gvisor.dev/gvisor@v0.0.0-20240520182842-f9d4d51c7e0f/pkg/sentry/platform/systrap/sysmsg_thread_amd64.go (about)

     1  // Copyright 2021 The gVisor Authors.
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package systrap
    16  
    17  import (
    18  	"golang.org/x/sys/unix"
    19  	"gvisor.dev/gvisor/pkg/abi/linux"
    20  	"gvisor.dev/gvisor/pkg/seccomp"
    21  )
    22  
    23  func appendSysThreadArchSeccompRules(rules []seccomp.RuleSet) []seccomp.RuleSet {
    24  	return append(rules, []seccomp.RuleSet{
    25  		{
    26  			// Rules for trapping vsyscall access.
    27  			Rules: seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
    28  				unix.SYS_GETTIMEOFDAY: seccomp.MatchAll{},
    29  				unix.SYS_TIME:         seccomp.MatchAll{},
    30  				unix.SYS_GETCPU:       seccomp.MatchAll{}, // SYS_GETCPU was not defined in package syscall on amd64.
    31  			}),
    32  			Action:   linux.SECCOMP_RET_TRAP,
    33  			Vsyscall: true,
    34  		},
    35  		{
    36  			Rules: seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
    37  				unix.SYS_ARCH_PRCTL: seccomp.Or{
    38  					seccomp.PerArg{
    39  						seccomp.EqualTo(linux.ARCH_SET_FS),
    40  						seccomp.AnyValue{},
    41  						seccomp.AnyValue{},
    42  						seccomp.AnyValue{},
    43  						seccomp.AnyValue{},
    44  						seccomp.AnyValue{},
    45  						seccomp.GreaterThan(stubStart), // rip
    46  					},
    47  					seccomp.PerArg{
    48  						seccomp.EqualTo(linux.ARCH_GET_FS),
    49  						seccomp.AnyValue{},
    50  						seccomp.AnyValue{},
    51  						seccomp.AnyValue{},
    52  						seccomp.AnyValue{},
    53  						seccomp.AnyValue{},
    54  						seccomp.GreaterThan(stubStart), // rip
    55  					},
    56  				},
    57  			}),
    58  			Action: linux.SECCOMP_RET_ALLOW,
    59  		},
    60  	}...)
    61  }