diff options
Diffstat (limited to 'container')
| -rw-r--r-- | container/mount.go | 2 | ||||
| -rw-r--r-- | container/seccomp/presets.go | 159 | ||||
| -rw-r--r-- | container/syscall.go | 2 | ||||
| -rw-r--r-- | container/syscall_386.go | 7 | ||||
| -rw-r--r-- | container/syscall_amd64.go | 7 |
5 files changed, 83 insertions, 94 deletions
diff --git a/container/mount.go b/container/mount.go index 84415fa8..978b90a9 100644 --- a/container/mount.go +++ b/container/mount.go @@ -123,7 +123,7 @@ func (p procPaths) remount(msg message.Msg, target string, flags uintptr) error { var destFd int if err := ext.IgnoringEINTR(func() (err error) { - destFd, err = p.k.open(targetFinal, O_PATH|O_CLOEXEC, 0) + destFd, err = p.k.open(targetFinal, ext.O_PATH|O_CLOEXEC, 0) return }); err != nil { return &os.PathError{Op: "open", Path: targetFinal, Err: err} diff --git a/container/seccomp/presets.go b/container/seccomp/presets.go index 4b76af61..252bf9f1 100644 --- a/container/seccomp/presets.go +++ b/container/seccomp/presets.go @@ -3,7 +3,7 @@ package seccomp /* flatpak commit 4c3bf179e2e4a2a298cd1db1d045adaf3f564532 */ import ( - . "syscall" + "syscall" . "hakurei.app/container/std" . "hakurei.app/ext" @@ -69,121 +69,124 @@ func Preset(presets FilterPreset, flags ExportFlag) (rules []NativeRule) { var ( presetCommon = []NativeRule{ /* Block dmesg */ - {Syscall: SNR_SYSLOG, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_SYSLOG, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* Useless old syscall */ - {Syscall: SNR_USELIB, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_USELIB, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* Don't allow disabling accounting */ - {Syscall: SNR_ACCT, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_ACCT, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* Don't allow reading current quota use */ - {Syscall: SNR_QUOTACTL, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_QUOTACTL, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* Don't allow access to the kernel keyring */ - {Syscall: SNR_ADD_KEY, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_KEYCTL, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_REQUEST_KEY, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_ADD_KEY, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_KEYCTL, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_REQUEST_KEY, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* Scary VM/NUMA ops */ - {Syscall: SNR_MOVE_PAGES, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_MBIND, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_GET_MEMPOLICY, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SET_MEMPOLICY, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_MIGRATE_PAGES, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_MOVE_PAGES, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_MBIND, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_GET_MEMPOLICY, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SET_MEMPOLICY, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_MIGRATE_PAGES, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, } /* hakurei: project-specific extensions */ presetCommonExt = []NativeRule{ /* system calls for changing the system clock */ - {Syscall: SNR_ADJTIMEX, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_CLOCK_ADJTIME, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_CLOCK_ADJTIME64, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_CLOCK_SETTIME, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_CLOCK_SETTIME64, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETTIMEOFDAY, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_ADJTIMEX, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_CLOCK_ADJTIME, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_CLOCK_ADJTIME64, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_CLOCK_SETTIME, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_CLOCK_SETTIME64, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETTIMEOFDAY, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* loading and unloading of kernel modules */ - {Syscall: SNR_DELETE_MODULE, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_FINIT_MODULE, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_INIT_MODULE, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_DELETE_MODULE, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_FINIT_MODULE, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_INIT_MODULE, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* system calls for rebooting and reboot preparation */ - {Syscall: SNR_KEXEC_FILE_LOAD, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_KEXEC_LOAD, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_REBOOT, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_KEXEC_FILE_LOAD, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_KEXEC_LOAD, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_REBOOT, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* system