script_core 0.2.3 → 0.3.0

data/ext/enterprise_script_service/libseccomp/src/syscalls.h

@@ -0,0 +1,62 @@
+/**
+ * Enhanced Seccomp x86_64 Syscall Table
+ *
+ * Copyright (c) 2012, 2020 Red Hat <pmoore@redhat.com>
+ * Author: Paul Moore <paul@paul-moore.com>
+ * gperf support: Giuseppe Scrivano <gscrivan@redhat.com>
+ */
+
+#ifndef _SYSCALLS_H
+#define _SYSCALLS_H
+
+#include <stddef.h>
+
+#include "arch-aarch64.h"
+#include "arch-arm.h"
+#include "arch.h"
+#include "arch-mips64.h"
+#include "arch-mips64n32.h"
+#include "arch-mips.h"
+#include "arch-parisc.h"
+#include "arch-ppc64.h"
+#include "arch-ppc.h"
+#include "arch-s390.h"
+#include "arch-s390x.h"
+#include "arch-x32.h"
+#include "arch-x86_64.h"
+#include "arch-x86.h"
+#include "arch-x86.h"
+#include "arch-riscv64.h"
+
+/* NOTE: changes to the arch_syscall_table layout may require changes to the
+ *       generate_syscalls_perf.sh and arch-syscall-validate scripts */
+struct arch_syscall_table {
+	int name;
+	int index;
+
+	/* each arch listed here must be defined in syscalls.c  */
+	/* NOTE: see the warning above - BEWARE! */
+	int x86;
+	int x86_64;
+	int x32;
+	int arm;
+	int aarch64;
+	int mips;
+	int mips64;
+	int mips64n32;
+	int parisc;
+	int parisc64;
+	int ppc;
+	int ppc64;
+	int riscv64;
+	int s390;
+	int s390x;
+};
+#define OFFSET_ARCH(NAME) offsetof(struct arch_syscall_table, NAME)
+
+/* defined in syscalls.perf.template  */
+int syscall_resolve_name(const char *name, int offset);
+const char *syscall_resolve_num(int num, int offset);
+const struct arch_syscall_def *syscall_iterate(unsigned int spot, int offset);
+
+#endif

data/ext/enterprise_script_service/libseccomp/src/syscalls.perf.template

@@ -0,0 +1,82 @@
+%{
+/**
+ * Copyright (c) 2012 Red Hat <pmoore@redhat.com>
+ * Copyright (c) 2020 Red Hat <gscrivan@redhat.com>
+ * Authors: Paul Moore <paul@paul-moore.com>
+ *          Giuseppe Scrivano <gscrivan@redhat.com>
+ */
+
+/*
+ * This library is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; if not, see <http://www.gnu.org/licenses>.
+ */
+
+#include <seccomp.h>
+#include <string.h>
+#include "syscalls.h"
+
+%}
+struct arch_syscall_table;
+
+%%
+@@SYSCALLS_TABLE@@
+%%
+
+static int syscall_get_offset_value(const struct arch_syscall_table *s,
+				    int offset)
+{
+	return *(int *)((char *)s + offset);
+}
+
+int syscall_resolve_name(const char *name, int offset)
+{
+	const struct arch_syscall_table *s;
+
+	s = in_word_set(name, strlen(name));
+	if (s == NULL)
+		return __NR_SCMP_ERROR;
+
+	return syscall_get_offset_value(s, offset);
+}
+
+const char *syscall_resolve_num(int num, int offset)
+{
+	unsigned int iter;
+
+	for (iter = 0; iter < sizeof(wordlist)/sizeof(wordlist[0]); iter++) {
+		if (syscall_get_offset_value(&wordlist[iter], offset) == num)
+			return (stringpool + wordlist[iter].name);
+	}
+
+	return NULL;
+}
+
+const struct arch_syscall_def *syscall_iterate(unsigned int spot, int offset)
+{
+	unsigned int iter;
+        /* this is thread-unsafe, only use for testing */
+	static struct arch_syscall_def arch_def;
+
+	arch_def.name = NULL;
+	arch_def.num = __NR_SCMP_ERROR;
+
+	for (iter = 0; iter < sizeof(wordlist)/sizeof(wordlist[0]); iter++) {
+		if (wordlist[iter].index == spot) {
+			arch_def.name = stringpool + wordlist[iter].name;
+			arch_def.num = syscall_get_offset_value(&wordlist[iter],
+								offset);
+			return &arch_def;
+		}
+	}
+
+	return &arch_def;
+}

data/ext/enterprise_script_service/libseccomp/src/system.c

@@ -26,17 +26,19 @@
 #define _GNU_SOURCE
 #include <unistd.h>
 
+#include "system.h"
+
 #include <seccomp.h>
 
 #include "arch.h"
 #include "db.h"
 #include "gen_bpf.h"
-#include "system.h"
+#include "helper.h"
 
