@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.64-sysid.1

package/vendor/seccomp-src/apply-seccomp.c

@@ -1,280 +0,0 @@
-/*
- * apply-seccomp.c - Apply seccomp BPF filter in an isolated PID namespace
- *
- * Usage: apply-seccomp <command> [args...]
- *
- * This program applies a baked-in seccomp BPF filter, isolates the
- * target command in a nested user+PID+mount namespace so it cannot see or
- * ptrace any process that lacks the filter, applies the filter with
- * prctl(PR_SET_SECCOMP), and execs the command.
- *
- * Process layout inside the outer bwrap sandbox:
- *
- *   bwrap init (PID 1)          <- outer PID ns, no seccomp
- *   \_ bash / socat ...         <- outer PID ns, no seccomp
- *      \_ apply-seccomp [outer] <- outer PID ns, waits for inner init
- *         ================================================= PID ns boundary
- *         \_ apply-seccomp [inner init] <- inner PID 1, PR_SET_DUMPABLE=0
- *            \_ user command            <- inner PID 2, seccomp applied
- *
- * From the user command's point of view /proc contains only its own process
- * tree. The bwrap init, bash wrapper, and socat helpers are not addressable,
- * so they cannot be ptraced or patched via /proc/N/mem even on systems with
- * kernel.yama.ptrace_scope=0. The inner init (PID 1) sets PR_SET_DUMPABLE=0
- * so it cannot be ptraced either.
- *
- * Any failure to set up the nested namespaces aborts with a non-zero exit
- * status; we never fall back to running the command without isolation.
- *
- * Compile: gcc -static -O2 -o apply-seccomp apply-seccomp.c
- */
-
-#define _GNU_SOURCE
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <sched.h>
-#include <signal.h>
-#include <sys/prctl.h>
-#include <sys/wait.h>
-#include <sys/mount.h>
-#include <linux/seccomp.h>
-#include <linux/filter.h>
-
-#include "unix-block-bpf.h"
-
-#ifndef PR_SET_NO_NEW_PRIVS
-#define PR_SET_NO_NEW_PRIVS 38
-#endif
-
-#ifndef PR_CAP_AMBIENT
-#define PR_CAP_AMBIENT 47
-#define PR_CAP_AMBIENT_CLEAR_ALL 4
-#endif
-
-#ifndef SECCOMP_MODE_FILTER
-#define SECCOMP_MODE_FILTER 2
-#endif
-
-static void die(const char *msg) {
-    perror(msg);
-    _exit(1);
-}
-
-static int write_file(const char *path, const char *fmt, ...) {
-    char buf[256];
-    va_list ap;
-    va_start(ap, fmt);
-    int len = vsnprintf(buf, sizeof(buf), fmt, ap);
-    va_end(ap);
-    if (len < 0 || (size_t)len >= sizeof(buf)) {
-        errno = EOVERFLOW;
-        return -1;
-    }
-
-    int fd = open(path, O_WRONLY);
-    if (fd < 0) {
-        return -1;
-    }
-    ssize_t r = write(fd, buf, (size_t)len);
-    int saved = errno;
-    close(fd);
-    if (r != len) {
-        errno = (r < 0) ? saved : EIO;
-        return -1;
-    }
-    return 0;
-}
-
-/* PID the current process forwards signals to. Used by both the outer stub
- * (forwards to inner init) and the inner init (forwards to the worker).
- * PID 1 ignores signals it has no handler for, so the inner init MUST install
- * these or SIGTERM from the outside is silently dropped. */
-static volatile pid_t forward_target = -1;
-
-static void forward_signal(int sig) {
-    if (forward_target > 0) {
-        kill(forward_target, sig);
-    }
-}
-
-static void install_forwarders(pid_t target) {
-    forward_target = target;
-    struct sigaction sa = { .sa_handler = forward_signal };
-    sigemptyset(&sa.sa_mask);
-    sigaction(SIGTERM, &sa, NULL);
-    sigaction(SIGINT,  &sa, NULL);
-    sigaction(SIGHUP,  &sa, NULL);
-    sigaction(SIGQUIT, &sa, NULL);
-    sigaction(SIGUSR1, &sa, NULL);
-    sigaction(SIGUSR2, &sa, NULL);
-}
-
-/*
- * Wait for `main_child`, reaping any other children that exit first.
