src/nspawn/nspawn-seccomp.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2016 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <errno.h>
  21 #include <linux/netlink.h>
  22 #include <sys/capability.h>
  23 #include <sys/types.h>
  24
  25 #ifdef HAVE_SECCOMP
  26 #include <seccomp.h>
  27 #endif
  28
  29 #include "alloc-util.h"
  30 #include "log.h"
  31 #include "nspawn-seccomp.h"
  32 #ifdef HAVE_SECCOMP
  33 #include "seccomp-util.h"
  34 #endif
  35 #include "string-util.h"
  36
  37 #ifdef HAVE_SECCOMP
  38
  39 static int seccomp_add_default_syscall_filter(
  40                 scmp_filter_ctx ctx,
  41                 uint32_t arch,
  42                 uint64_t cap_list_retain) {
  43
  44         static const struct {
  45                 uint64_t capability;
  46                 const char* name;
  47         } blacklist[] = {
  48                 { 0,              "_sysctl"             }, /* obsolete syscall */
  49                 { 0,              "add_key"             }, /* keyring is not namespaced */
  50                 { 0,              "afs_syscall"         }, /* obsolete syscall */
  51                 { 0,              "bdflush"             },
  52 #ifdef __NR_bpf
  53                 { 0,              "bpf"                 },
  54 #endif
  55                 { 0,              "break"               }, /* obsolete syscall */
  56                 { 0,              "create_module"       }, /* obsolete syscall */
  57                 { 0,              "ftime"               }, /* obsolete syscall */
  58                 { 0,              "get_kernel_syms"     }, /* obsolete syscall */
  59                 { 0,              "getpmsg"             }, /* obsolete syscall */
  60                 { 0,              "gtty"                }, /* obsolete syscall */
  61 #ifdef __NR_kexec_file_load
  62                 { 0,              "kexec_file_load"     },
  63 #endif
  64                 { 0,              "kexec_load"          },
  65                 { 0,              "keyctl"              }, /* keyring is not namespaced */
  66                 { 0,              "lock"                }, /* obsolete syscall */
  67                 { 0,              "lookup_dcookie"      },
  68                 { 0,              "mpx"                 }, /* obsolete syscall */
  69                 { 0,              "nfsservctl"          }, /* obsolete syscall */
  70                 { 0,              "open_by_handle_at"   },
  71                 { 0,              "perf_event_open"     },
  72                 { 0,              "prof"                }, /* obsolete syscall */
  73                 { 0,              "profil"              }, /* obsolete syscall */
  74                 { 0,              "putpmsg"             }, /* obsolete syscall */
  75                 { 0,              "query_module"        }, /* obsolete syscall */
  76                 { 0,              "quotactl"            },
  77                 { 0,              "request_key"         }, /* keyring is not namespaced */
  78                 { 0,              "security"            }, /* obsolete syscall */
  79                 { 0,              "sgetmask"            }, /* obsolete syscall */
  80                 { 0,              "ssetmask"            }, /* obsolete syscall */
  81                 { 0,              "stty"                }, /* obsolete syscall */
  82                 { 0,              "swapoff"             },
  83                 { 0,              "swapon"              },
  84                 { 0,              "sysfs"               }, /* obsolete syscall */
  85                 { 0,              "tuxcall"             }, /* obsolete syscall */
  86                 { 0,              "ulimit"              }, /* obsolete syscall */
  87                 { 0,              "uselib"              }, /* obsolete syscall */
  88                 { 0,              "ustat"               }, /* obsolete syscall */
  89                 { 0,              "vserver"             }, /* obsolete syscall */
  90                 { CAP_SYSLOG,     "syslog"              },
  91                 { CAP_SYS_MODULE, "delete_module"       },
  92                 { CAP_SYS_MODULE, "finit_module"        },
  93                 { CAP_SYS_MODULE, "init_module"         },
  94                 { CAP_SYS_PACCT,  "acct"                },
  95                 { CAP_SYS_PTRACE, "process_vm_readv"    },
