117 lines
3.2 KiB
Go
117 lines
3.2 KiB
Go
// Copyright 2018 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// Test binary used to test that seccomp filters are properly constructed and
|
|
// indeed kill the process on violation.
|
|
package main
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"os"
|
|
|
|
"golang.org/x/sys/unix"
|
|
"gvisor.dev/gvisor/pkg/seccomp"
|
|
)
|
|
|
|
func main() {
|
|
dieFlag := flag.Bool("die", false, "trips over the filter if true")
|
|
flag.Parse()
|
|
|
|
syscalls := seccomp.SyscallRules{
|
|
unix.SYS_ACCEPT: {},
|
|
unix.SYS_BIND: {},
|
|
unix.SYS_BRK: {},
|
|
unix.SYS_CLOCK_GETTIME: {},
|
|
unix.SYS_CLONE: {},
|
|
unix.SYS_CLOSE: {},
|
|
unix.SYS_DUP: {},
|
|
unix.SYS_DUP3: {},
|
|
unix.SYS_EPOLL_CREATE1: {},
|
|
unix.SYS_EPOLL_CTL: {},
|
|
unix.SYS_EPOLL_PWAIT: {},
|
|
unix.SYS_EXIT: {},
|
|
unix.SYS_EXIT_GROUP: {},
|
|
unix.SYS_FALLOCATE: {},
|
|
unix.SYS_FCHMOD: {},
|
|
unix.SYS_FCNTL: {},
|
|
unix.SYS_FSTAT: {},
|
|
unix.SYS_FSYNC: {},
|
|
unix.SYS_FTRUNCATE: {},
|
|
unix.SYS_FUTEX: {},
|
|
unix.SYS_GETDENTS64: {},
|
|
unix.SYS_GETPEERNAME: {},
|
|
unix.SYS_GETPID: {},
|
|
unix.SYS_GETSOCKNAME: {},
|
|
unix.SYS_GETSOCKOPT: {},
|
|
unix.SYS_GETTID: {},
|
|
unix.SYS_GETTIMEOFDAY: {},
|
|
unix.SYS_LISTEN: {},
|
|
unix.SYS_LSEEK: {},
|
|
unix.SYS_MADVISE: {},
|
|
unix.SYS_MINCORE: {},
|
|
unix.SYS_MMAP: {},
|
|
unix.SYS_MPROTECT: {},
|
|
unix.SYS_MUNLOCK: {},
|
|
unix.SYS_MUNMAP: {},
|
|
unix.SYS_NANOSLEEP: {},
|
|
unix.SYS_PPOLL: {},
|
|
unix.SYS_PREAD64: {},
|
|
unix.SYS_PSELECT6: {},
|
|
unix.SYS_PWRITE64: {},
|
|
unix.SYS_READ: {},
|
|
unix.SYS_READLINKAT: {},
|
|
unix.SYS_READV: {},
|
|
unix.SYS_RECVMSG: {},
|
|
unix.SYS_RENAMEAT: {},
|
|
unix.SYS_RESTART_SYSCALL: {},
|
|
unix.SYS_RT_SIGACTION: {},
|
|
unix.SYS_RT_SIGPROCMASK: {},
|
|
unix.SYS_RT_SIGRETURN: {},
|
|
unix.SYS_SCHED_YIELD: {},
|
|
unix.SYS_SENDMSG: {},
|
|
unix.SYS_SETITIMER: {},
|
|
unix.SYS_SET_ROBUST_LIST: {},
|
|
unix.SYS_SETSOCKOPT: {},
|
|
unix.SYS_SHUTDOWN: {},
|
|
unix.SYS_SIGALTSTACK: {},
|
|
unix.SYS_SOCKET: {},
|
|
unix.SYS_SYNC_FILE_RANGE: {},
|
|
unix.SYS_TGKILL: {},
|
|
unix.SYS_UTIMENSAT: {},
|
|
unix.SYS_WRITE: {},
|
|
unix.SYS_WRITEV: {},
|
|
}
|
|
|
|
arch_syscalls(syscalls)
|
|
|
|
die := *dieFlag
|
|
if !die {
|
|
syscalls[unix.SYS_OPENAT] = []seccomp.Rule{
|
|
{
|
|
seccomp.EqualTo(10),
|
|
},
|
|
}
|
|
}
|
|
|
|
if err := seccomp.Install(syscalls); err != nil {
|
|
fmt.Printf("Failed to install seccomp: %v", err)
|
|
os.Exit(1)
|
|
}
|
|
fmt.Printf("Filters installed\n")
|
|
|
|
unix.RawSyscall(unix.SYS_OPENAT, 10, 0, 0)
|
|
fmt.Printf("Syscall was allowed!!!\n")
|
|
}
|