seccomp: allow defining separate filters for 32-bit arch

System calls (names and numbers) are not exactly the same for 32 bit
and 64 bit architectures. Let's allow defining separate filters for
32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This
is useful for mixed 64/32 bit application environments like Steam and
Wine.

Implement protocol and mdwx filtering also for 32 bit arch. It's still
better to block secondary archs completely if not needed.

Lists of supported system calls are also updated.

Warn if preload libraries would be needed due to trace, tracelog or
postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic
linker does not understand the 64 bit preload libraries.

Closes #3267.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>

4 files changed, 6 insertions, 52 deletions

diff --git a/src/fsec-print/Makefile.in b/src/fsec-print/Makefile.in
index f717af788..a30ff4ba3 100644
--- a/src/fsec-print/Makefile.in
+++ b/src/fsec-print/Makefile.in
@@ -5,8 +5,8 @@ include ../common.mk
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 
-fsec-print: $(OBJS) ../lib/libnetlink.o
-        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+fsec-print: $(OBJS) ../lib/libnetlink.o ../lib/errno.o ../lib/syscall.o
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS)
 
 clean:; rm -fr *.o fsec-print *.gcov *.gcda *.gcno *.plist
 
diff --git a/src/fsec-print/fsec_print.h b/src/fsec-print/fsec_print.h
index 0237fd020..337199288 100644
--- a/src/fsec-print/fsec_print.h
+++ b/src/fsec-print/fsec_print.h
@@ -21,12 +21,10 @@
 #define FSEC_PRINT_H
 #include "../include/common.h"
 #include "../include/seccomp.h"
+#include "../include/syscall.h"
 #include <sys/mman.h>
 
 // print.c
 void print(struct sock_filter *filter, int entries);
 
-// syscall_list.c
-const char *syscall_find_nr(int nr);
-
 #endif
diff --git a/src/fsec-print/main.c b/src/fsec-print/main.c
index 728308dac..7bb4fd0cd 100644
--- a/src/fsec-print/main.c
+++ b/src/fsec-print/main.c
@@ -24,6 +24,9 @@ static void usage(void) {
         printf("\tfsec-print file - disassemble seccomp filter\n");
 }
 
+int arg_quiet = 0;
+void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native) {}
+
 int main(int argc, char **argv) {
 #if 0
 {
diff --git a/src/fsec-print/syscall_list.c b/src/fsec-print/syscall_list.c
deleted file mode 100644
index 274908cef..000000000
--- a/src/fsec-print/syscall_list.c
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright (C) 2014-2020 Firejail Authors
- *
- * This file is part of firejail project
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-#include "fsec_print.h"
-#include <sys/syscall.h>
-
-typedef struct {
-        const char * const name;
-        int nr;
-} SyscallEntry;
-
-static const SyscallEntry syslist[] = {
-//
-// code generated using tools/extract-syscall
-//
-#include "../include/syscall.h"
-//
-// end of generated code
-//
-}; // end of syslist
-
-const char *syscall_find_nr(int nr) {
-        int i;
-        int elems = sizeof(syslist) / sizeof(syslist[0]);
-        for (i = 0; i < elems; i++) {
-                if (nr == syslist[i].nr)
-                        return syslist[i].name;
-        }
-
-        return NULL;
-}