-/* NOTE: the seccomp syscall whitelist is currently disabled for testing
+/* NOTE: the seccomp syscall allowlist is currently disabled for testing
  *       purposes, but unless we can verify all of the supported ABIs before
- *       our next release we may have to enable the whitelist */
-#define SYSCALL_WHITELIST_ENABLE	0
+ *       our next release we may have to enable the allowlist */
+#define SYSCALL_ALLOWLIST_ENABLE	0
 
 static int _nr_seccomp = -1;
 static int _support_seccomp_syscall = -1;
@@ -44,6 +46,10 @@ static int _support_seccomp_flag_tsync = -1;
 static int _support_seccomp_flag_log = -1;
 static int _support_seccomp_action_log = -1;
 static int _support_seccomp_kill_process = -1;
+static int _support_seccomp_flag_spec_allow = -1;
+static int _support_seccomp_flag_new_listener = -1;
+static int _support_seccomp_user_notif = -1;
+static int _support_seccomp_flag_tsync_esrch = -1;
 
 /**
  * Check to see if the seccomp() syscall is supported
@@ -65,8 +71,8 @@ int sys_chk_seccomp_syscall(void)
 	if (_support_seccomp_syscall >= 0)
 		return _support_seccomp_syscall;
 
-#if SYSCALL_WHITELIST_ENABLE
-	/* architecture whitelist */
+#if SYSCALL_ALLOWLIST_ENABLE
+	/* architecture allowlist */
 	switch (arch_def_native->token) {
 	case SCMP_ARCH_X86_64:
 	case SCMP_ARCH_ARM:
@@ -75,6 +81,7 @@ int sys_chk_seccomp_syscall(void)
 	case SCMP_ARCH_PPC64LE:
 	case SCMP_ARCH_S390:
 	case SCMP_ARCH_S390X:
+	case SCMP_ARCH_RISCV64:
 		break;
 	default:
 		goto unsupported;
@@ -87,7 +94,7 @@ int sys_chk_seccomp_syscall(void)
 
 	/* this is an invalid call because the second argument is non-zero, but
 	 * depending on the errno value of ENOSYS or EINVAL we can guess if the
-	 * seccomp() syscal is supported or not */
+	 * seccomp() syscall is supported or not */
 	rc = syscall(nr_seccomp, SECCOMP_SET_MODE_STRICT, 1, NULL);
 	if (rc < 0 && errno == EINVAL)
 		goto supported;
@@ -157,6 +164,18 @@ int sys_chk_seccomp_action(uint32_t action)
 		return _support_seccomp_action_log;
 	} else if (action == SCMP_ACT_ALLOW) {
 		return 1;
+	} else if (action == SCMP_ACT_NOTIFY) {
+		if (_support_seccomp_user_notif < 0) {
+			struct seccomp_notif_sizes sizes;
+			if (sys_chk_seccomp_syscall() == 1 &&
+			    syscall(_nr_seccomp, SECCOMP_GET_NOTIF_SIZES, 0,
+				    &sizes) == 0)
+				_support_seccomp_user_notif = 1;
+			else
+				_support_seccomp_user_notif = 0;
+		}
+
+		return _support_seccomp_user_notif;
 	}
 
 	return 0;
@@ -172,10 +191,17 @@ int sys_chk_seccomp_action(uint32_t action)
  */
 void sys_set_seccomp_action(uint32_t action, bool enable)
 {
-	if (action == SCMP_ACT_LOG)
+	switch (action) {
+	case SCMP_ACT_LOG:
 		_support_seccomp_action_log = (enable ? 1 : 0);
-	else if (action == SCMP_ACT_KILL_PROCESS)
+		break;
+	case SCMP_ACT_KILL_PROCESS:
 		_support_seccomp_kill_process = (enable ? 1 : 0);
+		break;
+	case SCMP_ACT_NOTIFY:
+		_support_seccomp_user_notif = (enable ? 1 : 0);
+		break;
+	}
 }
 
