seccomp-notify 0.1.0

data/lib/seccomp/notify/target_memory.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "socket"
+
+module Seccomp
+  module Notify
+    class TargetMemory
+      PAGE_SIZE = 4096
+
+      def initialize(listener, request, cache, cache_mutex = Mutex.new)
+        @listener = listener
+        @request = request
+        @cache = cache
+        @cache_mutex = cache_mutex
+      end
+
+      def read(address, length)
+        raise ArgumentError, "length must be non-negative" if length.negative?
+
+        data = memory.pread(length, address)
+        raise MemoryReadError, "short read from target memory" unless data.bytesize == length
+        raise StaleNotificationError, "notification is no longer valid" unless @request.valid?
+
+        @request.mark_pointer_read!
+        data
+      rescue Errno::EIO, Errno::EFAULT, Errno::ENOENT, Errno::EACCES => error
+        raise MemoryReadError, error.message
+      end
+
+      def read_string(address, max: PAGE_SIZE)
+        raise ArgumentError, "max must be positive" unless max.positive?
+
+        result = +""
+        while result.bytesize < max
+          length = [PAGE_SIZE - ((address + result.bytesize) % PAGE_SIZE), max - result.bytesize].min
+          chunk = read(address + result.bytesize, length)
+          nul = chunk.index("\0")
+          return result << chunk.byteslice(0, nul) if nul
+
+          result << chunk
+        end
+        raise MemoryReadError, "NUL terminator not found within #{max} bytes"
+      end
+
+      def read_sockaddr(address, length)
+        raise MemoryReadError, "sockaddr is shorter than sa_family" if length < 2
+
+        bytes = read(address, length)
+        case bytes.unpack1("S<")
+        when Socket::AF_INET
+          raise MemoryReadError, "short AF_INET sockaddr" if length < 16
+          Addrinfo.tcp(IPAddr.ntop(bytes.byteslice(4, 4)), bytes.byteslice(2, 2).unpack1("n"))
+        when Socket::AF_INET6
+          raise MemoryReadError, "short AF_INET6 sockaddr" if length < 28
+          address = IPAddr.ntop(bytes.byteslice(8, 16))
+          scope = bytes.byteslice(24, 4).unpack1("L<")
+          address = "#{address}%#{scope}" unless scope.zero?
+          Addrinfo.tcp(address, bytes.byteslice(2, 2).unpack1("n"))
+        when Socket::AF_UNIX
+          raw_path = bytes.byteslice(2..).to_s
+          path = raw_path.start_with?("\0") ? raw_path : raw_path.split("\0", 2).first
+          Addrinfo.unix(path)
+        else
+          raise MemoryReadError, "unsupported sockaddr family #{bytes.unpack1("S<")}"
+        end
+      end
+
+      private
+
+      def memory
+        @cache[@request.tid] || @cache_mutex.synchronize do
+          @cache[@request.tid] ||= File.open("/proc/#{@request.tid}/mem", File::RDONLY)
+        end
+      end
+    end
+  end
+end

data/lib/seccomp/notify/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Seccomp
+  module Notify
+    VERSION = "0.1.0"
+  end
+end

