dual i386/amd64 seccomp support for --seccomp option

6 files changed, 121 insertions, 11 deletions

diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c
index ba784fc2e..e71daaad8 100644
--- a/src/firejail/protocol.c
+++ b/src/firejail/protocol.c
@@ -18,6 +18,33 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 
+/*
+        struct sock_filter filter[] = {
+                VALIDATE_ARCHITECTURE,
+                EXAMINE_SYSCALL,
+                ONLY(SYS_socket),
+                EXAMINE_ARGUMENT(0), // allow only AF_INET and AF_INET6, drop everything else
+                WHITELIST(AF_INET),
+                WHITELIST(AF_INET6),
+                WHITELIST(AF_PACKET),
+                RETURN_ERRNO(ENOTSUP)
+        };
+        struct sock_fprog prog = {
+                .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])),
+                .filter = filter,
+        };
+
+
+        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
+                perror("prctl(NO_NEW_PRIVS)");
+                return 1;
+        }
+        if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
+                perror("prctl");
+                return 1;
+        }
+*/
+
 #ifdef HAVE_SECCOMP
 #include "firejail.h"
 #include "seccomp.h"
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 984059bf8..6ab3ae56e 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -337,6 +337,69 @@ static void read_seccomp_file(char *file_name) {
                 filter_debug();
 }
 
+// i386t filter installed on amd64 architectures
+void seccomp_filter_32(void) {
+        // hardcoded syscall values
+        struct sock_filter filter[] = {
+                VALIDATE_ARCHITECTURE_32,
+                EXAMINE_SYSCALL,
+                BLACKLIST(21), // mount
+                BLACKLIST(52), // umount2
+                BLACKLIST(26), // ptrace
+                BLACKLIST(283), // kexec_load
+                BLACKLIST(342), // open_by_handle_at
+                BLACKLIST(128), // init_module
+                BLACKLIST(350), // finit_module
+                BLACKLIST(129), // delete_module
+                BLACKLIST(110), // iopl
+                BLACKLIST(101), // ioperm
+                BLACKLIST(87), // swapon
+                BLACKLIST(115), // swapoff
+                BLACKLIST(103), // syslog
+                BLACKLIST(347), // process_vm_readv
+                BLACKLIST(348), // process_vm_writev
+                BLACKLIST(135), // sysfs
+                BLACKLIST(149), // _sysctl
+                BLACKLIST(124), // adjtimex
+                BLACKLIST(343), // clock_adjtime
+                BLACKLIST(253), // lookup_dcookie
+                BLACKLIST(336), // perf_event_open
+                BLACKLIST(338), // fanotify_init
+                BLACKLIST(349), // kcmp
+                BLACKLIST(286), // add_key
+                BLACKLIST(287), // request_key
+                BLACKLIST(288), // keyctl
+                BLACKLIST(86), // uselib
+                BLACKLIST(51), // acct
+                BLACKLIST(123), // modify_ldt
+                BLACKLIST(217), // pivot_root
+                BLACKLIST(245), // io_setup
+                BLACKLIST(246), // io_destroy
+                BLACKLIST(247), // io_getevents
+                BLACKLIST(248), // io_submit
+                BLACKLIST(249), // io_cancel
+                BLACKLIST(257), // remap_file_pages
+                BLACKLIST(274), // mbind
+                BLACKLIST(275), // get_mempolicy
+                BLACKLIST(276), // set_mempolicy
+                BLACKLIST(294), // migrate_pages
+                BLACKLIST(317), // move_pages
+                BLACKLIST(316), // vmsplice
+                RETURN_ALLOW
+        };
+
+        struct sock_fprog prog = {
+                .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])),
+                .filter = filter,
+        };
+
+        if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) || prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
+                ;
+        }
+        else if (arg_debug) {
+                printf("dual i386/amd64 seccomp filter\n");
+        }
+}
 
 // drop filter for seccomp option
 int seccomp_filter_drop(void) {
@@ -344,6 +407,10 @@ int seccomp_filter_drop(void) {
         
