Improve seccomp support for non-x86 architectures

6 files changed, 77 insertions, 23 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 435b9527d..60a43a600 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -54,15 +54,15 @@
 
 #define RUN_SECCOMP_PROTOCOL    "/run/firejail/mnt/seccomp.protocol"    // protocol filter
 #define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp"                     // configured filter
-#define RUN_SECCOMP_AMD64       "/run/firejail/mnt/seccomp.amd64"       // amd64 filter installed on i386 architectures
-#define RUN_SECCOMP_I386        "/run/firejail/mnt/seccomp.i386"                // i386 filter installed on amd64 architectures
+#define RUN_SECCOMP_64  "/run/firejail/mnt/seccomp.64"          // 64bit arch filter installed on 32bit architectures
+#define RUN_SECCOMP_32  "/run/firejail/mnt/seccomp.32"          // 32bit arch filter installed on 64bit architectures
 #define RUN_SECCOMP_MDWX        "/run/firejail/mnt/seccomp.mdwx"                // filter for memory-deny-write-execute
 #define RUN_SECCOMP_BLOCK_SECONDARY     "/run/firejail/mnt/seccomp.block_secondary"     // secondary arch blocking filter
 #define RUN_SECCOMP_POSTEXEC    "/run/firejail/mnt/seccomp.postexec"            // filter for post-exec library
 #define PATH_SECCOMP_DEFAULT (LIBDIR "/firejail/seccomp")                       // default filter built during make
 #define PATH_SECCOMP_DEFAULT_DEBUG (LIBDIR "/firejail/seccomp.debug")   // default filter built during make
-#define PATH_SECCOMP_AMD64 (LIBDIR "/firejail/seccomp.amd64")           // amd64 filter built during make
-#define PATH_SECCOMP_I386 (LIBDIR "/firejail/seccomp.i386")                     // i386 filter built during make
+#define PATH_SECCOMP_64 (LIBDIR "/firejail/seccomp.64")                 // 64bit arch filter built during make
+#define PATH_SECCOMP_32 (LIBDIR "/firejail/seccomp.32")                 // 32bit arch filter built during make
 #define PATH_SECCOMP_MDWX (LIBDIR "/firejail/seccomp.mdwx")             // filter for memory-deny-write-execute built during make
 #define PATH_SECCOMP_BLOCK_SECONDARY (LIBDIR "/firejail/seccomp.block_secondary")       // secondary arch blocking filter built during make
 
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c
index bf1ef0469..0b447e03b 100644
--- a/src/firejail/preproc.c
+++ b/src/firejail/preproc.c
@@ -79,8 +79,8 @@ void preproc_mount_mnt_dir(void) {
                         copy_file(PATH_SECCOMP_BLOCK_SECONDARY, RUN_SECCOMP_BLOCK_SECONDARY, getuid(), getgid(), 0644); // root needed
                 else {
                         //copy default seccomp files
-                        copy_file(PATH_SECCOMP_I386, RUN_SECCOMP_I386, getuid(), getgid(), 0644); // root needed
-                        copy_file(PATH_SECCOMP_AMD64, RUN_SECCOMP_AMD64, getuid(), getgid(), 0644); // root needed
+                        copy_file(PATH_SECCOMP_32, RUN_SECCOMP_32, getuid(), getgid(), 0644); // root needed
+                        copy_file(PATH_SECCOMP_64, RUN_SECCOMP_64, getuid(), getgid(), 0644); // root needed
                 }
                 if (arg_allow_debuggers)
                         copy_file(PATH_SECCOMP_DEFAULT_DEBUG, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 7b45e2574..e75863c3a 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -137,22 +137,22 @@ errexit:
         exit(1);
 }
 
-// i386 filter installed on amd64 architectures
-#if defined(__x86_64__)
+// 32 bit arch filter installed on 64 bit architectures
+#if defined(__LP64__)
 static void seccomp_filter_32(void) {
-        if (seccomp_load(RUN_SECCOMP_I386) == 0) {
+        if (seccomp_load(RUN_SECCOMP_32) == 0) {
                 if (arg_debug)
-                        printf("Dual i386/amd64 seccomp filter configured\n");
+                        printf("Dual 32/64 bit seccomp filter configured\n");
         }
 }
 #endif
 
