|
@@ -67,6 +67,28 @@
|
|
#include <execinfo.h>
|
|
#include <execinfo.h>
|
|
#endif
|
|
#endif
|
|
|
|
|
|
|
|
+/**
|
|
|
|
+ * Linux 32 bit definitions
|
|
|
|
+ */
|
|
|
|
+#if defined(__i386__)
|
|
|
|
+
|
|
|
|
+#define REG_SYSCALL REG_EAX
|
|
|
|
+#define M_SYSCALL gregs[REG_SYSCALL]
|
|
|
|
+
|
|
|
|
+/**
|
|
|
|
+ * Linux 64 bit definitions
|
|
|
|
+ */
|
|
|
|
+#elif defined(__x86_64__)
|
|
|
|
+
|
|
|
|
+#define REG_SYSCALL REG_RAX
|
|
|
|
+#define M_SYSCALL gregs[REG_SYSCALL]
|
|
|
|
+
|
|
|
|
+#elif defined(__arm__)
|
|
|
|
+
|
|
|
|
+#define M_SYSCALL arm_r7
|
|
|
|
+
|
|
|
|
+#endif
|
|
|
|
+
|
|
/**Determines if at least one sandbox is active.*/
|
|
/**Determines if at least one sandbox is active.*/
|
|
static int sandbox_active = 0;
|
|
static int sandbox_active = 0;
|
|
/** Holds the parameter list configuration for the sandbox.*/
|
|
/** Holds the parameter list configuration for the sandbox.*/
|
|
@@ -113,7 +135,9 @@ static int filter_nopar_gen[] = {
|
|
#ifdef __NR_getgid32
|
|
#ifdef __NR_getgid32
|
|
SCMP_SYS(getgid32),
|
|
SCMP_SYS(getgid32),
|
|
#endif
|
|
#endif
|
|
|
|
+#ifdef __NR_getrlimt
|
|
SCMP_SYS(getrlimit),
|
|
SCMP_SYS(getrlimit),
|
|
|
|
+#endif
|
|
SCMP_SYS(gettimeofday),
|
|
SCMP_SYS(gettimeofday),
|
|
SCMP_SYS(gettid),
|
|
SCMP_SYS(gettid),
|
|
SCMP_SYS(getuid),
|
|
SCMP_SYS(getuid),
|
|
@@ -126,7 +150,10 @@ static int filter_nopar_gen[] = {
|
|
#endif
|
|
#endif
|
|
SCMP_SYS(mkdir),
|
|
SCMP_SYS(mkdir),
|
|
SCMP_SYS(mlockall),
|
|
SCMP_SYS(mlockall),
|
|
|
|
+#ifdef __NR_mmap
|
|
|
|
+ /* XXXX restrict this in the same ways as mmap2 */
|
|
SCMP_SYS(mmap),
|
|
SCMP_SYS(mmap),
|
|
|
|
+#endif
|
|
SCMP_SYS(munmap),
|
|
SCMP_SYS(munmap),
|
|
SCMP_SYS(read),
|
|
SCMP_SYS(read),
|
|
SCMP_SYS(rt_sigreturn),
|
|
SCMP_SYS(rt_sigreturn),
|
|
@@ -245,8 +272,12 @@ static int
|
|
sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
|
|
sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter)
|
|
{
|
|
{
|
|
(void) filter;
|
|
(void) filter;
|
|
|
|
+#ifdef __NR_time
|
|
return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time),
|
|
return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time),
|
|
SCMP_CMP(0, SCMP_CMP_EQ, 0));
|
|
SCMP_CMP(0, SCMP_CMP_EQ, 0));
|
|
|
|
+#else
|
|
|
|
+ return 0;
|
|
|
|
+#endif
|
|
}
|
|
}
|
|
|
|
|
|
/**
|
|
/**
|
|
@@ -1439,7 +1470,8 @@ install_syscall_filter(sandbox_cfg_t* cfg)
|
|
|
|
|
|
// loading the seccomp2 filter
|
|
// loading the seccomp2 filter
|
|
if ((rc = seccomp_load(ctx))) {
|
|
if ((rc = seccomp_load(ctx))) {
|
|
- log_err(LD_BUG, "(Sandbox) failed to load!");
|
|
|
|
|
|
+ log_err(LD_BUG, "(Sandbox) failed to load: %d (%s)!", rc,
|
|
|
|
+ strerror(-rc));
|
|
goto end;
|
|
goto end;
|
|
}
|
|
}
|
|
|
|
|
|
@@ -1499,7 +1531,7 @@ sigsys_debugging(int nr, siginfo_t *info, void *void_context)
|
|
if (!ctx)
|
|
if (!ctx)
|
|
return;
|
|
return;
|
|
|
|
|
|
- syscall = (int) ctx->uc_mcontext.gregs[REG_SYSCALL];
|
|
|
|
|
|
+ syscall = (int) ctx->uc_mcontext.M_SYSCALL;
|
|
|
|
|
|
#ifdef USE_BACKTRACE
|
|
#ifdef USE_BACKTRACE
|
|
depth = backtrace(syscall_cb_buf, MAX_DEPTH);
|
|
depth = backtrace(syscall_cb_buf, MAX_DEPTH);
|