diff options
Diffstat (limited to 'src/firejail/seccomp.c')
-rw-r--r-- | src/firejail/seccomp.c | 72 |
1 files changed, 28 insertions, 44 deletions
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c index 74d29fc9d..20807f5b1 100644 --- a/src/firejail/seccomp.c +++ b/src/firejail/seccomp.c | |||
@@ -22,6 +22,34 @@ | |||
22 | #include "firejail.h" | 22 | #include "firejail.h" |
23 | #include "../include/seccomp.h" | 23 | #include "../include/seccomp.h" |
24 | 24 | ||
25 | char *seccomp_check_list(const char *str) { | ||
26 | assert(str); | ||
27 | if (strlen(str) == 0) { | ||
28 | fprintf(stderr, "Error: empty syscall lists are not allowed\n"); | ||
29 | exit(1); | ||
30 | } | ||
31 | |||
32 | int len = strlen(str) + 1; | ||
33 | char *rv = malloc(len); | ||
34 | if (!rv) | ||
35 | errExit("malloc"); | ||
36 | memset(rv, 0, len); | ||
37 | |||
38 | const char *ptr1 = str; | ||
39 | char *ptr2 = rv; | ||
40 | while (*ptr1 != '\0') { | ||
41 | if (isalnum(*ptr1) || *ptr1 == '_' || *ptr1 == ',' || *ptr1 == ':') | ||
42 | *ptr2++ = *ptr1++; | ||
43 | else { | ||
44 | fprintf(stderr, "Error: invalid syscall list\n"); | ||
45 | exit(1); | ||
46 | } | ||
47 | } | ||
48 | |||
49 | return rv; | ||
50 | } | ||
51 | |||
52 | |||
25 | int seccomp_load(const char *fname) { | 53 | int seccomp_load(const char *fname) { |
26 | assert(fname); | 54 | assert(fname); |
27 | 55 | ||
@@ -136,10 +164,6 @@ int seccomp_filter_drop(int enforce_seccomp) { | |||
136 | #endif | 164 | #endif |
137 | if (arg_debug) | 165 | if (arg_debug) |
138 | printf("Build default+drop seccomp filter\n"); | 166 | printf("Build default+drop seccomp filter\n"); |
139 | if (strlen(cfg.seccomp_list) == 0) { | ||
140 | fprintf(stderr, "Error: empty syscall lists are not allowed\n"); | ||
141 | exit(1); | ||
142 | } | ||
143 | 167 | ||
144 | // build the seccomp filter as a regular user | 168 | // build the seccomp filter as a regular user |
145 | int rv; | 169 | int rv; |
@@ -157,10 +181,6 @@ int seccomp_filter_drop(int enforce_seccomp) { | |||
157 | else if (cfg.seccomp_list == NULL && cfg.seccomp_list_drop) { | 181 | else if (cfg.seccomp_list == NULL && cfg.seccomp_list_drop) { |
158 | if (arg_debug) | 182 | if (arg_debug) |
159 | printf("Build drop seccomp filter\n"); | 183 | printf("Build drop seccomp filter\n"); |
160 | if (strlen(cfg.seccomp_list_drop) == 0) { | ||
161 | fprintf(stderr, "Error: empty syscall lists are not allowed\n"); | ||
162 | exit(1); | ||
163 | } | ||
164 | 184 | ||
165 | // build the seccomp filter as a regular user | 185 | // build the seccomp filter as a regular user |
166 | int rv; | 186 | int rv; |
@@ -199,10 +219,6 @@ int seccomp_filter_drop(int enforce_seccomp) { | |||
199 | int seccomp_filter_keep(void) { | 219 | int seccomp_filter_keep(void) { |
200 | if (arg_debug) | 220 | if (arg_debug) |
201 | printf("Build drop seccomp filter\n"); | 221 | printf("Build drop seccomp filter\n"); |
202 | if (strlen(cfg.seccomp_list_keep) == 0) { | ||
203 | fprintf(stderr, "Error: empty syscall lists are not allowed\n"); | ||
204 | exit(1); | ||
205 | } | ||
206 | 222 | ||
207 | // build the seccomp filter as a regular user | 223 | // build the seccomp filter as a regular user |
208 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4, | 224 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4, |
@@ -216,38 +232,6 @@ int seccomp_filter_keep(void) { | |||
216 | return seccomp_load(RUN_SECCOMP_CFG); | 232 | return seccomp_load(RUN_SECCOMP_CFG); |
217 | } | 233 | } |
218 | 234 | ||
219 | // errno filter for seccomp option | ||
220 | int seccomp_filter_errno(void) { | ||
221 | #if 0 //todo: disabled temporarely, bring it back | ||
222 | int i; | ||
223 | int higest_errno = errno_highest_nr(); | ||
224 | filter_init(); | ||
225 | |||
226 | // apply errno list | ||
227 | |||
228 | for (i = 0; i < higest_errno; i++) { | ||
229 | if (cfg.seccomp_list_errno[i]) { | ||
230 | if (syscall_check_list(cfg.seccomp_list_errno[i], filter_add_errno, i)) { | ||
231 | fprintf(stderr, "Error: cannot load seccomp filter\n"); | ||
232 | exit(1); | ||
233 | } | ||
234 | } | ||
235 | } | ||
236 | |||
237 | filter_end_blacklist(); | ||
238 | if (arg_debug) | ||
239 | filter_debug(); | ||
240 | |||
241 | // save seccomp filter in /run/firejail/mnt/seccomp | ||
242 | // in order to use it in --join operations | ||
243 | write_seccomp_file(); | ||
244 | return seccomp_load(RUN_SECCOMP_CFG); | ||
245 | #else | ||
246 | printf("*** --seccomp.<errno> is temporarily disabled, it will be brought back soon ***\n"); | ||
247 | return 0; | ||
248 | #endif | ||
249 | } | ||
250 | |||
251 | void seccomp_print_filter_name(const char *name) { | 235 | void seccomp_print_filter_name(const char *name) { |
252 | EUID_ASSERT(); | 236 | EUID_ASSERT(); |
253 | if (!name || strlen(name) == 0) { | 237 | if (!name || strlen(name) == 0) { |