 /**
@@ -221,6 +247,20 @@ int sys_chk_seccomp_flag(int flag)
 			_support_seccomp_flag_log = _sys_chk_seccomp_flag_kernel(flag);
 
 		return _support_seccomp_flag_log;
+	case SECCOMP_FILTER_FLAG_SPEC_ALLOW:
+		if (_support_seccomp_flag_spec_allow < 0)
+			_support_seccomp_flag_spec_allow = _sys_chk_seccomp_flag_kernel(flag);
+
+		return _support_seccomp_flag_spec_allow;
+	case SECCOMP_FILTER_FLAG_NEW_LISTENER:
+		if (_support_seccomp_flag_new_listener < 0)
+			_support_seccomp_flag_new_listener = _sys_chk_seccomp_flag_kernel(flag);
+
+		return _support_seccomp_flag_new_listener;
+	case SECCOMP_FILTER_FLAG_TSYNC_ESRCH:
+		if (_support_seccomp_flag_tsync_esrch < 0)
+			_support_seccomp_flag_tsync_esrch = _sys_chk_seccomp_flag_kernel(flag);
+		return _support_seccomp_flag_tsync_esrch;
 	}
 
 	return -EOPNOTSUPP;
@@ -244,12 +284,22 @@ void sys_set_seccomp_flag(int flag, bool enable)
 	case SECCOMP_FILTER_FLAG_LOG:
 		_support_seccomp_flag_log = (enable ? 1 : 0);
 		break;
+	case SECCOMP_FILTER_FLAG_SPEC_ALLOW:
+		_support_seccomp_flag_spec_allow = (enable ? 1 : 0);
+		break;
+	case SECCOMP_FILTER_FLAG_NEW_LISTENER:
+		_support_seccomp_flag_new_listener = (enable ? 1 : 0);
+		break;
+	case SECCOMP_FILTER_FLAG_TSYNC_ESRCH:
+		_support_seccomp_flag_tsync_esrch = (enable ? 1 : 0);
+		break;
 	}
 }
 
 /**
  * Loads the filter into the kernel
  * @param col the filter collection
+ * @param rawrc pass the raw return code if true
  *
  * This function loads the given seccomp filter context into the kernel.  If
  * the filter was loaded correctly, the kernel will be enforcing the filter
@@ -257,14 +307,15 @@ void sys_set_seccomp_flag(int flag, bool enable)
  * error.
  *
  */
-int sys_filter_load(const struct db_filter_col *col)
+int sys_filter_load(struct db_filter_col *col, bool rawrc)
 {
 	int rc;
+	bool tsync_notify;
 	struct bpf_program *prgm = NULL;
 
-	prgm = gen_bpf_generate(col);
-	if (prgm == NULL)
-		return -ENOMEM;
+	rc = gen_bpf_generate(col, &prgm);
+	if (rc < 0)
+		return rc;
 
 	/* attempt to set NO_NEW_PRIVS */
 	if (col->attr.nnp_enable) {
@@ -273,24 +324,153 @@ int sys_filter_load(const struct db_filter_col *col)
 			goto filter_load_out;
 	}
 
+	tsync_notify = (_support_seccomp_flag_tsync_esrch > 0);
+
 	/* load the filter into the kernel */
 	if (sys_chk_seccomp_syscall() == 1) {
 		int flgs = 0;
-		if (col->attr.tsync_enable)
+		if (tsync_notify) {
+			if (col->attr.tsync_enable)
+				flgs |= SECCOMP_FILTER_FLAG_TSYNC | \
+					SECCOMP_FILTER_FLAG_TSYNC_ESRCH;
+			if (_support_seccomp_user_notif > 0)
+				flgs |= SECCOMP_FILTER_FLAG_NEW_LISTENER;
+		} else if (col->attr.tsync_enable)
 			flgs |= SECCOMP_FILTER_FLAG_TSYNC;
+		else if (_support_seccomp_user_notif > 0)
+			flgs |= SECCOMP_FILTER_FLAG_NEW_LISTENER;
 		if (col->attr.log_enable)
 			flgs |= SECCOMP_FILTER_FLAG_LOG;
+		if (col->attr.spec_allow)
+			flgs |= SECCOMP_FILTER_FLAG_SPEC_ALLOW;
 		rc = syscall(_nr_seccomp, SECCOMP_SET_MODE_FILTER, flgs, prgm);
-		if (rc > 0 && col->attr.tsync_enable)
+		if (tsync_notify && rc > 0) {
+			/* return 0 on NEW_LISTENER success, but save the fd */
+			col->notify_fd = rc;
+			rc = 0;
+		} else if (rc > 0 && col->attr.tsync_enable) {
 			/* always return -ESRCH if we fail to sync threads */
 			errno = ESRCH;
+			rc = -errno;
+		} else if (rc > 0 && _support_seccomp_user_notif > 0) {
+			/* return 0 on NEW_LISTENER success, but save the fd */
+			col->notify_fd = rc;
+			rc = 0;
+		}
 	} else
 		rc = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, prgm);
 