- * Returns as soon as `main_child` terminates — the caller then _exit()s,
- * which as PID 1 tears down the namespace and SIGKILLs any stragglers.
- * Returns an exit(3)-style status: exit code, or 128+signal.
- */
-static int reap_until(pid_t main_child) {
-    int status = 0;
-    for (;;) {
-        pid_t r = waitpid(-1, &status, 0);
-        if (r < 0) {
-            if (errno == EINTR) {
-                continue;
-            }
-            return 1;  /* ECHILD without seeing main_child — shouldn't happen. */
-        }
-        if (r == main_child) {
-            if (WIFEXITED(status)) {
-                return WEXITSTATUS(status);
-            }
-            if (WIFSIGNALED(status)) {
-                return 128 + WTERMSIG(status);
-            }
-            return 1;
-        }
-        /* Reaped an orphan that died before main_child; keep waiting. */
-    }
-}
-
-int main(int argc, char *argv[]) {
-    if (argc < 2) {
-        fprintf(stderr, "Usage: %s <command> [args...]\n", argv[0]);
-        return 1;
-    }
-
-    char **command_argv = &argv[1];
-
-    _Static_assert(sizeof(unix_block_bpf) % sizeof(struct sock_filter) == 0,
-                   "BPF filter size must be a multiple of sock_filter");
-    struct sock_fprog prog = {
-        .len = (unsigned short)(sizeof(unix_block_bpf) / sizeof(struct sock_filter)),
-        .filter = (struct sock_filter *)unix_block_bpf,
-    };
-
-    /* ---- New PID + mount namespaces. Children (not us) enter the PID ns. ----
-     *
-     * Two paths to get CAP_SYS_ADMIN for the unshare:
-     *   (a) The caller (bwrap) kept CAP_SYS_ADMIN in this user namespace via
-     *       --cap-add. Just unshare directly.
-     *   (b) We don't have the cap. Create a nested user namespace to get it,
-     *       map uid/gid, then unshare. This also works when apply-seccomp is
-     *       run standalone outside bwrap.
-     *
-     * Path (a) is tried first. If the caller didn't give us the cap, the
-     * kernel returns EPERM and we fall through to (b). Path (b) can itself
-     * fail on hosts where unprivileged user namespaces are gated by an LSM
-     * (Ubuntu 24.04's AppArmor restriction, for example) — the unshare
-     * succeeds but the new namespace grants no capabilities, so the setgroups
-     * write fails. In that case we abort: the caller must supply CAP_SYS_ADMIN.
-     */
-    if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
-        if (errno != EPERM) {
-            die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS)");
-        }
-
-        uid_t uid = geteuid();
-        gid_t gid = getegid();
-
-        if (unshare(CLONE_NEWUSER) < 0) {
-            die("apply-seccomp: unshare(CLONE_NEWUSER)");
-        }
-        if (write_file("/proc/self/setgroups", "deny") < 0) {
-            die("apply-seccomp: write /proc/self/setgroups "
-                "(nested userns is capability-restricted; "
-                "caller must provide CAP_SYS_ADMIN)");
-        }
-        if (write_file("/proc/self/uid_map", "%u %u 1\n", uid, uid) < 0) {
-            die("apply-seccomp: write /proc/self/uid_map");
-        }
-        if (write_file("/proc/self/gid_map", "%u %u 1\n", gid, gid) < 0) {
-            die("apply-seccomp: write /proc/self/gid_map");
-        }
-        if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
-            die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS) after userns");
-        }
-    }
-
-    pid_t child = fork();
-    if (child < 0) {
-        die("apply-seccomp: fork");
-    }
-
-    if (child > 0) {
-        /* Outer stub: still in bwrap's PID namespace. Forward signals and
-         * wait so the caller sees the real exit status. */
-        install_forwarders(child);
-
-        int status;
-        for (;;) {
-            pid_t r = waitpid(child, &status, 0);
-            if (r < 0 && errno == EINTR) continue;
-            if (r < 0) die("apply-seccomp: waitpid");
-            break;
-        }
-        if (WIFSIGNALED(status)) return 128 + WTERMSIG(status);
-        return WIFEXITED(status) ? WEXITSTATUS(status) : 1;
-    }
-
-    /* ================================================================
-     * Inner init — PID 1 in the nested PID namespace.
