seccomp: allow defining separate filters for 32-bit arch

System calls (names and numbers) are not exactly the same for 32 bit
and 64 bit architectures. Let's allow defining separate filters for
32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This
is useful for mixed 64/32 bit application environments like Steam and
Wine.

Implement protocol and mdwx filtering also for 32 bit arch. It's still
better to block secondary archs completely if not needed.

Lists of supported system calls are also updated.

Warn if preload libraries would be needed due to trace, tracelog or
postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic
linker does not understand the 64 bit preload libraries.

Closes #3267.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>

1 files changed, 70 insertions, 0 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index 78717ab41..922ba2edb 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -20,6 +20,7 @@
 #include "firejail.h"
 #include "../include/pid.h"
 #include "../include/firejail_user.h"
+#include "../include/syscall.h"
 #define _GNU_SOURCE
 #include <sys/utsname.h>
 #include <sched.h>
@@ -72,6 +73,7 @@ int arg_overlay_keep = 0;			// place overlay diff in a known directory
 int arg_overlay_reuse = 0;                      // allow the reuse of overlays
 
 int arg_seccomp = 0;                            // enable default seccomp filter
+int arg_seccomp32 = 0;                          // enable default seccomp filter for 32 bit arch
 int arg_seccomp_postexec = 0;                   // need postexec ld.preload library?
 int arg_seccomp_block_secondary = 0;            // block any secondary architectures
 
@@ -548,6 +550,14 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 else
                         exit_err_feature("seccomp");
         }
+        else if (strcmp(argv[i], "--debug-syscalls32") == 0) {
+                if (checkcfg(CFG_SECCOMP)) {
+                        int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSECCOMP_MAIN, "debug-syscalls32");
+                        exit(rv);
+                }
+                else
+                        exit_err_feature("seccomp");
+        }
         else if (strcmp(argv[i], "--debug-errnos") == 0) {
                 if (checkcfg(CFG_SECCOMP)) {
                         int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSECCOMP_MAIN, "debug-errnos");
@@ -956,6 +966,18 @@ static void run_builder(int argc, char **argv) {
         exit(1);
 }
 
+void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native) {}
+
+static int check_postexec(const char *list) {
+        char *prelist, *postlist;
+
+        if (list) {
+                syscalls_in_list(list, "@default-keep", -1, &prelist, &postlist, true);
+                if (postlist)
+                        return 1;
+        }
+        return 0;
+}
 
 //*******************************************
 // Main program
@@ -1263,6 +1285,18 @@ int main(int argc, char **argv) {
                         else
                                 exit_err_feature("seccomp");
                 }
+                else if (strncmp(argv[i], "--seccomp.32=", 13) == 0) {
+                        if (checkcfg(CFG_SECCOMP)) {
+                                if (arg_seccomp32) {
+                                        fprintf(stderr, "Error: seccomp.32 already enabled\n");
+                                        exit(1);
+                                }
+                                arg_seccomp32 = 1;
+                                cfg.seccomp_list32 = seccomp_check_list(argv[i] + 13);
+                        }
+                        else
+                                exit_err_feature("seccomp");
+                }
                 else if (strncmp(argv[i], "--seccomp.drop=", 15) == 0) {
                         if (checkcfg(CFG_SECCOMP)) {
                                 if (arg_seccomp) {
@@ -1275,6 +1309,18 @@ int main(int argc, char **argv) {
                         else
                                 exit_err_feature("seccomp");
                 }
+                else if (strncmp(argv[i], "--seccomp.32.drop=", 18) == 0) {
+                        if (checkcfg(CFG_SECCOMP)) {
+                                if (arg_seccomp32) {
+                                        fprintf(stderr, "Error: seccomp.32 already enabled\n");
+                                        exit(1);
+                                }
+                                arg_seccomp32 = 1;
+                                cfg.seccomp_list_drop32 = seccomp_check_list(argv[i] + 18);
+                        }
+                        else
+                                exit_err_feature("seccomp");
+                }
                 else if (strncmp(argv[i], "--seccomp.keep=", 15) == 0) {
                         if (checkcfg(CFG_SECCOMP)) {
                                 if (arg_seccomp) {
@@ -1287,8 +1333,24 @@ int main(int argc, char **argv) {
                         else
                                 exit_err_feature("seccomp");
                 }
+                else if (strncmp(argv[i], "--seccomp.32.keep=", 18) == 0) {
+                        if (checkcfg(CFG_SECCOMP)) {
+                                if (arg_seccomp32) {
+                                        fprintf(stderr, "Error: seccomp.32 already enabled\n");
+                                        exit(1);
+                                }
+                                arg_seccomp32 = 1;
+                                cfg.seccomp_list_keep32 = seccomp_check_list(argv[i] + 18);
+                        }
+                        else
+                                exit_err_feature("seccomp");
+                }
                 else if (strcmp(argv[i], "--seccomp.block-secondary") == 0) {
                         if (checkcfg(CFG_SECCOMP)) {
+                                if (arg_seccomp32) {
+                                        fprintf(stderr, "Error: seccomp.32 conflicts with block-secondary\n");
+                                        exit(1);
+                                }
                                 arg_seccomp_block_secondary = 1;
                         }
                         else
@@ -2542,6 +2604,14 @@ int main(int argc, char **argv) {
         // check network configuration options - it will exit if anything went wrong
         net_check_cfg();
 
+#ifdef HAVE_SECCOMP
+        if (arg_seccomp)
+                arg_seccomp_postexec = check_postexec(cfg.seccomp_list) || check_postexec(cfg.seccomp_list_drop);
+#endif
+        bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec;
+        if (need_preload && (cfg.seccomp_list32 || cfg.seccomp_list_drop32 || cfg.seccomp_list_keep32))
+                fwarning("preload libraries (trace, tracelog, postexecseccomp due to seccomp.drop=execve etc.) are incompatible with 32 bit filters\n");
+
         // check and assign an IP address - for macvlan it will be done again in the sandbox!
         if (any_bridge_configured()) {
                 EUID_ROOT();