seccomp-tools 1.6.2 → 1.7.0

data/lib/seccomp-tools/consts/sys_nr/riscv64.rb

@@ -0,0 +1,332 @@
+# frozen_string_literal: true
+
+{
+  io_setup: 0,
+  io_destroy: 1,
+  io_submit: 2,
+  io_cancel: 3,
+  io_getevents: 4,
+  setxattr: 5,
+  lsetxattr: 6,
+  fsetxattr: 7,
+  getxattr: 8,
+  lgetxattr: 9,
+  fgetxattr: 10,
+  listxattr: 11,
+  llistxattr: 12,
+  flistxattr: 13,
+  removexattr: 14,
+  lremovexattr: 15,
+  fremovexattr: 16,
+  getcwd: 17,
+  lookup_dcookie: 18,
+  eventfd2: 19,
+  epoll_create1: 20,
+  epoll_ctl: 21,
+  epoll_pwait: 22,
+  dup: 23,
+  dup3: 24,
+  fcntl: 25,
+  inotify_init1: 26,
+  inotify_add_watch: 27,
+  inotify_rm_watch: 28,
+  ioctl: 29,
+  ioprio_set: 30,
+  ioprio_get: 31,
+  flock: 32,
+  mknodat: 33,
+  mkdirat: 34,
+  unlinkat: 35,
+  symlinkat: 36,
+  linkat: 37,
+  umount2: 39,
+  mount: 40,
+  pivot_root: 41,
+  nfsservctl: 42,
+  statfs: 43,
+  fstatfs: 44,
+  truncate: 45,
+  ftruncate: 46,
+  fallocate: 47,
+  faccessat: 48,
+  chdir: 49,
+  fchdir: 50,
+  chroot: 51,
+  fchmod: 52,
+  fchmodat: 53,
+  fchownat: 54,
+  fchown: 55,
+  openat: 56,
+  close: 57,
+  vhangup: 58,
+  pipe2: 59,
+  quotactl: 60,
+  getdents64: 61,
+  lseek: 62,
+  read: 63,
+  write: 64,
+  readv: 65,
+  writev: 66,
+  pread64: 67,
+  pwrite64: 68,
+  preadv: 69,
+  pwritev: 70,
+  sendfile: 71,
+  pselect6: 72,
+  ppoll: 73,
+  signalfd4: 74,
+  vmsplice: 75,
+  splice: 76,
+  tee: 77,
+  readlinkat: 78,
+  newfstatat: 79,
+  fstat: 80,
+  sync: 81,
+  fsync: 82,
+  fdatasync: 83,
+  sync_file_range: 84,
+  timerfd_create: 85,
+  timerfd_settime: 86,
+  timerfd_gettime: 87,
+  utimensat: 88,
+  acct: 89,
+  capget: 90,
+  capset: 91,
+  personality: 92,
+  exit: 93,
+  exit_group: 94,
+  waitid: 95,
+  set_tid_address: 96,
+  unshare: 97,
+  futex: 98,
+  set_robust_list: 99,
+  get_robust_list: 100,
+  nanosleep: 101,
+  getitimer: 102,
+  setitimer: 103,
+  kexec_load: 104,
+  init_module: 105,
+  delete_module: 106,
+  timer_create: 107,
+  timer_gettime: 108,
+  timer_getoverrun: 109,
+  timer_settime: 110,
+  timer_delete: 111,
+  clock_settime: 112,
+  clock_gettime: 113,
+  clock_getres: 114,
+  clock_nanosleep: 115,
+  syslog: 116,
+  ptrace: 117,
+  sched_setparam: 118,
+  sched_setscheduler: 119,
+  sched_getscheduler: 120,
+  sched_getparam: 121,
+  sched_setaffinity: 122,
+  sched_getaffinity: 123,
+  sched_yield: 124,
+  sched_get_priority_max: 125,
+  sched_get_priority_min: 126,
+  sched_rr_get_interval: 127,
+  restart_syscall: 128,
+  kill: 129,
+  tkill: 130,
+  tgkill: 131,
+  sigaltstack: 132,
+  rt_sigsuspend: 133,
+  rt_sigaction: 134,
+  rt_sigprocmask: 135,
+  rt_sigpending: 136,
+  rt_sigtimedwait: 137,
+  rt_sigqueueinfo: 138,
+  rt_sigreturn: 139,
+  setpriority: 140,
+  getpriority: 141,
+  reboot: 142,
+  setregid: 143,
+  setgid: 144,
+  setreuid: 145,
+  setuid: 146,
+  setresuid: 147,
+  getresuid: 148,
+  setresgid: 149,
+  getresgid: 150,
+  setfsuid: 151,
+  setfsgid: 152,
+  times: 153,
+  setpgid: 154,
+  getpgid: 155,
+  getsid: 156,
+  setsid: 157,
+  getgroups: 158,
+  setgroups: 159,
+  uname: 160,
+  sethostname: 161,
+  setdomainname: 162,
+  getrlimit: 163,
+  setrlimit: 164,
+  getrusage: 165,