-     * ================================================================ */
-
-    /* Block ptrace and /proc/1/mem writes against this process. */
-    if (prctl(PR_SET_DUMPABLE, 0) < 0) {
-        die("apply-seccomp: prctl(PR_SET_DUMPABLE)");
-    }
-
-    /* Don't let our /proc mount propagate anywhere. */
-    if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
-        die("apply-seccomp: mount(MS_PRIVATE)");
-    }
-    /* EPERM here means a masked /proc is underneath (unprivileged Docker)
-     * and the kernel domination check refused the overmount. The nested
-     * userns above is the isolation boundary; this remount only hides
-     * outer PIDs from `ls /proc`. enableWeakerNestedSandbox targets
-     * exactly this environment. */
-    if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0
-        && errno != EPERM) {
-        die("apply-seccomp: mount(/proc)");
-    }
-
-    /* bwrap --cap-add places CAP_SYS_ADMIN in the ambient set so it survives
-     * exec. Clear it now that the mount is done; combined with
-     * PR_SET_NO_NEW_PRIVS, the worker's execve drops to zero capabilities. */
-    if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0) < 0) {
-        die("apply-seccomp: prctl(PR_CAP_AMBIENT_CLEAR_ALL)");
-    }
-
-    /* Fork the real workload so PID 1 can stay as a non-dumpable reaper. */
-    pid_t worker = fork();
-    if (worker < 0) {
-        die("apply-seccomp: fork(worker)");
-    }
-
-    if (worker > 0) {
-        /* Inner init: reap everything, exit with the worker's status.
-         * When PID 1 exits the kernel tears down the whole namespace.
-         * PID 1 drops signals without handlers, so install forwarders. */
-        install_forwarders(worker);
-        _exit(reap_until(worker));
-    }
-
-    /* ---- Worker (inner PID 2): apply seccomp and exec. ---- */
-    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
-        die("apply-seccomp: prctl(PR_SET_NO_NEW_PRIVS)");
-    }
-    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
-        die("apply-seccomp: prctl(PR_SET_SECCOMP)");
-    }
-
-    execvp(command_argv[0], command_argv);
-    die("apply-seccomp: execvp");
-    return 1;
-}

package/vendor/seccomp-src/seccomp-unix-block.c

@@ -1,148 +0,0 @@
-/*
- * Seccomp BPF filter generator to block Unix domain socket creation
- *
- * This program generates a seccomp-bpf filter that blocks the socket() syscall
- * when called with AF_UNIX as the domain argument. This prevents creation of
- * Unix domain sockets while allowing all other socket types (AF_INET, AF_INET6, etc.)
- * and all other syscalls.
- *
- * The filter is exported in a format compatible with bubblewrap's --seccomp flag.
- *
- * SECURITY LIMITATION - 32-bit x86 (ia32):
- * TODO: This filter does NOT block socketcall() syscall, which is a security issue
- * on 32-bit x86 systems. On ia32, the socket() syscall doesn't exist - instead,
- * all socket operations are multiplexed through socketcall():
- *   - socketcall(SYS_SOCKET, [AF_UNIX, ...]) - can bypass this filter
- *   - socketcall(SYS_SOCKETPAIR, [AF_UNIX, ...]) - can bypass this filter
- *
- * To fix this, we need to add conditional rules that:
- * 1. Check if socketcall() exists on the current architecture (32-bit x86 only)
- * 2. Block socketcall(SYS_SOCKET, ...) when first arg of sub-call is AF_UNIX
- * 3. Block socketcall(SYS_SOCKETPAIR, ...) when first arg of sub-call is AF_UNIX
- *
- * This requires inspecting the arguments passed to socketcall, which is more
- * complex BPF logic. For now, 32-bit x86 is not supported.
- *
- * Compilation:
- *   gcc -o seccomp-unix-block seccomp-unix-block.c -lseccomp
- *
- * Usage:
- *   ./seccomp-unix-block <output-file> [arch]
- *
- * If arch is given (x86_64 or aarch64), the filter is generated for that
- * architecture instead of the native one. Lets a single-arch builder emit
- * filters for both x64 and arm64.
