },
 	{ "open", 5 },
 	{ "open_by_handle_at", 336 },
+	{ "open_tree", 428 },
 	{ "openat", 288 },
 	{ "pause", 29 },
 	{ "pciconfig_iobase", __PNR_pciconfig_iobase },
@@ -237,14 +256,17 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "pciconfig_write", __PNR_pciconfig_write },
 	{ "perf_event_open", 331 },
 	{ "personality", 136 },
+	{ "pidfd_open", 434 },
+	{ "pidfd_send_signal", 424 },
 	{ "pipe", 42 },
 	{ "pipe2", 325 },
 	{ "pivot_root", 217 },
-	{ "pkey_alloc", __PNR_pkey_alloc },
-	{ "pkey_free", __PNR_pkey_free },
-	{ "pkey_mprotect", __PNR_pkey_mprotect },
+	{ "pkey_alloc", 385 },
+	{ "pkey_free", 386 },
+	{ "pkey_mprotect", 384 },
 	{ "poll", 168 },
 	{ "ppoll", 302 },
+	{ "ppoll_time64", __PNR_ppoll_time64 },
 	{ "prctl", 172 },
 	{ "pread64", 180 },
 	{ "preadv", 328 },
@@ -255,6 +277,7 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "prof", __PNR_prof },
 	{ "profil", __PNR_profil },
 	{ "pselect6", 301 },
+	{ "pselect6_time64", __PNR_pselect6_time64 },
 	{ "ptrace", 26 },
 	{ "putpmsg", 189 },
 	{ "pwrite64", 181 },
@@ -272,6 +295,7 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "recv", __PNR_recv },
 	{ "recvfrom", 371 },
 	{ "recvmmsg", 357 },
+	{ "recvmmsg_time64", __PNR_recvmmsg_time64 },
 	{ "recvmsg", 372 },
 	{ "remap_file_pages", 267 },
 	{ "removexattr", 233 },
@@ -289,6 +313,7 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "rt_sigreturn", 173 },
 	{ "rt_sigsuspend", 179 },
 	{ "rt_sigtimedwait", 177 },
+	{ "rt_sigtimedwait_time64", __PNR_rt_sigtimedwait_time64 },
 	{ "rt_tgsigqueueinfo", 330 },
 	{ "rtas", __PNR_rtas },
 	{ "s390_guarded_storage", 378 },
@@ -303,6 +328,7 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "sched_getparam", 155 },
 	{ "sched_getscheduler", 157 },
 	{ "sched_rr_get_interval", 161 },
+	{ "sched_rr_get_interval_time64", __PNR_sched_rr_get_interval_time64 },
 	{ "sched_setaffinity", 239 },
 	{ "sched_setattr", 345 },
 	{ "sched_setparam", 154 },
@@ -311,10 +337,11 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "seccomp", 348 },
 	{ "security", __PNR_security },
 	{ "select", 142 },
-	{ "semctl", __PNR_semctl },
-	{ "semget", __PNR_semget },
+	{ "semctl", 394 },
+	{ "semget", 393 },
 	{ "semop", __PNR_semop },
-	{ "semtimedop", __PNR_semtimedop },
+	{ "semtimedop", 392 },
+	{ "semtimedop_time64", __PNR_semtimedop_time64 },
 	{ "send", __PNR_send },
 	{ "sendfile", 187 },
 	{ "sendfile64", __PNR_sendfile64 },
@@ -356,10 +383,10 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "setuid32", __PNR_setuid32 },
 	{ "setxattr", 224 },
 	{ "sgetmask", __PNR_sgetmask },
-	{ "shmat", __PNR_shmat },
-	{ "shmctl", __PNR_shmctl },
-	{ "shmdt", __PNR_shmdt },
-	{ "shmget", __PNR_shmget },
+	{ "shmat", 397 },
+	{ "shmctl", 396 },
+	{ "shmdt", 398 },
+	{ "shmget", 395 },
 	{ "shutdown", 373 },
 	{ "sigaction", 67 },
 	{ "sigaltstack", 186 },
@@ -408,11 +435,15 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "timer_delete", 258 },
 	{ "timer_getoverrun", 257 },
 	{ "timer_gettime", 256 },
+	{ "timer_gettime64", __PNR_timer_gettime64 },
 	{ "timer_settime", 255 },
+	{ "timer_settime64", __PNR_timer_settime64 },
 	{ "timerfd", 317 },
 	{ "timerfd_create", 319 },
 	{ "timerfd_gettime", 321 },
+	{ "timerfd_gettime64", __PNR_timerfd_gettime64 },
 	{ "timerfd_settime", 320 },
+	{ "timerfd_settime64", __PNR_timerfd_settime64 },
 	{ "times", 43 },
 	{ "tkill", 237 },
 	{ "truncate", 92 },
@@ -434,6 +465,7 @@ const struct arch_syscall_def s390x_syscall_table[] = { \
 	{ "ustat", 62 },
 	{ "utime", 30 },
 	{ "utimensat", 315 },
+	{ "utimensat_time64", __PNR_utimensat_time64 },
 	{ "utimes", 313 },
 	{ "vfork", 190 },
 	{ "vhangup", 111 },