  96                 { CAP_SYS_PTRACE, "process_vm_writev"   },
  97                 { CAP_SYS_PTRACE, "ptrace"              },
  98                 { CAP_SYS_RAWIO,  "ioperm"              },
  99                 { CAP_SYS_RAWIO,  "iopl"                },
 100                 { CAP_SYS_RAWIO,  "pciconfig_iobase"    },
 101                 { CAP_SYS_RAWIO,  "pciconfig_read"      },
 102                 { CAP_SYS_RAWIO,  "pciconfig_write"     },
 103 #ifdef __NR_s390_pci_mmio_read
 104                 { CAP_SYS_RAWIO,  "s390_pci_mmio_read"  },
 105 #endif
 106 #ifdef __NR_s390_pci_mmio_write
 107                 { CAP_SYS_RAWIO,  "s390_pci_mmio_write" },
 108 #endif
 109                 { CAP_SYS_TIME,   "adjtimex"            },
 110                 { CAP_SYS_TIME,   "clock_adjtime"       },
 111                 { CAP_SYS_TIME,   "clock_settime"       },
 112                 { CAP_SYS_TIME,   "settimeofday"        },
 113                 { CAP_SYS_TIME,   "stime"               },
 114         };
 115
 116         int r, c = 0;
 117         size_t i;
 118
 119         for (i = 0; i < ELEMENTSOF(blacklist); i++) {
 120                 if (blacklist[i].capability != 0 && (cap_list_retain & (1ULL << blacklist[i].capability)))
 121                         continue;
 122
 123                 r = seccomp_add_syscall_filter_item(ctx, blacklist[i].name, SCMP_ACT_ERRNO(EPERM));
 124                 if (r < 0)
 125                         /* If the system call is not known on this architecture, then that's fine, let's ignore it */
 126                         log_debug_errno(r, "Failed to add rule for system call %s, ignoring: %m", blacklist[i].name);
 127                 else
 128                         c++;
 129         }
 130
 131         return c;
 132 }
 133
 134 int setup_seccomp(uint64_t cap_list_retain) {
 135         uint32_t arch;
 136         int r;
 137
 138         if (!is_seccomp_available()) {
 139                 log_debug("SECCOMP features not detected in the kernel, disabling SECCOMP audit filter");
 140                 return 0;
 141         }
 142
 143         SECCOMP_FOREACH_LOCAL_ARCH(arch) {
 144                 _cleanup_(seccomp_releasep) scmp_filter_ctx seccomp = NULL;
 145                 int n;
 146
 147                 log_debug("Operating on architecture: %s", seccomp_arch_to_string(arch));
 148
 149                 r = seccomp_init_for_arch(&seccomp, arch, SCMP_ACT_ALLOW);
 150                 if (r < 0)
 151                         return log_error_errno(r, "Failed to allocate seccomp object: %m");
 152
 153                 n = seccomp_add_default_syscall_filter(seccomp, arch, cap_list_retain);
 154                 if (n < 0)
 155                         return n;
 156
 157                 /*
 158                   Audit is broken in containers, much of the userspace audit hookup will fail if running inside a
 159                   container. We don't care and just turn off creation of audit sockets.
 160
 161                   This will make socket(AF_NETLINK, *, NETLINK_AUDIT) fail with EAFNOSUPPORT which audit userspace uses
 162                   as indication that audit is disabled in the kernel.
 163                 */
 164
 165                 r = seccomp_rule_add_exact(
 166                                 seccomp,
 167                                 SCMP_ACT_ERRNO(EAFNOSUPPORT),
 168                                 SCMP_SYS(socket),
 169                                 2,
 170                                 SCMP_A0(SCMP_CMP_EQ, AF_NETLINK),
 171                                 SCMP_A2(SCMP_CMP_EQ, NETLINK_AUDIT));
 172                 if (r < 0)
 173                         log_debug_errno(r, "Failed to add audit seccomp rule, ignoring: %m");
 174                 else
 175                         n++;
 176
 177                 if (n <= 0) /* no rule added? then skip this architecture */
 178                         continue;
 179
 180                 r = seccomp_load(seccomp);
 181                 if (IN_SET(r, -EPERM, -EACCES))
 182                         return log_error_errno(r, "Failed to install seccomp audit filter: %m");
 183                 if (r < 0)
 184                         log_debug_errno(r, "Failed to install filter set for architecture %s, skipping: %m", seccomp_arch_to_string(arch));
 185         }
 186
 187         return 0;
 188 }
 189
 190 #else
 191
 192 int setup_seccomp(uint64_t cap_list_retain) {
 193         return 0;
 194 }
 195
 196 #endif