+  umask: 166,
+  prctl: 167,
+  getcpu: 168,
+  gettimeofday: 169,
+  settimeofday: 170,
+  adjtimex: 171,
+  getpid: 172,
+  getppid: 173,
+  getuid: 174,
+  geteuid: 175,
+  getgid: 176,
+  getegid: 177,
+  gettid: 178,
+  sysinfo: 179,
+  mq_open: 180,
+  mq_unlink: 181,
+  mq_timedsend: 182,
+  mq_timedreceive: 183,
+  mq_notify: 184,
+  mq_getsetattr: 185,
+  msgget: 186,
+  msgctl: 187,
+  msgrcv: 188,
+  msgsnd: 189,
+  semget: 190,
+  semctl: 191,
+  semtimedop: 192,
+  semop: 193,
+  shmget: 194,
+  shmctl: 195,
+  shmat: 196,
+  shmdt: 197,
+  socket: 198,
+  socketpair: 199,
+  bind: 200,
+  listen: 201,
+  accept: 202,
+  connect: 203,
+  getsockname: 204,
+  getpeername: 205,
+  sendto: 206,
+  recvfrom: 207,
+  setsockopt: 208,
+  getsockopt: 209,
+  shutdown: 210,
+  sendmsg: 211,
+  recvmsg: 212,
+  readahead: 213,
+  brk: 214,
+  munmap: 215,
+  mremap: 216,
+  add_key: 217,
+  request_key: 218,
+  keyctl: 219,
+  clone: 220,
+  execve: 221,
+  mmap: 222,
+  fadvise64: 223,
+  swapon: 224,
+  swapoff: 225,
+  mprotect: 226,
+  msync: 227,
+  mlock: 228,
+  munlock: 229,
+  mlockall: 230,
+  munlockall: 231,
+  mincore: 232,
+  madvise: 233,
+  remap_file_pages: 234,
+  mbind: 235,
+  get_mempolicy: 236,
+  set_mempolicy: 237,
+  migrate_pages: 238,
+  move_pages: 239,
+  rt_tgsigqueueinfo: 240,
+  perf_event_open: 241,
+  accept4: 242,
+  recvmmsg: 243,
+  riscv_hwprobe: 258,
+  riscv_flush_icache: 259,
+  wait4: 260,
+  prlimit64: 261,
+  fanotify_init: 262,
+  fanotify_mark: 263,
+  name_to_handle_at: 264,
+  open_by_handle_at: 265,
+  clock_adjtime: 266,
+  syncfs: 267,
+  setns: 268,
+  sendmmsg: 269,
+  process_vm_readv: 270,
+  process_vm_writev: 271,
+  kcmp: 272,
+  finit_module: 273,
+  sched_setattr: 274,
+  sched_getattr: 275,
+  renameat2: 276,
+  seccomp: 277,
+  getrandom: 278,
+  memfd_create: 279,
+  bpf: 280,
+  execveat: 281,
+  userfaultfd: 282,
+  membarrier: 283,
+  mlock2: 284,
+  copy_file_range: 285,
+  preadv2: 286,
+  pwritev2: 287,
+  pkey_mprotect: 288,
+  pkey_alloc: 289,
+  pkey_free: 290,
+  statx: 291,
+  io_pgetevents: 292,
+  rseq: 293,
+  kexec_file_load: 294,
+  pidfd_send_signal: 424,
+  io_uring_setup: 425,
+  io_uring_enter: 426,
+  io_uring_register: 427,
+  open_tree: 428,
+  move_mount: 429,
+  fsopen: 430,
+  fsconfig: 431,
+  fsmount: 432,
+  fspick: 433,
+  pidfd_open: 434,
+  clone3: 435,
+  close_range: 436,
+  openat2: 437,
+  pidfd_getfd: 438,
+  faccessat2: 439,
+  process_madvise: 440,
+  epoll_pwait2: 441,
+  mount_setattr: 442,
+  quotactl_fd: 443,
+  landlock_create_ruleset: 444,
+  landlock_add_rule: 445,
+  landlock_restrict_self: 446,
+  memfd_secret: 447,
+  process_mrelease: 448,
+  futex_waitv: 449,
+  set_mempolicy_home_node: 450,
+  cachestat: 451,
+  fchmodat2: 452,
+  map_shadow_stack: 453,
+  futex_wake: 454,
+  futex_wait: 455,
+  futex_requeue: 456,
+  statmount: 457,
+  listmount: 458,
+  lsm_get_self_attr: 459,
+  lsm_set_self_attr: 460,
+  lsm_list_modules: 461,
+  mseal: 462,
+  setxattrat: 463,
+  getxattrat: 464,
+  listxattrat: 465,
+  removexattrat: 466,
+  open_tree_attr: 467,
+  file_getattr: 468,
+  file_setattr: 469,
+  listns: 470,
+  rseq_slice_yield: 471
+}