         // default seccomp
         if (cfg.seccomp_list_drop == NULL) {
+#if defined(__x86_64__)
+                seccomp_filter_32();
+#endif
+
 #ifdef SYS_mount                
                 filter_add_blacklist(SYS_mount, 0);
 #endif
diff --git a/src/firejail/seccomp.h b/src/firejail/seccomp.h
index b83fe87ce..6fbc6a590 100644
--- a/src/firejail/seccomp.h
+++ b/src/firejail/seccomp.h
@@ -29,26 +29,34 @@
                 BLACKLIST(SYS_kexec_load), // loading a different kernel
                 BLACKLIST(SYS_open_by_handle_at), // open by handle
                 BLACKLIST(SYS_init_module), // kernel module handling
-#ifdef SYS_finit_module // introduced in 2013
                 BLACKLIST(SYS_finit_module),
-#endif
                 BLACKLIST(SYS_delete_module),
                 BLACKLIST(SYS_iopl), // io permisions
-#ifdef SYS_ioperm
                 BLACKLIST(SYS_ioperm),
-#endif
-SYS_iopl
                 BLACKLIST(SYS_iopl), // io permisions
-#endif
-#ifdef SYS_ni_syscall), // new io permisions call on arm devices
                 BLACKLIST(SYS_ni_syscall),
-#endif
                 BLACKLIST(SYS_swapon), // swap on/off
                 BLACKLIST(SYS_swapoff),
                 BLACKLIST(SYS_syslog), // kernel printk control
                 RETURN_ALLOW
         };
+
+        struct sock_fprog prog = {
+                .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])),
+                .filter = filter,
+        };
+
+
+        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
+                perror("prctl(NO_NEW_PRIVS)");
+                return 1;
+        }
+        if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
+                perror("prctl");
+                return 1;
+        }
 */
+
 #ifndef SECCOMP_H
 #define SECCOMP_H
 #include <errno.h>
@@ -97,9 +105,9 @@ struct seccomp_data {
      BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
      BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 
-#define VALIDATE_ARCHITECTURE_32_64 \
+#define VALIDATE_ARCHITECTURE_32 \
      BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, arch))), \
-     BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
+     BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, AUDIT_ARCH_I386, 1, 0), \
      BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
 
 #define EXAMINE_SYSCALL BPF_STMT(BPF_LD+BPF_W+BPF_ABS,  \
diff --git a/src/tools/syscall_test b/src/tools/syscall_test
index 21db21ae0..bf29c5b99 100755
--- a/src/tools/syscall_test
+++ b/src/tools/syscall_test
diff --git a/src/tools/syscall_test.c b/src/tools/syscall_test.c
index 47c27978b..b3f43c755 100644
--- a/src/tools/syscall_test.c
+++ b/src/tools/syscall_test.c
@@ -5,10 +5,11 @@
 #include <sys/socket.h>
 #include <linux/netlink.h>
 #include <net/ethernet.h>
+#include <sys/mount.h>
 
 int main(int argc, char **argv) {
         if (argc != 2) {
-                printf("Usage: test [sleep|socket|mkdir]\n");
+                printf("Usage: test [sleep|socket|mkdir|mount]\n");
                 return 1;
         }
 
@@ -62,6 +63,13 @@ int main(int argc, char **argv) {
                 mkdir("tmp", 0777);
                 printf("after mkdir\n");
         }
+        else if (strcmp(argv[1], "mount") == 0) {
+                printf("before mount\n");
+                if (mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0) {
+                        perror("mount");
+                }
+                printf("after mount\n");
+        }
         else {
                 fprintf(stderr, "Error: invalid argument\n");
                 return 1;
diff --git a/src/tools/syscall_test32 b/src/tools/syscall_test32
index 5d027f5dd..8d72f58c4 100755
--- a/src/tools/syscall_test32
+++ b/src/tools/syscall_test32