-// amd64 filter installed on i386 architectures
-#if defined(__i386__)
+// 64 bit arch filter installed on 32 bit architectures
+#if defined(__ILP32__)
 static void seccomp_filter_64(void) {
-        if (seccomp_load(RUN_SECCOMP_AMD64) == 0) {
+        if (seccomp_load(RUN_SECCOMP_64) == 0) {
                 if (arg_debug)
-                        printf("Dual i386/amd64 seccomp filter configured\n");
+                        printf("Dual 32/64 bit seccomp filter configured\n");
         }
 }
 #endif
@@ -177,10 +177,10 @@ int seccomp_filter_drop(void) {
                         if (arg_seccomp_block_secondary)
                                 seccomp_filter_block_secondary();
                         else {
-#if defined(__x86_64__)
+#if defined(__LP64__)
                                 seccomp_filter_32();
 #endif
-#if defined(__i386__)
+#if defined(__ILP32__)
                                 seccomp_filter_64();
 #endif
                         }
@@ -190,10 +190,10 @@ int seccomp_filter_drop(void) {
                         if (arg_seccomp_block_secondary)
                                 seccomp_filter_block_secondary();
                         else {
-#if defined(__x86_64__)
+#if defined(__LP64__)
                                 seccomp_filter_32();
 #endif
-#if defined(__i386__)
+#if defined(__ILP32__)
                                 seccomp_filter_64();
 #endif
                         }
diff --git a/src/fseccomp/seccomp_print.c b/src/fseccomp/seccomp_print.c
index 3793e125d..e8df2bda5 100644
--- a/src/fseccomp/seccomp_print.c
+++ b/src/fseccomp/seccomp_print.c
@@ -90,7 +90,7 @@ static int detect_filter_type(void) {
         }
         
         
-        // testing for secondare amd64 filter
+        // testing for secondary 64 bit filter
         const struct sock_filter start_secondary_64[] = {
                 VALIDATE_ARCHITECTURE_64,
                 EXAMINE_SYSCALL,
@@ -102,7 +102,7 @@ static int detect_filter_type(void) {
                 return sizeof(start_secondary_64) / sizeof(struct sock_filter);
         }
         
-        // testing for secondare i386 filter
+        // testing for secondary 32 bit filter
         const struct sock_filter start_secondary_32[] = {
                 VALIDATE_ARCHITECTURE_32,
                 EXAMINE_SYSCALL,
diff --git a/src/fseccomp/seccomp_secondary.c b/src/fseccomp/seccomp_secondary.c
index dd69b58cc..da6a693e6 100644
--- a/src/fseccomp/seccomp_secondary.c
+++ b/src/fseccomp/seccomp_secondary.c
@@ -108,7 +108,7 @@ void seccomp_secondary_64(const char *fname) {
         write_filter(fname, sizeof(filter), filter);
 }
 
-// i386 filter installed on amd64 architectures
+// 32 bit arch filter installed on 64 bit architectures
 void seccomp_secondary_32(const char *fname) {
         // hardcoded syscall values
         struct sock_filter filter[] = {
diff --git a/src/include/seccomp.h b/src/include/seccomp.h
index 2f2b2384d..133b6ce72 100644
--- a/src/include/seccomp.h
+++ b/src/include/seccomp.h
@@ -91,10 +91,64 @@ struct seccomp_data {
 