data/ext/enterprise_script_service/libseccomp/src/arch-s390x.c

@@ -28,15 +28,15 @@ const struct arch_def arch_def_s390x = {
 
 /**
  * Convert a multiplexed pseudo socket syscall into a direct syscall
- * @param socketcall the multiplexed pseudo syscall number
+ * @param syscall the multiplexed pseudo syscall number
  *
  * Return the related direct syscall number, __NR_SCMP_UNDEF is there is
  * no related syscall, or __NR_SCMP_ERROR otherwise.
  *
  */
-static int _s390x_sock_demux(int socketcall)
+static int _s390x_syscall_demux(int syscall)
 {
-	switch (socketcall) {
+	switch (syscall) {
 	case -101:
 		/* socket */
 		return 359;
@@ -97,6 +97,42 @@ static int _s390x_sock_demux(int socketcall)
 	case -120:
 		/* sendmmsg */
 		return 345;
+	case -201:
+		/* semop - not defined */
+		return __NR_SCMP_UNDEF;
+	case -202:
+		/* semget */
+		return 393;
+	case -203:
+		/* semctl */
+		return 394;
+	case -204:
+		/* semtimedop */
+		return 392;
+	case -211:
+		/* msgsnd */
+		return 400;
+	case -212:
+		/* msgrcv */
+		return 401;
+	case -213:
+		/* msgget */
+		return 399;
+	case -214:
+		/* msgctl */
+		return 402;
+	case -221:
+		/* shmat */
+		return 397;
+	case -222:
+		/* shmdt */
+		return 398;
+	case -223:
+		/* shmget */
+		return 395;
+	case -224:
+		/* shmctl */
+		return 396;
 	}
 
 	return __NR_SCMP_ERROR;
@@ -110,7 +146,7 @@ static int _s390x_sock_demux(int socketcall)
  * there is no related pseudo syscall, or __NR_SCMP_ERROR otherwise.
  *
  */
-static int _s390x_sock_mux(int syscall)
+static int _s390x_syscall_mux(int syscall)
 {
 	switch (syscall) {
 	case 337:
@@ -164,6 +200,39 @@ static int _s390x_sock_mux(int syscall)
 	case 373:
 		/* shutdown */
 		return -113;
+	case 392:
+		/* semtimedop */
+		return -204;
+	case 393:
+		/* semget */
+		return -202;
+	case 394:
+		/* semctl */
+		return -203;
+	case 400:
+		/* msgsnd */
+		return -211;
+	case 401:
+		/* msgrcv */
+		return -212;
+	case 399:
+		/* msgget */
+		return -213;
+	case 402:
+		/* msgctl */
+		return -214;
+	case 397:
+		/* shmat */
+		return -221;
+	case 398:
+		/* shmdt */
+		return -222;
+	case 395:
+		/* shmget */
+		return -223;
+	case 396:
+		/* shmctl */
+		return -224;
 	}
 
 	return __NR_SCMP_ERROR;
@@ -228,7 +297,7 @@ int s390x_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
 
