gvisor.dev/gvisor@v0.0.0-20240520182842-f9d4d51c7e0f/pkg/seccomp/victim/seccomp_test_victim.go (about)

     1  // Copyright 2018 The gVisor Authors.
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  // Test binary used to test that seccomp filters are properly constructed and
    16  // indeed kill the process on violation.
    17  package main
    18  
    19  import (
    20  	"flag"
    21  	"fmt"
    22  	"os"
    23  
    24  	"golang.org/x/sys/unix"
    25  	"gvisor.dev/gvisor/pkg/seccomp"
    26  )
    27  
    28  func main() {
    29  	dieFlag := flag.Bool("die", false, "trips over the filter if true")
    30  	flag.Parse()
    31  
    32  	syscalls := seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
    33  		unix.SYS_ACCEPT:          seccomp.MatchAll{},
    34  		unix.SYS_BIND:            seccomp.MatchAll{},
    35  		unix.SYS_BRK:             seccomp.MatchAll{},
    36  		unix.SYS_CLOCK_GETTIME:   seccomp.MatchAll{},
    37  		unix.SYS_CLONE:           seccomp.MatchAll{},
    38  		unix.SYS_CLOSE:           seccomp.MatchAll{},
    39  		unix.SYS_DUP:             seccomp.MatchAll{},
    40  		unix.SYS_DUP3:            seccomp.MatchAll{},
    41  		unix.SYS_EPOLL_CREATE1:   seccomp.MatchAll{},
    42  		unix.SYS_EPOLL_CTL:       seccomp.MatchAll{},
    43  		unix.SYS_EPOLL_PWAIT:     seccomp.MatchAll{},
    44  		unix.SYS_EXIT:            seccomp.MatchAll{},
    45  		unix.SYS_EXIT_GROUP:      seccomp.MatchAll{},
    46  		unix.SYS_FALLOCATE:       seccomp.MatchAll{},
    47  		unix.SYS_FCHMOD:          seccomp.MatchAll{},
    48  		unix.SYS_FCNTL:           seccomp.MatchAll{},
    49  		unix.SYS_FSTAT:           seccomp.MatchAll{},
    50  		unix.SYS_FSYNC:           seccomp.MatchAll{},
    51  		unix.SYS_FTRUNCATE:       seccomp.MatchAll{},
    52  		unix.SYS_FUTEX:           seccomp.MatchAll{},
    53  		unix.SYS_GETDENTS64:      seccomp.MatchAll{},
    54  		unix.SYS_GETPEERNAME:     seccomp.MatchAll{},
    55  		unix.SYS_GETPID:          seccomp.MatchAll{},
    56  		unix.SYS_GETSOCKNAME:     seccomp.MatchAll{},
    57  		unix.SYS_GETSOCKOPT:      seccomp.MatchAll{},
    58  		unix.SYS_GETTID:          seccomp.MatchAll{},
    59  		unix.SYS_GETTIMEOFDAY:    seccomp.MatchAll{},
    60  		unix.SYS_LISTEN:          seccomp.MatchAll{},
    61  		unix.SYS_LSEEK:           seccomp.MatchAll{},
    62  		unix.SYS_MADVISE:         seccomp.MatchAll{},
    63  		unix.SYS_MINCORE:         seccomp.MatchAll{},
    64  		unix.SYS_MMAP:            seccomp.MatchAll{},
    65  		unix.SYS_MPROTECT:        seccomp.MatchAll{},
    66  		unix.SYS_MUNLOCK:         seccomp.MatchAll{},
    67  		unix.SYS_MUNMAP:          seccomp.MatchAll{},
    68  		unix.SYS_NANOSLEEP:       seccomp.MatchAll{},
    69  		unix.SYS_OPENAT:          seccomp.MatchAll{},
    70  		unix.SYS_PPOLL:           seccomp.MatchAll{},
    71  		unix.SYS_PREAD64:         seccomp.MatchAll{},
    72  		unix.SYS_PSELECT6:        seccomp.MatchAll{},
    73  		unix.SYS_PWRITE64:        seccomp.MatchAll{},
    74  		unix.SYS_READ:            seccomp.MatchAll{},
    75  		unix.SYS_READLINKAT:      seccomp.MatchAll{},
    76  		unix.SYS_READV:           seccomp.MatchAll{},
    77  		unix.SYS_RECVMSG:         seccomp.MatchAll{},
    78  		unix.SYS_RENAMEAT:        seccomp.MatchAll{},
    79  		unix.SYS_RESTART_SYSCALL: seccomp.MatchAll{},
    80  		unix.SYS_RT_SIGACTION:    seccomp.MatchAll{},
    81  		unix.SYS_RT_SIGPROCMASK:  seccomp.MatchAll{},
    82  		unix.SYS_RT_SIGRETURN:    seccomp.MatchAll{},
    83  		unix.SYS_SCHED_YIELD:     seccomp.MatchAll{},
    84  		unix.SYS_SENDMSG:         seccomp.MatchAll{},
    85  		unix.SYS_SETITIMER:       seccomp.MatchAll{},
    86  		unix.SYS_SET_ROBUST_LIST: seccomp.MatchAll{},
    87  		unix.SYS_SETSOCKOPT:      seccomp.MatchAll{},
    88  		unix.SYS_SHUTDOWN:        seccomp.MatchAll{},
    89  		unix.SYS_SIGALTSTACK:     seccomp.MatchAll{},
    90  		unix.SYS_SOCKET:          seccomp.MatchAll{},
    91  		unix.SYS_SYNC_FILE_RANGE: seccomp.MatchAll{},
    92  		unix.SYS_TGKILL:          seccomp.MatchAll{},
    93  		unix.SYS_UTIMENSAT:       seccomp.MatchAll{},
    94  		unix.SYS_WRITE:           seccomp.MatchAll{},
    95  		unix.SYS_WRITEV:          seccomp.MatchAll{},
    96  	})
    97  
    98  	arch_syscalls(syscalls)
    99  	// We choose a syscall that is unlikely to be called by Go runtime,
   100  	// even with race or other instrumentation enabled.
   101  	syscall := uintptr(unix.SYS_UMASK)
   102  
   103  	die := *dieFlag
   104  	if !die {
   105  		syscalls.Set(syscall, seccomp.PerArg{
   106  			seccomp.EqualTo(0),
   107  		})
   108  	}
   109  
   110  	if err := seccomp.Install(syscalls, seccomp.NewSyscallRules(), seccomp.DefaultProgramOptions()); err != nil {
   111  		fmt.Printf("Failed to install seccomp: %v\n", err)
   112  		os.Exit(1)
   113  	}
   114  	fmt.Printf("Filters installed\n")
   115  
   116  	unix.RawSyscall(syscall, 0, 0, 0)
   117  	fmt.Printf("Syscall was allowed!!!\n")
   118  }