calls for enabling/disabling swap devices */ - {Syscall: SNR_SWAPOFF, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SWAPON, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_SWAPOFF, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SWAPON, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, } presetNamespace = []NativeRule{ /* Don't allow subnamespace setups: */ - {Syscall: SNR_UNSHARE, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETNS, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_MOUNT, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_UMOUNT, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_UMOUNT2, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_PIVOT_ROOT, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_CHROOT, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_CLONE, Errno: ScmpErrno(EPERM), - Arg: &ScmpArgCmp{Arg: cloneArg, Op: SCMP_CMP_MASKED_EQ, DatumA: CLONE_NEWUSER, DatumB: CLONE_NEWUSER}}, + {Syscall: SNR_UNSHARE, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETNS, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_MOUNT, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_UMOUNT, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_UMOUNT2, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_PIVOT_ROOT, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_CHROOT, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_CLONE, Errno: ScmpErrno(syscall.EPERM), + Arg: &ScmpArgCmp{Arg: cloneArg, Op: SCMP_CMP_MASKED_EQ, + DatumA: syscall.CLONE_NEWUSER, DatumB: syscall.CLONE_NEWUSER}}, /* seccomp can't look into clone3()'s struct clone_args to check whether * the flags are OK, so we have no choice but to block clone3(). - * Return ENOSYS so user-space will fall back to clone(). + * Return syscall.ENOSYS so user-space will fall back to clone(). * (CVE-2021-41133; see also https://github.com/moby/moby/commit/9f6b562d) */ - {Syscall: SNR_CLONE3, Errno: ScmpErrno(ENOSYS), Arg: nil}, + {Syscall: SNR_CLONE3, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, /* New mount manipulation APIs can also change our VFS. There's no * legitimate reason to do these in the sandbox, so block all of them * rather than thinking about which ones might be dangerous. * (CVE-2021-41133) */ - {Syscall: SNR_OPEN_TREE, Errno: ScmpErrno(ENOSYS), Arg: nil}, - {Syscall: SNR_MOVE_MOUNT, Errno: ScmpErrno(ENOSYS), Arg: nil}, - {Syscall: SNR_FSOPEN, Errno: ScmpErrno(ENOSYS), Arg: nil}, - {Syscall: SNR_FSCONFIG, Errno: ScmpErrno(ENOSYS), Arg: nil}, - {Syscall: SNR_FSMOUNT, Errno: ScmpErrno(ENOSYS), Arg: nil}, - {Syscall: SNR_FSPICK, Errno: ScmpErrno(ENOSYS), Arg: nil}, - {Syscall: SNR_MOUNT_SETATTR, Errno: ScmpErrno(ENOSYS), Arg: nil}, + {Syscall: SNR_OPEN_TREE, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, + {Syscall: SNR_MOVE_MOUNT, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, + {Syscall: SNR_FSOPEN, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, + {Syscall: SNR_FSCONFIG, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, + {Syscall: SNR_FSMOUNT, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, + {Syscall: SNR_FSPICK, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, + {Syscall: SNR_MOUNT_SETATTR, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, } /* hakurei: project-specific extensions */ presetNamespaceExt = []NativeRule{ /* changing file ownership */ - {Syscall: SNR_CHOWN, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_CHOWN32, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_FCHOWN, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_FCHOWN32, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_FCHOWNAT, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_LCHOWN, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_LCHOWN32, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_CHOWN, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_CHOWN32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_FCHOWN, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_FCHOWN32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_FCHOWNAT, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_LCHOWN, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_LCHOWN32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* system calls for changing user ID and group ID credentials */ - {Syscall: SNR_SETGID, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETGID32, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETGROUPS, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETGROUPS32, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETREGID, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETREGID32, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETRESGID, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETRESGID32, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETRESUID, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETRESUID32, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETREUID, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETREUID32, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETUID, Errno: ScmpErrno(EPERM), Arg: nil}, - {Syscall: SNR_SETUID32, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_SETGID, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETGID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETGROUPS, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETGROUPS32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETREGID, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETREGID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETRESGID, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETRESGID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETRESUID, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETRESUID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETREUID, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETREUID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETUID, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, + {Syscall: SNR_SETUID32, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, } presetTTY = []NativeRule{ /* Don't allow faking input to the controlling tty (CVE-2017-5226) */ - {Syscall: SNR_IOCTL, Errno: ScmpErrno(EPERM), - Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, DatumA: 0xFFFFFFFF, DatumB: TIOCSTI}}, + {Syscall: SNR_IOCTL, Errno: ScmpErrno(syscall.EPERM), + Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, + DatumA: 0xFFFFFFFF, DatumB: syscall.TIOCSTI}}, /* In the unlikely event that the controlling tty is a Linux virtual * console (/dev/tty2 or similar), copy/paste operations have an effect * similar to TIOCSTI (CVE-2023-28100) */ - {Syscall: SNR_IOCTL, Errno: ScmpErrno(EPERM), - Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, DatumA: 0xFFFFFFFF, DatumB: TIOCLINUX}}, + {Syscall: SNR_IOCTL, Errno: ScmpErrno(syscall.EPERM), + Arg: &ScmpArgCmp{Arg: 1, Op: SCMP_CMP_MASKED_EQ, + DatumA: 0xFFFFFFFF, DatumB: syscall.TIOCLINUX}}, } presetEmu = []NativeRule{ @@ -191,15 +194,15 @@ var ( * so it's disabled as a hardening measure. * However, it is required to run old 16-bit applications * as well as some Wine patches, so it's allowed in multiarch. */ - {Syscall: SNR_MODIFY_LDT, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_MODIFY_LDT, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, } /* hakurei: project-specific extensions */ presetEmuExt = []NativeRule{ - {Syscall: SNR_SUBPAGE_PROT, Errno: ScmpErrno(ENOSYS), Arg: nil}, - {Syscall: SNR_SWITCH_ENDIAN, Errno: ScmpErrno(ENOSYS), Arg: nil}, - {Syscall: SNR_VM86, Errno: ScmpErrno(ENOSYS), Arg: nil}, - {Syscall: SNR_VM86OLD, Errno: ScmpErrno(ENOSYS), Arg: nil}, + {Syscall: SNR_SUBPAGE_PROT, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, + {Syscall: SNR_SWITCH_ENDIAN, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, + {Syscall: SNR_VM86, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, + {Syscall: SNR_VM86OLD, Errno: ScmpErrno(syscall.ENOSYS), Arg: nil}, } ) @@ -207,11 +210,11 @@ func presetDevel(allowedPersonality ScmpDatum) []NativeRule { return []NativeRule{ /* Profiling operations; we expect these to be done by tools from outside * the sandbox. In particular perf has been the source of many CVEs. */ - {Syscall: SNR_PERF_EVENT_OPEN, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_PERF_EVENT_OPEN, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, /* Don't allow you to switch to bsd emulation or whatnot */ - {Syscall: SNR_PERSONALITY, Errno: ScmpErrno(EPERM), + {Syscall: SNR_PERSONALITY, Errno: ScmpErrno(syscall.EPERM), Arg: &ScmpArgCmp{Arg: 0, Op: SCMP_CMP_NE, DatumA: allowedPersonality}}, - {Syscall: SNR_PTRACE, Errno: ScmpErrno(EPERM), Arg: nil}, + {Syscall: SNR_PTRACE, Errno: ScmpErrno(syscall.EPERM), Arg: nil}, } } diff --git a/container/syscall.go b/container/syscall.go index e008ecea..43e49bea 100644 --- a/container/syscall.go +++ b/container/syscall.go @@ -9,7 +9,7 @@ import ( // setNoNewPrivs sets the calling thread's no_new_privs attribute. func setNoNewPrivs() error { - return ext.Prctl(PR_SET_NO_NEW_PRIVS, 1, 0) + return ext.Prctl(ext.PR_SET_NO_NEW_PRIVS, 1, 0) } // schedParam is equivalent to struct sched_param from include/linux/sched.h. diff --git a/container/syscall_386.go b/container/syscall_386.go deleted file mode 100644 index 4b8e2df3..00000000 --- a/container/syscall_386.go +++ /dev/null @@ -1,7 +0,0 @@ -package container - -const ( - O_PATH = 0x200000 - - PR_SET_NO_NEW_PRIVS = 0x26 -) diff --git a/container/syscall_amd64.go b/container/syscall_amd64.go deleted file mode 100644 index 4b8e2df3..00000000 --- a/container/syscall_amd64.go +++ /dev/null @@ -1,7 +0,0 @@ -package container - -const ( - O_PATH = 0x200000 - - PR_SET_NO_NEW_PRIVS = 0x26 -) |