src/nspawn/nspawn-seccomp.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <linux/netlink.h>
   5 #include <sys/capability.h>
   6 #include <sys/socket.h>
   7 #include <sys/types.h>
   8
   9 #if HAVE_SECCOMP
  10 #include <seccomp.h>
  11 #endif
  12
  13 #include "alloc-util.h"
  14 #include "log.h"
  15 #include "nspawn-seccomp.h"
  16 #if HAVE_SECCOMP
  17 #include "seccomp-util.h"
  18 #endif
  19 #include "string-util.h"
  20 #include "strv.h"
  21
  22 #if HAVE_SECCOMP
  23
  24 static int seccomp_add_default_syscall_filter(
  25                 scmp_filter_ctx ctx,
  26                 uint32_t arch,
  27                 uint64_t cap_list_retain,
  28                 char **syscall_allow_list,
  29                 char **syscall_deny_list) {
  30
  31         static const struct {
  32                 uint64_t capability;
  33                 const char* name;
  34         } allow_list[] = {
  35                 /* Let's use set names where we can */
  36                 { 0,                  "@aio"                   },
  37                 { 0,                  "@basic-io"              },
  38                 { 0,                  "@chown"                 },
  39                 { 0,                  "@default"               },
  40                 { 0,                  "@file-system"           },
  41                 { 0,                  "@io-event"              },
  42                 { 0,                  "@ipc"                   },
  43                 { 0,                  "@mount"                 },
  44                 { 0,                  "@network-io"            },
  45                 { 0,                  "@process"               },
  46                 { 0,                  "@resources"             },
  47                 { 0,                  "@setuid"                },
  48                 { 0,                  "@signal"                },
  49                 { 0,                  "@sync"                  },
  50                 { 0,                  "@timer"                 },
  51
  52                 /* The following four are sets we optionally enable, in case the caps have been configured for it */
  53                 { CAP_SYS_TIME,       "@clock"                 },
  54                 { CAP_SYS_MODULE,     "@module"                },
  55                 { CAP_SYS_RAWIO,      "@raw-io"                },
  56                 { CAP_IPC_LOCK,       "@memlock"               },
  57
  58                 /* Plus a good set of additional syscalls which are not part of any of the groups above */
  59                 { 0,                  "brk"                    },
  60                 { 0,                  "capget"                 },
  61                 { 0,                  "capset"                 },
  62                 { 0,                  "copy_file_range"        },
  63                 { 0,                  "fadvise64"              },
  64                 { 0,                  "fadvise64_64"           },
  65                 { 0,                  "flock"                  },
  66                 { 0,                  "get_mempolicy"          },
  67                 { 0,                  "getcpu"                 },
  68                 { 0,                  "getpriority"            },
  69                 { 0,                  "getrandom"              },
  70                 { 0,                  "ioctl"                  },
  71                 { 0,                  "ioprio_get"             },
  72                 { 0,                  "kcmp"                   },
  73                 { 0,                  "madvise"                },
  74                 { 0,                  "mincore"                },
  75                 { 0,                  "mprotect"               },
  76                 { 0,                  "mremap"                 },
  77                 { 0,                  "name_to_handle_at"      },
  78                 { 0,                  "oldolduname"            },
  79                 { 0,                  "olduname"               },
  80                 { 0,                  "personality"            },
  81                 { 0,                  "readahead"              },
  82                 { 0,                  "readdir"                },
  83                 { 0,                  "remap_file_pages"       },
  84                 { 0,                  "sched_get_priority_max" },
  85                 { 0,                  "sched_get_priority_min" },
  86                 { 0,                  "sched_getaffinity"      },
  87                 { 0,                  "sched_getattr"          },
  88                 { 0,                  "sched_getparam"         },
  89                 { 0,                  "sched_getscheduler"     },
  90                 { 0,                  "sched_rr_get_interval"  },
  91                 { 0,                  "sched_yield"            },
  92                 { 0,                  "seccomp"                },
  93                 { 0,                  "sendfile"               },
  94                 { 0,                  "sendfile64"             },
  95                 { 0,                  "setdomainname"          },
  96                 { 0,                  "setfsgid"               },
  97                 { 0,                  "setfsgid32"             },
  98                 { 0,                  "setfsuid"               },
  99                 { 0,                  "setfsuid32"             },
 100                 { 0,                  "sethostname"            },
 101                 { 0,                  "setpgid"                },
 102                 { 0,                  "setsid"                 },
 103                 { 0,                  "splice"                 },
 104                 { 0,                  "sysinfo"                },
 105                 { 0,                  "tee"                    },
 106                 { 0,                  "umask"                  },
 107                 { 0,                  "uname"                  },
 108                 { 0,                  "userfaultfd"            },
 109                 { 0,                  "vmsplice"               },
 110
 111                 /* The following individual syscalls are added depending on specified caps */
 112                 { CAP_SYS_PACCT,      "acct"                   },
 113                 { CAP_SYS_PTRACE,     "process_vm_readv"       },
 114                 { CAP_SYS_PTRACE,     "process_vm_writev"      },
 115                 { CAP_SYS_PTRACE,     "ptrace"                 },
 116                 { CAP_SYS_BOOT,       "reboot"                 },
 117                 { CAP_SYSLOG,         "syslog"                 },
 118                 { CAP_SYS_TTY_CONFIG, "vhangup"                },
 119
 120                 /*
 121                  * The following syscalls and groups are knowingly excluded:
 122                  *
 123                  * @cpu-emulation
 124                  * @keyring           (NB: keyring is not namespaced!)