 filter_load_out:
 	/* cleanup and return */
 	gen_bpf_release(prgm);
+	if (rc == -ESRCH)
+		return -ESRCH;
 	if (rc < 0)
-		return -errno;
+		return (rawrc ? -errno : -ECANCELED);
+	return rc;
+}
+
+/**
+ * Allocate a pair of notification request/response structures
+ * @param req the request location
+ * @param resp the response location
+ *
+ * This function allocates a pair of request/response structure by computing
+ * the correct sized based on the currently running kernel. It returns zero on
+ * success, and negative values on failure.
+ *
+ */
+int sys_notify_alloc(struct seccomp_notif **req,
+		     struct seccomp_notif_resp **resp)
+{
+	int rc;
+	static struct seccomp_notif_sizes sizes = { 0, 0, 0 };
+
+	if (_support_seccomp_syscall <= 0)
+		return -EOPNOTSUPP;
+
+	if (sizes.seccomp_notif == 0 && sizes.seccomp_notif_resp == 0) {
+		rc = syscall(__NR_seccomp, SECCOMP_GET_NOTIF_SIZES, 0, &sizes);
+		if (rc < 0)
+			return -ECANCELED;
+	}
+	if (sizes.seccomp_notif == 0 || sizes.seccomp_notif_resp == 0)
+		return -EFAULT;
+
+	if (req) {
+		*req = zmalloc(sizes.seccomp_notif);
+		if (!*req)
+			return -ENOMEM;
+	}
+
+	if (resp) {
+		*resp = zmalloc(sizes.seccomp_notif_resp);
+		if (!*resp) {
+			if (req)
+				free(*req);
+			return -ENOMEM;
+		}
+	}
+
+	return 0;
+}
+
+/**
+ * Receive a notification from a seccomp notification fd
+ * @param fd the notification fd
+ * @param req the request buffer to save into
+ *
+ * Blocks waiting for a notification on this fd. This function is thread safe
+ * (synchronization is performed in the kernel). Returns zero on success,
+ * negative values on error.
+ *
+ */
+int sys_notify_receive(int fd, struct seccomp_notif *req)
+{
+	if (_support_seccomp_user_notif <= 0)
+		return -EOPNOTSUPP;
+
+	if (ioctl(fd, SECCOMP_IOCTL_NOTIF_RECV, req) < 0)
+		return -ECANCELED;
+
+	return 0;
+}
+
+/**
+ * Send a notification response to a seccomp notification fd
+ * @param fd the notification fd
+ * @param resp the response buffer to use
+ *
+ * Sends a notification response on this fd. This function is thread safe
+ * (synchronization is performed in the kernel). Returns zero on success,
+ * negative values on error.
+ *
+ */
+int sys_notify_respond(int fd, struct seccomp_notif_resp *resp)
+{
+	if (_support_seccomp_user_notif <= 0)
+		return -EOPNOTSUPP;
+
+	if (ioctl(fd, SECCOMP_IOCTL_NOTIF_SEND, resp) < 0)
+		return -ECANCELED;
+	return 0;
+}
+
+/**
+ * Check if a notification id is still valid
+ * @param fd the notification fd
+ * @param id the id to test
+ *
+ * Checks to see if a notification id is still valid. Returns 0 on success, and
+ * negative values on failure.
+ *
+ */
+int sys_notify_id_valid(int fd, uint64_t id)
+{
+	if (_support_seccomp_user_notif <= 0)
+		return -EOPNOTSUPP;
+
+	if (ioctl(fd, SECCOMP_IOCTL_NOTIF_ID_VALID, &id) < 0)
+		return -ENOENT;
 	return 0;
 }