proc/priv/shim: seccomp bpf filter via libseccomp

Rulesets adapted from Flatpak for compatibility.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 81 insertions, 0 deletions

diff --git a/internal/proc/priv/shim/seccomp.go b/internal/proc/priv/shim/seccomp.go
new file mode 100644
index 00000000..bf458742
--- /dev/null
+++ b/internal/proc/priv/shim/seccomp.go
@@ -0,0 +1,81 @@
+package shim
+
+/*
+#cgo linux pkg-config: --static libseccomp
+
+#include "export.h"
+*/
+import "C"
+import (
+	"errors"
+	"fmt"
+	"os"
+	"runtime"
+
+	"git.gensokyo.uk/security/fortify/internal/fmsg"
+)
+
+var resErr = [...]error{
+	0: nil,
+	1: errors.New("seccomp_init failed"),
+	2: errors.New("seccomp_arch_add failed"),
+	3: errors.New("seccomp_arch_add failed (multiarch)"),
+	4: errors.New("internal libseccomp failure"),
+	5: errors.New("seccomp_rule_add failed"),
+	6: errors.New("seccomp_export_bpf failed"),
+}
+
+type (
+	syscallOpts = C.f_syscall_opts
+)
+
+const (
+	flagDenyNS    syscallOpts = C.F_DENY_NS
+	flagDenyTTY   syscallOpts = C.F_DENY_TTY
+	flagDenyDevel syscallOpts = C.F_DENY_DEVEL
+	flagMultiarch syscallOpts = C.F_MULTIARCH
+	flagLinux32   syscallOpts = C.F_LINUX32
+	flagCan       syscallOpts = C.F_CAN
+	flagBluetooth syscallOpts = C.F_BLUETOOTH
+)
+
+func tmpfile() (*os.File, error) {
+	fd, err := C.f_tmpfile_fd()
+	if err != nil {
+		return nil, err
+	}
+	return os.NewFile(uintptr(fd), "tmpfile"), err
+}
+
+func exportFilter(fd uintptr, opts syscallOpts) error {
+	var (
+		arch      C.uint32_t = 0
+		multiarch C.uint32_t = 0
+	)
+	switch runtime.GOARCH {
+	case "386":
+		arch = C.SCMP_ARCH_X86
+	case "amd64":
+		arch = C.SCMP_ARCH_X86_64
+		multiarch = C.SCMP_ARCH_X86
+	case "arm":
+		arch = C.SCMP_ARCH_ARM
+	case "arm64":
+		arch = C.SCMP_ARCH_AARCH64
+		multiarch = C.SCMP_ARCH_ARM
+	}
+
+	res, err := C.f_export_bpf(C.int(fd), arch, multiarch, opts)
+	if re := resErr[res]; re != nil {
+		if err == nil {
+			return re
+		}
+		return fmt.Errorf("%s: %v", re.Error(), err)
+	}
+	return err
+}
+
+//export F_println
+func F_println(v *C.char) {
+	fmsg.VPrintln(C.GoString(v))
+}