From cd0ddf6f754ec364c0ec69bd4bb51f566065290e Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 13 Sep 2017 19:55:16 +0200 Subject: [PATCH] seccomp: add four new syscall groups These groups should be useful shortcuts for sets of closely related syscalls where it usually makes more sense to allow them altogether or not at all. --- man/systemd.exec.xml | 16 +++++++++ src/shared/seccomp-util.c | 71 +++++++++++++++++++++++++++++++++++++++ src/shared/seccomp-util.h | 4 +++ 3 files changed, 91 insertions(+) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 625063f1c0..edc070f6ea 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1461,6 +1461,10 @@ CapabilityBoundingSet=~CAP_B CAP_C @cpu-emulation System calls for CPU emulation functionality (vm862 and related calls) + + @credentials + System calls for querying process credentials (getuid2, capget2, and related calls) + @debug Debugging, performance monitoring and tracing functionality (ptrace2, perf_event_open2 and related calls) @@ -1481,6 +1485,10 @@ CapabilityBoundingSet=~CAP_B CAP_C @keyring Kernel keyring access (keyctl2 and related calls) + + @memlock + Locking of memory into RAM (mlock2, mlockall2 and related calls) + @module Loading and unloading of kernel modules (init_module2, delete_module2 and related calls) @@ -1521,10 +1529,18 @@ CapabilityBoundingSet=~CAP_B CAP_C @setuid System calls for changing user ID and group ID credentials, (setuid2, setgid2, setresuid2, …) + + @signal + System calls for manipulating and handling process signals (signal2, sigprocmask2, …) + @swap System calls for enabling/disabling swap devices (swapon2, swapoff2) + + @timer + System calls for scheduling operations by time (alarm2, timer_create2, …) + diff --git a/src/shared/seccomp-util.c b/src/shared/seccomp-util.c index f4f4eb36d3..e282469155 100644 --- a/src/shared/seccomp-util.c +++ b/src/shared/seccomp-util.c @@ -333,6 +333,32 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "vm86\0" "vm86old\0" }, + [SYSCALL_FILTER_SET_CREDENTIALS] = { + .name = "@credentials", + .help = "Query own process credentials", + .value = + "capget\0" + "getegid\0" + "getegid32\0" + "geteuid\0" + "geteuid32\0" + "getgid\0" + "getgid32\0" + "getgroups\0" + "getgroups32\0" + "getpgid\0" + "getpgrp\0" + "getpid\0" + "getppid\0" + "getresgid\0" + "getresgid32\0" + "getresuid\0" + "getresuid32\0" + "getsid\0" + "gettid\0" + "getuid\0" + "getuid32\0" + }, [SYSCALL_FILTER_SET_DEBUG] = { .name = "@debug", .help = "Debugging, performance monitoring and tracing functionality", @@ -487,6 +513,16 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "keyctl\0" "request_key\0" }, + [SYSCALL_FILTER_SET_MEMLOCK] = { + .name = "@memlock", + .help = "Memory locking control", + .value = + "mlock\0" + "mlock2\0" + "mlockall\0" + "munlock\0" + "munlockall\0" + }, [SYSCALL_FILTER_SET_MODULE] = { .name = "@module", .help = "Loading and unloading of kernel modules", @@ -691,6 +727,24 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "setuid\0" "setuid32\0" }, + [SYSCALL_FILTER_SET_SIGNAL] = { + .name = "@signal", + .help = "Process signal handling", + .value = + "rt_sigaction\0" + "rt_sigpending\0" + "rt_sigprocmask\0" + "rt_sigsuspend\0" + "rt_sigtimedwait\0" + "sigaction\0" + "sigaltstack\0" + "signal\0" + "signalfd\0" + "signalfd4\0" + "sigpending\0" + "sigprocmask\0" + "sigsuspend\0" + }, [SYSCALL_FILTER_SET_SWAP] = { .name = "@swap", .help = "Enable/disable swap devices", @@ -698,6 +752,23 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = { "swapoff\0" "swapon\0" }, + [SYSCALL_FILTER_SET_TIMER] = { + .name = "@timer", + .help = "Schedule operations by time", + .value = + "alarm\0" + "getitimer\0" + "setitimer\0" + "timer_create\0" + "timer_delete\0" + "timer_getoverrun\0" + "timer_gettime\0" + "timer_settime\0" + "timerfd_create\0" + "timerfd_gettime\0" + "timerfd_settime\0" + "times\0" + }, }; const SyscallFilterSet *syscall_filter_set_find(const char *name) { diff --git a/src/shared/seccomp-util.h b/src/shared/seccomp-util.h index c1612f5894..d4ff027df8 100644 --- a/src/shared/seccomp-util.h +++ b/src/shared/seccomp-util.h @@ -44,11 +44,13 @@ enum { SYSCALL_FILTER_SET_BASIC_IO, SYSCALL_FILTER_SET_CLOCK, SYSCALL_FILTER_SET_CPU_EMULATION, + SYSCALL_FILTER_SET_CREDENTIALS, SYSCALL_FILTER_SET_DEBUG, SYSCALL_FILTER_SET_FILE_SYSTEM, SYSCALL_FILTER_SET_IO_EVENT, SYSCALL_FILTER_SET_IPC, SYSCALL_FILTER_SET_KEYRING, + SYSCALL_FILTER_SET_MEMLOCK, SYSCALL_FILTER_SET_MODULE, SYSCALL_FILTER_SET_MOUNT, SYSCALL_FILTER_SET_NETWORK_IO, @@ -59,7 +61,9 @@ enum { SYSCALL_FILTER_SET_REBOOT, SYSCALL_FILTER_SET_RESOURCES, SYSCALL_FILTER_SET_SETUID, + SYSCALL_FILTER_SET_SIGNAL, SYSCALL_FILTER_SET_SWAP, + SYSCALL_FILTER_SET_TIMER, _SYSCALL_FILTER_SET_MAX };