data/lib/seccomp/notify.rb

@@ -0,0 +1,221 @@
+# frozen_string_literal: true
+
+require_relative "notify/version"
+require_relative "notify/errors"
+
+unless RUBY_PLATFORM.include?("linux")
+  raise Seccomp::Notify::NotSupportedError, "seccomp-notify supports Linux only"
+end
+
+require "rbconfig"
+require "socket"
+require_relative "notify/constants"
+require_relative "notify/structs"
+require_relative "notify/libc"
+require_relative "notify/ioctl"
+require_relative "notify/syscalls"
+require_relative "notify/bpf/instruction"
+require_relative "notify/bpf/program"
+require_relative "notify/bpf/builder"
+require_relative "notify/policy"
+require_relative "notify/filter"
+require_relative "notify/fd_passing"
+require_relative "notify/target_memory"
+require_relative "notify/request"
+require_relative "notify/features"
+require_relative "notify/supervisor"
+
+module Seccomp
+  module Notify
+    class << self
+      def supported?
+        Features.supported?
+      end
+
+      # Detects optional kernel capabilities with isolated child probes.
+      # @return [Hash<Symbol, Boolean>]
+      def features
+        @features ||= Features.detect
+      end
+
+      # Returns kernel-defined notification structure sizes.
+      # @return [Hash<Symbol, Integer>]
+      def notif_sizes
+        @notif_sizes ||= Libc.notif_sizes
+      end
+
+      # Returns whether the supervisor-side health pipe is still open.
+      #
+      # @return [Boolean, nil] nil when the process was not started by this gem
+      def supervisor_alive?
+        reader = supervisor_health_reader
+        reader ? IO.select([reader], nil, nil, 0).nil? : nil
+      end
+
+      # Starts a filtered child and returns its unfiltered parent supervisor.
+      # @param policy [Policy]
+      # @yield runs in the filtered child
+      # @return [Supervisor]
+      def spawn(policy, recv_timeout: 10, **supervisor_options, &target)
+        raise ArgumentError, "target block is required" unless target
+        unless recv_timeout.is_a?(Numeric) && recv_timeout.real? && recv_timeout.finite? && recv_timeout.positive?
+          raise ArgumentError, "recv_timeout must be positive"
+        end
+
+        program, install_flags = prepare_supervision(policy, supervisor_options)
+        parent_socket, child_socket = UNIXSocket.pair
+        health_reader, health_writer = IO.pipe
+        pid = fork do
+          parent_socket.close
+          health_writer.close
+          keep_health_reader(health_reader)
+          listener = Filter.install!(program, flags: install_flags)
+          FdPassing.send_fd(child_socket, listener)
+          child_socket.close
+          listener.close
+          target.call
+          exit! 0
+        rescue Exception => error # rubocop:disable Lint/RescueException
+          warn("seccomp-notify target setup failed: #{error.message}")
+          exit! 127
+        end
+        child_socket.close
+        health_reader.close
+        listener = FdPassing.recv_fd(parent_socket, timeout: recv_timeout)
+        parent_socket.close
+        Supervisor.new(listener, target_pid: pid, target_child: true, health_writer:, **supervisor_options)
+      rescue StandardError
+        listener&.close unless listener&.closed?
+        parent_socket&.close unless parent_socket&.closed?
+        child_socket&.close unless child_socket&.closed?
+        health_reader&.close unless health_reader&.closed?
+        health_writer&.close unless health_writer&.closed?
+        terminate_child(pid)
+        raise
+      end
+
+      # Installs a filter in the caller and starts a detached supervisor child.
+      # @param policy [Policy]
+      # @param supervisor [Symbol] :spawn or :fork
+      # @return [Integer] supervisor process id
+      def supervise_self(policy, supervisor: :spawn, **options, &configure)
+        raise ArgumentError, "supervisor must be :spawn or :fork" unless %i[spawn fork].include?(supervisor)
+        raise ArgumentError, "supervisor: :spawn does not support Ruby handler blocks" if supervisor == :spawn && configure
+
+        program, install_flags = prepare_supervision(policy, options)
+        selected_features = options.fetch(:features, features)
+        raise NotSupportedError, "supervise_self requires CONTINUE when no handler block is given" if !configure && !selected_features[:continue]
+
+        parent_socket, supervisor_socket = UNIXSocket.pair
+        health_reader, health_writer = IO.pipe
+        target_pid = Process.pid
+        supervisor_pid = case supervisor
+        when :fork
+          fork_supervisor(supervisor_socket, parent_socket, health_reader, health_writer, target_pid, options, configure)
+        when :spawn
+          spawn_supervisor(supervisor_socket, parent_socket, health_writer, target_pid, options)
+        end
+
+        supervisor_socket.close
+        health_writer.close
+        keep_health_reader(health_reader)
+        listener = Filter.install!(program, flags: install_flags)
+        FdPassing.send_fd(parent_socket, listener)
+        listener.close
+        parent_socket.close
+        Process.detach(supervisor_pid)
+        supervisor_pid
+      rescue StandardError
+        listener&.close unless listener&.closed?
+        parent_socket&.close unless parent_socket&.closed?
+        supervisor_socket&.close unless supervisor_socket&.closed?
+        health_reader&.close unless health_reader&.closed?
+        health_writer&.close unless health_writer&.closed?
+        clear_health_reader(health_reader)
+        terminate_child(supervisor_pid)
+        raise
+      end
+
+      private
+
+      def fork_supervisor(socket, other_socket, health_reader, health_writer, target_pid, options, configure)
+        fork do
+          other_socket.close
+          health_reader.close
+          Process.setsid
+          listener = FdPassing.recv_fd(socket)
+          socket.close
+          instance = Supervisor.new(listener, target_pid:, target_child: false, health_writer:, **options)
+          configure ? configure.call(instance) : instance.on_unknown { |request| request.continue! }
+          instance.run
+          exit! 0
+        rescue Exception => error # rubocop:disable Lint/RescueException
+          warn("seccomp-notify supervisor failed: #{error.message}")
+          exit! 1
+        end
+      end
+
+      def spawn_supervisor(socket, other_socket, health_writer, target_pid, options)
+        other_socket.close_on_exec = true
+        socket.close_on_exec = false
+        health_writer.close_on_exec = false
+        encoded_options = Marshal.dump(options).unpack1("H*")
+        Process.spawn(
+          RbConfig.ruby,
+          "-I",
+          File.expand_path("..", __dir__),
+          File.expand_path("../../exe/seccomp-notify-supervisor", __dir__),
+          socket.fileno.to_s,
+          target_pid.to_s,
+          encoded_options,
+          health_writer.fileno.to_s,
+          socket.fileno => socket.fileno,
+          health_writer.fileno => health_writer.fileno,
+          pgroup: true
+        )
+      end
+
+      def prepare_supervision(policy, options)
+        Supervisor.validate_options!(options)
+        sizes = notif_sizes
+        raise NotSupportedError, "unsupported kernel notification sizes: #{sizes.inspect}" unless sizes == Supervisor::EXPECTED_SIZES
+
+        selected_features = options.fetch(:features, features)
+        optional_flags = selected_features[:wait_killable_recv] ? Constants::SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV : 0
+        [BPF::Builder.new(policy).build, policy.flags | optional_flags]
+      end
+
+      def keep_health_reader(reader)
+        reader.close_on_exec = false
+        ENV["SECCOMP_NOTIFY_HEALTH_FD"] = reader.fileno.to_s
+        @supervisor_health_reader = reader
+      end
+
+      def supervisor_health_reader
+        return @supervisor_health_reader if defined?(@supervisor_health_reader)
+
+        fd = ENV["SECCOMP_NOTIFY_HEALTH_FD"]
+        @supervisor_health_reader = IO.for_fd(Integer(fd), autoclose: false) if fd
+      end
+
+      def clear_health_reader(reader)
+        return unless defined?(@supervisor_health_reader) && @supervisor_health_reader.equal?(reader)
+
+        @supervisor_health_reader = nil
+        ENV.delete("SECCOMP_NOTIFY_HEALTH_FD")
+      end
+
+      def terminate_child(pid)
+        return unless pid
+
+        waited = Process.waitpid(pid, Process::WNOHANG)
+        return if waited
+
+        Process.kill("KILL", pid)
+        Process.waitpid(pid)
+      rescue Errno::ECHILD, Errno::ESRCH
+        nil
+      end
+    end
+  end
+end