data/lib/seccomp-tools/disasm/disasm.rb

@@ -3,7 +3,8 @@
 require 'set'
 
 require 'seccomp-tools/bpf'
-require 'seccomp-tools/disasm/context'
+require 'seccomp-tools/symbolic/constraint'
+require 'seccomp-tools/symbolic/state'
 require 'seccomp-tools/util'
 
 module SeccompTools
@@ -12,24 +13,38 @@ module SeccompTools
     module_function
 
     # Disassemble BPF codes.
+    #
+    # Emulates the filter to track what each register holds, so syscall names and argument
+    # positions can be inferred and shown as comments.
     # @param [String] raw
     #   The raw BPF bytes.
-    # @param [Symbol] arch
-    #   Architecture.
+    # @param [Symbol?] arch
+    #   Target architecture, must be one of {SeccompTools::Util.supported_archs}.
+    #   Defaults to {SeccompTools::Util.system_arch} when +nil+.
     # @param [Boolean] display_bpf
+    #   Whether to prepend each line with its raw +code+, +jt+, +jf+ and +k+ fields.
     # @param [Boolean] arg_infer
+    #   Whether to annotate lines with the inferred syscall name and argument.
+    # @return [String]
+    #   The disassembly result, ready to be printed.
+    # @example
+    #   SeccompTools::Disasm.disasm(raw, arch: :amd64, display_bpf: false)
+    #   #=> "0000: A = sys_number\n0001: if (A == read) goto 0003\n0002: return KILL\n0003: return ALLOW\n"
     def disasm(raw, arch: nil, display_bpf: true, arg_infer: true)
       codes = to_bpf(raw, arch)
-      contexts = Array.new(codes.size) { Set.new }
-      contexts[0].add(Context.new)
-      # all we care is whether A is data[*]
-      dis = codes.zip(contexts).map do |code, ctxs|
-        ctxs.each do |ctx|
-          code.branch(ctx) do |pc, c|
-            contexts[pc].add(c) unless pc >= contexts.size
+      states = Array.new(codes.size) { Set.new }
+      states[0].add(Symbolic::State.initial)
+      # A forward pass (jumps only go forward) tracking, per line, the states that can reach it, so
+      # syscall names and argument positions can be inferred from what each register holds. Unlike
+      # the Executor, this over-approximates - it forks every conditional instead of folding - so
+      # dead lines are still rendered.
+      dis = codes.zip(states).map do |code, sts|
+        sts.each do |st|
+          code.branch(st) do |pc, s|
+            states[pc].add(s) unless pc >= states.size
           end
         end
-        code.contexts = ctxs
+        code.states = sts
         code.disasm(code: display_bpf, arg_infer:)
       end.join("\n")
       if display_bpf
@@ -45,8 +60,11 @@ module SeccompTools
 