 		/* determine both the muxed and direct syscall numbers */
 		if (sys > 0) {
-			sys_a = _s390x_sock_mux(sys);
+			sys_a = _s390x_syscall_mux(sys);
 			if (sys_a == __NR_SCMP_ERROR) {
 				rc = __NR_SCMP_ERROR;
 				goto add_return;
@@ -236,7 +305,7 @@ int s390x_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
 			sys_b = sys;
 		} else {
 			sys_a = sys;
-			sys_b = _s390x_sock_demux(sys);
+			sys_b = _s390x_syscall_demux(sys);
 			if (sys_b == __NR_SCMP_ERROR) {
 				rc = __NR_SCMP_ERROR;
 				goto add_return;
@@ -291,24 +360,81 @@ int s390x_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
 			if (rc < 0)
 				goto add_return;
 		}
-	} else if (sys <= -200 && sys >= -224) {
-		/* multiplexed ipc syscalls */
+	} else if ((sys <= -200 && sys >= -224) || (sys >= 392 && sys <= 402)) {
+		/* (-200 to -224) : multiplexed ipc syscalls
+		   (392 to 402) : direct ipc syscalls */
+
+		/* strict check for the multiplexed socket syscalls */
 		for (iter = 0; iter < ARG_COUNT_MAX; iter++) {
 			if ((rule->args[iter].valid != 0) && (rule->strict)) {
 				rc = -EINVAL;
 				goto add_return;
 			}
 		}
-		rule->args[0].arg = 0;
-		rule->args[0].op = SCMP_CMP_EQ;
-		rule->args[0].mask = DATUM_MAX;
-		rule->args[0].datum = abs(sys) % 200;
-		rule->args[0].valid = 1;
-		rule->syscall = __s390x_NR_ipc;
 
-		rc = db_rule_add(db, rule);
-		if (rc < 0)
-			goto add_return;
+		/* determine both the muxed and direct syscall numbers */
+		if (sys > 0) {
+			sys_a = _s390x_syscall_mux(sys);
+			if (sys_a == __NR_SCMP_ERROR) {
+				rc = __NR_SCMP_ERROR;
+				goto add_return;
+			}
+			sys_b = sys;
+		} else {
+			sys_a = sys;
+			sys_b = _s390x_syscall_demux(sys);
+			if (sys_b == __NR_SCMP_ERROR) {
+				rc = __NR_SCMP_ERROR;
+				goto add_return;
+			}
+		}
+
+		/* use rule_a for the multiplexed syscall and use rule_b for
+		 * the direct wired syscall */
+
+		if (sys_a == __NR_SCMP_UNDEF) {
+			rule_a = NULL;
+			rule_b = rule;
+		} else if (sys_b == __NR_SCMP_UNDEF) {
+			rule_a = rule;
+			rule_b = NULL;
+		} else {
+			/* need two rules, dup the first and link together */
+			rule_a = rule;
+			rule_dup = db_rule_dup(rule_a);
+			rule_b = rule_dup;
+			if (rule_b == NULL)
+				goto add_return;
+			rule_b->prev = rule_a;
+			rule_b->next = NULL;
+			rule_a->next = rule_b;
+		}
+
+		/* multiplexed socket syscalls */
+		if (rule_a != NULL) {
+			rule_a->syscall = __s390x_NR_ipc;
+			rule_a->args[0].arg = 0;
+			rule_a->args[0].op = SCMP_CMP_EQ;
+			rule_a->args[0].mask = DATUM_MAX;
+			rule_a->args[0].datum = (-sys_a) % 200;
+			rule_a->args[0].valid = 1;
+		}
+
+		/* direct wired socket syscalls */
+		if (rule_b != NULL)
+			rule_b->syscall = sys_b;
+
+		/* we should be protected by a transaction checkpoint */
+		if (rule_a != NULL) {
+			rc = db_rule_add(db, rule_a);
+			if (rc < 0)
+				goto add_return;
+		}
+		if (rule_b != NULL) {
+			rc = db_rule_add(db, rule_b);
+			if (rc < 0)
+				goto add_return;
+		}
 	} else if (sys >= 0) {
 		/* normal syscall processing */
 		rc = db_rule_add(db, rule);