data/spike/notify_min.c

@@ -0,0 +1,65 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <linux/audit.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/ioctl.h>
+#include <sys/prctl.h>
+#include <sys/socket.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#if defined(__aarch64__)
+#define EXPECTED_ARCH AUDIT_ARCH_AARCH64
+#else
+#define EXPECTED_ARCH AUDIT_ARCH_X86_64
+#endif
+
+static void send_fd(int socket, int fd) {
+  char byte = 0, control[CMSG_SPACE(sizeof(fd))];
+  struct iovec iov = {.iov_base = &byte, .iov_len = 1};
+  struct msghdr msg = {.msg_iov = &iov, .msg_iovlen = 1, .msg_control = control, .msg_controllen = sizeof(control)};
+  struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);
+  cmsg->cmsg_level = SOL_SOCKET; cmsg->cmsg_type = SCM_RIGHTS; cmsg->cmsg_len = CMSG_LEN(sizeof(fd));
+  *(int *)CMSG_DATA(cmsg) = fd;
+  if (sendmsg(socket, &msg, 0) < 0) perror("sendmsg"), exit(1);
+}
+
+static int recv_fd(int socket) {
+  char byte, control[CMSG_SPACE(sizeof(int))];
+  struct iovec iov = {.iov_base = &byte, .iov_len = 1};
+  struct msghdr msg = {.msg_iov = &iov, .msg_iovlen = 1, .msg_control = control, .msg_controllen = sizeof(control)};
+  if (recvmsg(socket, &msg, 0) < 0) perror("recvmsg"), exit(1);
+  return *(int *)CMSG_DATA(CMSG_FIRSTHDR(&msg));
+}
+
+int main(int argc, char **argv) {
+  int sockets[2]; socketpair(AF_UNIX, SOCK_STREAM, 0, sockets);
+  pid_t pid = fork();
+  if (pid == 0) {
+    struct sock_filter ins[] = {
+      BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, arch)),
+      BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, EXPECTED_ARCH, 1, 0), BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),
+      BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
+      BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_openat, 0, 1), BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_USER_NOTIF),
+      BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+    };
+    struct sock_fprog program = {.len = sizeof(ins) / sizeof(ins[0]), .filter = ins};
+    prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+    int listener = syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_NEW_LISTENER, &program);
+    send_fd(sockets[1], listener);
+    int fd = syscall(SYS_openat, AT_FDCWD, "/dev/null", 0);
+    return (argc > 1 && argv[1][0] == 'c') ? (fd < 0) : !(fd < 0 && errno == EPERM);
+  }
+  int listener = recv_fd(sockets[0]);
+  struct seccomp_notif req = {0}; struct seccomp_notif_resp resp = {0};
+  ioctl(listener, SECCOMP_IOCTL_NOTIF_RECV, &req); resp.id = req.id;
+  if (argc > 1 && argv[1][0] == 'c') resp.flags = SECCOMP_USER_NOTIF_FLAG_CONTINUE; else resp.error = -EPERM;
+  ioctl(listener, SECCOMP_IOCTL_NOTIF_SEND, &resp);
+  int status; waitpid(pid, &status, 0); return WEXITSTATUS(status);
+}