     # Convert raw BPF string to array of {BPF}.
     # @param [String] raw
-    # @param [Symbol] arch
+    #   The raw BPF bytes, each instruction being 8 bytes long.
+    # @param [Symbol?] arch
+    #   Target architecture, defaults to {SeccompTools::Util.system_arch} when +nil+.
     # @return [Array<BPF>]
+    #   One {BPF} per instruction, in order.
     def to_bpf(raw, arch)
       arch ||= Util.system_arch
       raw.scan(/.{8}/m).map.with_index { |b, i| BPF.new(b, arch, i) }

data/lib/seccomp-tools/dumper.rb

@@ -1,57 +1,64 @@
 # frozen_string_literal: true
 
 require 'os'
+require 'timeout'
 
 require 'seccomp-tools/logger'
 require 'seccomp-tools/ptrace' if OS.linux?
 require 'seccomp-tools/syscall'
+require 'seccomp-tools/util'
 
 module SeccompTools
   # Dump seccomp-bpf using ptrace of binary.
   module Dumper
     # Whether the dumper is supported.
-    # Dumper works based on ptrace, so we need the platform be Linux.
+    # Dumper works based on ptrace, so we need the platform to be Linux.
     SUPPORTED = OS.linux?
 
     module_function
 
     # Main bpf dump function.
-    # Yield seccomp bpf whenever find a +prctl(SET_SECCOMP)+ call.
+    # Yields seccomp bpf whenever a +prctl(SET_SECCOMP)+ call is found.
     #
     # @param [Array<String>] args
-    #   The arguments for target execution file.
+    #   The command to be executed, i.e. the target executable followed by its arguments.
     # @param [Integer] limit
     #   By default, +dump+ will only dump the first +SET_SECCOMP+ call.
     #   Set +limit+ to the number of calling +prctl(SET_SECCOMP)+ then the child process will be killed when number of
     #   calling +prctl+ reaches +limit+.
     #
     #   Negative number for unlimited.
+    # @param [Float?] timeout
+    #   Number of seconds to wait for the target process. When the timeout is reached, the target
+    #   process is killed and the filters dumped so far are returned. +nil+ for no timeout.
     # @yieldparam [String] bpf
     #   Seccomp bpf in raw bytes.
-    # @yieldparam [Symbol] arch
-    #   Architecture of the target process.
+    # @yieldparam [Symbol?] arch
+    #   Architecture of the target process, +nil+ when it cannot be determined.
+    #   See {SeccompTools::Util.process_arch}.
     # @return [Array<Object>, Array<String>]
-    #   Return the block returned. If block is not given, array of raw bytes will be returned.
+    #   One entry per dumped filter: the block's return values when a block is given, otherwise the
+    #   raw bytes. Empty on a non-Linux platform, where dumping is unsupported.
     # @example
     #   dump('ls', '-l', '-a')
     #   #=> []
     #   dump('spec/binary/twctf-2016-diary') { |c| c[0, 10] }
     #   #=> [" \x00\x00\x00\x00\x00\x00\x00\x15\x00"]
-    # @todo
-    #   +timeout+ option.
-    def dump(*args, limit: 1, &block)
+    def dump(*args, limit: 1, timeout: nil, &block)
       return [] unless SUPPORTED
 
       pid = fork { handle_child(*args) }
-      Handler.new(pid).handle(limit, &block)
+      Handler.new(pid).handle(limit, timeout: timeout, &block)
     end
 