 125                  * @obsolete
 126                  * @pkey
 127                  * @swap
 128                  *
 129                  * bpf                (NB: bpffs is not namespaced!)
 130                  * fanotify_init
 131                  * fanotify_mark
 132                  * kexec_file_load
 133                  * kexec_load
 134                  * lookup_dcookie
 135                  * nfsservctl
 136                  * open_by_handle_at
 137                  * perf_event_open
 138                  * quotactl
 139                  */
 140         };
 141
 142         char **p;
 143         int r;
 144
 145         for (size_t i = 0; i < ELEMENTSOF(allow_list); i++) {
 146                 if (allow_list[i].capability != 0 && (cap_list_retain & (1ULL << allow_list[i].capability)) == 0)
 147                         continue;
 148
 149                 r = seccomp_add_syscall_filter_item(ctx, allow_list[i].name, SCMP_ACT_ALLOW, syscall_deny_list, false);
 150                 if (r < 0)
 151                         return log_error_errno(r, "Failed to add syscall filter item %s: %m", allow_list[i].name);
 152         }
 153
 154         STRV_FOREACH(p, syscall_allow_list) {
 155                 r = seccomp_add_syscall_filter_item(ctx, *p, SCMP_ACT_ALLOW, syscall_deny_list, true);
 156                 if (r < 0)
 157                         log_warning_errno(r, "Failed to add rule for system call %s on %s, ignoring: %m",
 158                                           *p, seccomp_arch_to_string(arch));
 159         }
 160
 161         return 0;
 162 }
 163
 164 int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **syscall_deny_list) {
 165         uint32_t arch;
 166         int r;
 167
 168         if (!is_seccomp_available()) {
 169                 log_debug("SECCOMP features not detected in the kernel, disabling SECCOMP filterering");
 170                 return 0;
 171         }
 172
 173         SECCOMP_FOREACH_LOCAL_ARCH(arch) {
 174                 _cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
 175
 176                 log_debug("Applying allow list on architecture: %s", seccomp_arch_to_string(arch));
 177
 178                 r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ERRNO(EPERM));
 179                 if (r < 0)
 180                         return log_error_errno(r, "Failed to allocate seccomp object: %m");
 181
 182                 r = seccomp_add_default_syscall_filter(seccomp, arch, cap_list_retain, syscall_allow_list, syscall_deny_list);
 183                 if (r < 0)
 184                         return r;
 185
 186                 r = seccomp_load(seccomp);
 187                 if (ERRNO_IS_SECCOMP_FATAL(r))
 188                         return log_error_errno(r, "Failed to install seccomp filter: %m");
 189                 if (r < 0)
 190                         log_debug_errno(r, "Failed to install filter set for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
 191         }
 192
 193         SECCOMP_FOREACH_LOCAL_ARCH(arch) {
 194                 _cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
 195
 196                 log_debug("Applying NETLINK_AUDIT mask on architecture: %s", seccomp_arch_to_string(arch));
 197
 198                 r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ALLOW);
 199                 if (r < 0)
 200                         return log_error_errno(r, "Failed to allocate seccomp object: %m");
 201
 202                 /*
 203                   Audit is broken in containers, much of the userspace audit hookup will fail if running inside a
 204                   container. We don't care and just turn off creation of audit sockets.
 205
 206                   This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOSUPPORT which audit userspace uses
 207                   as indication that audit is disabled in the kernel.
 208                 */
 209
 210                 r = seccomp_rule_add_exact(
 211                                 seccomp,
 212                                 SCMP_ACT_ERRNO(EAFNOSUPPORT),
 213                                 SCMP_SYS(socket),
 214                                 2,
 215                                 SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
 216                                 SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
 217                 if (r < 0) {
 218                         log_debug_errno(r, "Failed to add audit seccomp rule, ignoring: %m");
 219                         continue;
 220                 }
 221
 222                 r = seccomp_load(seccomp);
 223                 if (ERRNO_IS_SECCOMP_FATAL(r))
 224                         return log_error_errno(r, "Failed to install seccomp audit filter: %m");
 225                 if (r < 0)
 226                         log_debug_errno(r, "Failed to install filter set for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
 227         }
 228
 229         return 0;
 230 }
 231
 232 #else
 233
 234 int setup_seccomp(uint64_t cap_list_retain, char **syscall_allow_list, char **syscall_deny_list) {
 235         return 0;
 236 }
 237
 238 #endif