- *
- * Dependencies:
- *   - libseccomp (libseccomp-dev package on Debian/Ubuntu)
- */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <seccomp.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-
-int main(int argc, char *argv[]) {
-    scmp_filter_ctx ctx;
-    int rc;
-
-    if (argc < 2 || argc > 3) {
-        fprintf(stderr, "Usage: %s <output-file> [x86_64|aarch64]\n", argv[0]);
-        return 1;
-    }
-
-    const char *output_file = argv[1];
-    const char *arch_name = (argc == 3) ? argv[2] : NULL;
-
-    /* Create seccomp context with default action ALLOW */
-    ctx = seccomp_init(SCMP_ACT_ALLOW);
-    if (ctx == NULL) {
-        fprintf(stderr, "Error: Failed to initialize seccomp context\n");
-        return 1;
-    }
-
-    if (arch_name != NULL) {
-        uint32_t target;
-        if (strcmp(arch_name, "x86_64") == 0) {
-            target = SCMP_ARCH_X86_64;
-        } else if (strcmp(arch_name, "aarch64") == 0) {
-            target = SCMP_ARCH_AARCH64;
-        } else {
-            fprintf(stderr, "Error: Unsupported arch '%s'\n", arch_name);
-            seccomp_release(ctx);
-            return 1;
-        }
-        if (target != seccomp_arch_native()) {
-            rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
-            if (rc == 0) rc = seccomp_arch_add(ctx, target);
-            if (rc < 0) {
-                fprintf(stderr, "Error: Failed to set target arch: %s\n", strerror(-rc));
-                seccomp_release(ctx);
-                return 1;
-            }
-        }
-    }
-
-    /* Add rule to block socket(AF_UNIX, ...) */
-    /* socket() syscall signature: int socket(int domain, int type, int protocol) */
-    /* arg0 = domain (AF_UNIX = 1) */
-    /* Use SCMP_CMP_MASKED_EQ with a 32-bit mask: the domain argument is a 32-bit
-     * int, so the kernel ignores the upper 32 bits of the register. A plain
-     * SCMP_CMP_EQ would compare all 64 bits and miss calls where the upper bits
-     * are set. */
-    rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1,
-                          SCMP_A0(SCMP_CMP_MASKED_EQ, 0xffffffff, AF_UNIX));
-    if (rc < 0) {
-        fprintf(stderr, "Error: Failed to add seccomp rule: %s\n", strerror(-rc));
-        seccomp_release(ctx);
-        return 1;
-    }
-
-    /* Block io_uring entirely. IORING_OP_SOCKET (Linux 5.19+) creates sockets
-     * in kernel context without going through the socket() syscall, bypassing
-     * the rule above. seccomp cannot inspect io_uring SQEs (they live in a
-     * shared-memory ring), so the only safe option is to deny ring creation
-     * and use. Blocking all three syscalls also covers the case of an
-     * inherited ring fd. */
-    int io_uring_calls[] = {
-        SCMP_SYS(io_uring_setup),
-        SCMP_SYS(io_uring_enter),
-        SCMP_SYS(io_uring_register),
-    };
-    for (size_t i = 0; i < sizeof(io_uring_calls) / sizeof(io_uring_calls[0]); i++) {
-        rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), io_uring_calls[i], 0);
-        if (rc < 0) {
-            fprintf(stderr, "Error: Failed to add io_uring rule: %s\n", strerror(-rc));
-            seccomp_release(ctx);
-            return 1;
-        }
-    }
-
-    /* Export the filter to a file */
-    int fd = open(output_file, O_CREAT | O_WRONLY | O_TRUNC, 0600);
-    if (fd < 0) {
-        fprintf(stderr, "Error: Failed to open output file: %s\n", strerror(errno));
-        seccomp_release(ctx);
-        return 1;
-    }
-
-    rc = seccomp_export_bpf(ctx, fd);
-    if (rc < 0) {
-        fprintf(stderr, "Error: Failed to export seccomp filter: %s\n", strerror(-rc));
-        close(fd);
-        seccomp_release(ctx);
-        return 1;
-    }
-
-    /* Clean up */
-    close(fd);
-    seccomp_release(ctx);
-
-    return 0;
-}