-    # Do the tracer things.
+    # Traces a forked child, single-stepping it through its syscalls and capturing the seccomp
+    # filters it installs.
     class Handler
       # Instantiate a {Handler} object.
       # @param [Integer] pid
       #   The process id after fork.
       def initialize(pid)
+        @pids = [pid]
         Process.waitpid(pid)
         opt = Ptrace::O_TRACESYSGOOD | Ptrace::O_TRACECLONE | Ptrace::O_TRACEFORK | Ptrace::O_TRACEVFORK
         Ptrace.setoptions(pid, 0, opt)
@@ -62,45 +69,59 @@ module SeccompTools
       #
       # @param [Integer] limit
       #   Child will be killed when number of calling +prctl(SET_SECCOMP)+ reaches +limit+.
+      # @param [Float?] timeout
+      #   Kill the child processes when +timeout+ seconds have elapsed. +nil+ for no timeout.
       # @yieldparam [String] bpf
       #   Seccomp bpf in raw bytes.
       # @yieldparam [Symbol] arch
       #   Architecture. See {SeccompTools::Syscall::ABI} for supported architectures.
       # @return [Array<Object>, Array<String>]
-      #   Return the block returned. If block is not given, array of raw bytes will be returned.
-      def handle(limit, &block)
+      #   One entry per dumped filter: the block's return values when a block is given, otherwise
+      #   the raw bytes.
+      def handle(limit, timeout: nil, &block)
         collect = []
         syscalls = {} # record last syscall
-        loop while wait_syscall do |child|
-          if syscalls[child].nil? # invoke syscall
-            syscalls[child] = syscall(child)
-            next true
+        begin
+          Timeout.timeout(timeout) do
+            loop while wait_syscall do |child|
+              if syscalls[child].nil? # invoke syscall
+                syscalls[child] = syscall(child)
+                next true
+              end
+              # syscall finished
+              sys = syscalls[child]
+              syscalls[child] = nil
+              if sys.set_seccomp? && syscall(child).ret.zero? # consider successful call only
+                bpf = sys.dump_bpf
+                collect << (block.nil? ? bpf : yield(bpf, sys.arch))
+                limit -= 1
+              end
+              !limit.zero?
+            end
           end
-          # syscall finished
-          sys = syscalls[child]
-          syscalls[child] = nil
-          if sys.set_seccomp? && syscall(child).ret.zero? # consider successful call only
-            bpf = sys.dump_bpf
-            collect << (block.nil? ? bpf : yield(bpf, sys.arch))
-            limit -= 1
-          end
-          !limit.zero?
+        rescue Timeout::Error
+          # keep the filters dumped so far; fall through to kill the children
         end
-        syscalls.each_key { |cpid| Process.kill('KILL', cpid) if alive?(cpid) }
+        @pids.each { |cpid| Process.kill('KILL', cpid) if alive?(cpid) }
         Process.waitall
         collect
       end
 
       private
 
+      # Waits until a traced child enters or leaves a syscall, then resumes it.
+      #
       # @yieldparam [Integer] pid
+      #   Id of the child that stopped.
+      # @yieldreturn [Boolean]
+      #   Whether tracing should continue.
       # @return [Boolean]
       #   +true+ for continue,
-      #   +false+ for break.
+      #   +false+ for break. Also +false+ once no children are left.
       def wait_syscall
         child, status = Process.wait2
+        @pids << child unless @pids.include?(child)
         cont = true
-        # TODO: Test if clone / vfork works
         if [Ptrace::EVENT_CLONE, Ptrace::EVENT_FORK, Ptrace::EVENT_VFORK].include?(status.to_i >> 16)
           # New child launched!
           # newpid = SeccompTools::Ptrace.geteventmsg(child)
@@ -113,11 +134,20 @@ module SeccompTools
         false
       end
 
+      # Reads the syscall the stopped child is currently invoking.
+      #
+      # @param [Integer] pid
+      #   Id of the stopped child.
       # @return [SeccompTools::Syscall]
       def syscall(pid)
         SeccompTools::Syscall.new(pid)
       end
 
+      # Is the process still running?
+      #
+      # @param [Integer] pid
+      #   Id of the process to be checked.
+      # @return [Boolean]
       def alive?(pid)
         Process.getpgid(pid)
         true
@@ -149,10 +179,11 @@ module SeccompTools
     #   Number of filters to dump. Negative number for unlimited.
     # @yieldparam [String] bpf
     #   Seccomp bpf in raw bytes.
-    # @yieldparam [Symbol] arch
-    #   Architecture of the target process (always nil right now).
+    # @yieldparam [Symbol?] arch
+    #   Architecture of the target process, +nil+ when it cannot be determined.
+    #   See {SeccompTools::Util.process_arch}.
     # @return [Array<Object>, Array<String>]
-    #   Return the block returned. If block is not given, array of raw bytes will be returned.
+    #   Returns what the block returned. If a block is not given, an array of raw bytes will be returned.
     # @raise [Errno::ESRCH]
     #   Raises when the target process does not exist.
     # @raise [Errno::EPERM]
@@ -174,6 +205,7 @@ module SeccompTools
       return [] unless SUPPORTED
 
       collect = []
+      arch = Util.process_arch(pid)
       Ptrace.attach_and_wait(pid)
       begin
         i = 0
@@ -183,7 +215,7 @@ module SeccompTools
           rescue Errno::ENOENT, Errno::EINVAL
             break
           end
-          collect << (block.nil? ? bpf : yield(bpf, nil))
+          collect << (block.nil? ? bpf : yield(bpf, arch))
           i += 1
         end
       ensure