data/tools/gen_syscall_table.rb

@@ -0,0 +1,59 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Usage: tools/gen_syscall_table.rb X86_SYSCALL_64_TBL GENERIC_SYSCALL_TBL OUTPUT
+
+def syscall_table(path, abis)
+  rows = File.readlines(path, chomp: true).filter_map do |line|
+    number, abi, name = line.split
+    [Integer(number), abi, name.to_sym] if number&.match?(/\A\d+\z/) && abis.include?(abi)
+  end
+  rows.group_by(&:first).to_h do |number, choices|
+    _number, _abi, name = choices.max_by { |_nr, abi, _name| abi == "64" ? 2 : abi == "common" ? 1 : 0 }
+    [name, number]
+  end
+end
+
+def ruby_hash(name, table)
+  entries = table.sort_by { |_syscall, number| number }.map { |syscall, number| "        #{syscall}: #{number}" }
+  "      #{name} = {\n#{entries.join(",\n")}\n      }.freeze"
+end
+
+x86_path, generic_path, output = ARGV
+abort "usage: #{$PROGRAM_NAME} X86_SYSCALL_64_TBL GENERIC_SYSCALL_TBL OUTPUT" unless output
+
+source = <<~RUBY
+# frozen_string_literal: true
+
+# Generated by tools/gen_syscall_table.rb from Linux kernel syscall tables.
+module Seccomp
+  module Notify
+    module Syscalls
+#{ruby_hash("X86_64", syscall_table(x86_path, %w[common 64]))}
+
+#{ruby_hash("AARCH64", syscall_table(generic_path, %w[common 64 time32 renameat stat64 rlimit memfd_secret]))}
+
+      TABLES = {x86_64: X86_64, aarch64: AARCH64}.freeze
+
+      module_function
+
+      def number(name, arch = Libc.architecture)
+        TABLES.fetch(arch).fetch(name.to_sym) do
+          raise InvalidPolicyError, "unknown syscall \#{name.inspect} for \#{arch}"
+        end
+      end
+
+      def name(number, arch = Libc.architecture)
+        reverse(arch)[number]
+      end
+
+      def reverse(arch)
+        @reverse ||= {}
+        @reverse[arch] ||= TABLES.fetch(arch).invert.freeze
+      end
+    end
+  end
+end
+RUBY
+
+File.write(output, source)

metadata

@@ -0,0 +1,86 @@
+--- !ruby/object:Gem::Specification
+name: seccomp-notify
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Yudai Takada
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: fiddle
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Builds seccomp cBPF filters and supervises Linux syscalls through SECCOMP_RET_USER_NOTIF
+  without native extensions.
+email:
+- t.yudai92@gmail.com
+executables:
+- seccomp-notify-supervisor
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- Rakefile
+- examples/deny_network.rb
+- examples/emulate_open.rb
+- examples/strace_lite.rb
+- exe/seccomp-notify-supervisor
+- lib/seccomp/notify.rb
+- lib/seccomp/notify/bpf/builder.rb
+- lib/seccomp/notify/bpf/instruction.rb
+- lib/seccomp/notify/bpf/program.rb
+- lib/seccomp/notify/constants.rb
+- lib/seccomp/notify/errors.rb
+- lib/seccomp/notify/fd_passing.rb
+- lib/seccomp/notify/features.rb
+- lib/seccomp/notify/filter.rb
+- lib/seccomp/notify/ioctl.rb
+- lib/seccomp/notify/libc.rb
+- lib/seccomp/notify/policy.rb
+- lib/seccomp/notify/request.rb
+- lib/seccomp/notify/structs.rb
+- lib/seccomp/notify/supervisor.rb
+- lib/seccomp/notify/syscalls.rb
+- lib/seccomp/notify/target_memory.rb
+- lib/seccomp/notify/version.rb
+- spike/notify_min.c
+- tools/gen_syscall_table.rb
+homepage: https://rubygems.org/gems/seccomp-notify
+licenses:
+- MIT
+metadata:
+  rubygems_mfa_required: 'true'
+  homepage_uri: https://rubygems.org/gems/seccomp-notify
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.1.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.6
+specification_version: 4
+summary: Pure Ruby bindings for Linux seccomp user notifications
+test_files: []