 #if defined(__i386__)
 # define ARCH_NR        AUDIT_ARCH_I386
+# define ARCH_32        AUDIT_ARCH_I386
+# define ARCH_64        AUDIT_ARCH_X86_64
 #elif defined(__x86_64__)
 # define ARCH_NR        AUDIT_ARCH_X86_64
+# define ARCH_32        AUDIT_ARCH_I386
+# define ARCH_64        AUDIT_ARCH_X86_64
+#elif defined(__aarch64__)
+# define ARCH_NR        AUDIT_ARCH_AARCH64
+# define ARCH_32        AUDIT_ARCH_ARM
+# define ARCH_64        AUDIT_ARCH_AARCH64
 #elif defined(__arm__)
 # define ARCH_NR        AUDIT_ARCH_ARM
+# define ARCH_32        AUDIT_ARCH_ARM
+# define ARCH_64        AUDIT_ARCH_AARCH64
+#elif defined(__mips__) && __BYTE_ORDER == __BIG_ENDIAN && _MIPS_SIM == _MIPS_SIM_ABI32
+# define ARCH_NR        AUDIT_ARCH_MIPS
+# define ARCH_32        AUDIT_ARCH_MIPS
+# define ARCH_64        AUDIT_ARCH_MIPS64
+#elif defined(__mips__) && __BYTE_ORDER == __LITTLE_ENDIAN && _MIPS_SIM == _MIPS_SIM_ABI32
+# define ARCH_NR        AUDIT_ARCH_MIPSEL
+# define ARCH_32        AUDIT_ARCH_MIPSEL
+# define ARCH_64        AUDIT_ARCH_MIPSEL64
+#elif defined(__mips__) && __BYTE_ORDER == __BIG_ENDIAN && _MIPS_SIM == _MIPS_SIM_ABI64
+# define ARCH_NR        AUDIT_ARCH_MIPS64
+# define ARCH_32        AUDIT_ARCH_MIPS
+# define ARCH_64        AUDIT_ARCH_MIPS64
+#elif defined(__mips__) && __BYTE_ORDER == __LITTLE_ENDIAN && _MIPS_SIM == _MIPS_SIM_ABI64
+# define ARCH_NR        AUDIT_ARCH_MIPSEL64
+# define ARCH_32        AUDIT_ARCH_MIPSEL
+# define ARCH_64        AUDIT_ARCH_MIPSEL64
+#elif defined(__mips__) && __BYTE_ORDER == __BIG_ENDIAN && _MIPS_SIM == _MIPS_SIM_NABI32
+# define ARCH_NR        AUDIT_ARCH_MIPS64N32
+# define ARCH_32        AUDIT_ARCH_MIPS64N32
+# define ARCH_64        AUDIT_ARCH_MIPS64
+#elif defined(__mips__) && __BYTE_ORDER == __LITTLE_ENDIAN && _MIPS_SIM == _MIPS_SIM_NABI32
+# define ARCH_NR        AUDIT_ARCH_MIPSEL64N32
+# define ARCH_32        AUDIT_ARCH_MIPSEL64N32
+# define ARCH_64        AUDIT_ARCH_MIPSEL64
+#elif defined(__powerpc64__) && __BYTE_ORDER == __BIG_ENDIAN
+# define ARCH_NR        AUDIT_ARCH_PPC64
+# define ARCH_32        AUDIT_ARCH_PPC
+# define ARCH_64        AUDIT_ARCH_PPC64
+#elif defined(__powerpc64__) && __BYTE_ORDER == __LITTLE_ENDIAN
+# define ARCH_NR        AUDIT_ARCH_PPC64LE
+# define ARCH_32        AUDIT_ARCH_PPC
+# define ARCH_64        AUDIT_ARCH_PPC64LE
+#elif defined(__powerpc__)
+# define ARCH_NR        AUDIT_ARCH_PPC
+# define ARCH_32        AUDIT_ARCH_PPC
+# define ARCH_64        AUDIT_ARCH_PPC64LE
+#elif defined(__s390x__)
+# define ARCH_NR        AUDIT_ARCH_S390X
+# define ARCH_32        AUDIT_ARCH_S390
+# define ARCH_64        AUDIT_ARCH_S390X
+#elif defined(__s390__)
+# define ARCH_NR        AUDIT_ARCH_S390
+# define ARCH_32        AUDIT_ARCH_S390
+# define ARCH_64        AUDIT_ARCH_S390X
 #else
 # warning "Platform does not support seccomp filter yet"
 # define ARCH_NR        0
@@ -112,12 +166,12 @@ struct seccomp_data {
 
 #define VALIDATE_ARCHITECTURE_64 \
      BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, arch))), \
-     BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, AUDIT_ARCH_X86_64, 1, 0), \
+     BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_64, 1, 0), \
      BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 
 #define VALIDATE_ARCHITECTURE_32 \
      BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, arch))), \
-     BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, AUDIT_ARCH_I386, 1, 0), \
+     BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_32, 1, 0), \
      BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 
 #if defined(__x86_64__)