<commit_before>/*
 * Copyright (c) 2013 The Native Client Authors. All rights reserved.
 * Use of this source code is governed by a BSD-style license that can be
 * found in the LICENSE file.
 */

/*
 * Seccomp filter policy for x86-64 with BPF macros
 */

#include <linux/ptrace.h>

#include "native_client/src/include/nacl_compiler_annotations.h"

#if defined(PTRACE_O_TRACESECCOMP)
#define SUPPORTED_OS 1
#endif

#if defined(SUPPORTED_OS)

#include <linux/audit.h>
#include <linux/errno.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/types.h>
#include <linux/unistd.h>
#include <signal.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <unistd.h>

#define SyscallArg(n) (offsetof(struct seccomp_data, args[n]))
#define SyscallArch (offsetof(struct seccomp_data, arch))
#define SyscallNr (offsetof(struct seccomp_data, nr))


#define REG_RESULT  REG_RAX
#define REG_SYSCALL  REG_RAX
#define REG_ARG0  REG_RDI
#define REG_ARG1  REG_RSI
#define REG_ARG2  REG_RDX
#define REG_ARG3  REG_R10
#define REG_ARG4  REG_R8
#define REG_ARG5  REG_R9

#ifndef PR_SET_NO_NEW_PRIVS
#define PR_SET_NO_NEW_PRIVS 38
#endif

#ifndef SYS_SECCOMP
#define SYS_SECCOMP 1
#endif

#define BUF_SIZE 1024

static void NaClSeccompBpfSigsysHandler(int nr, siginfo_t *info,
                                        void *void_context) {
  ucontext_t *ctx = (ucontext_t *) void_context;
  int syscall;
  char buf[BUF_SIZE];
  int n;
  char *filename;
  int fatal = 1;
  UNREFERENCED_PARAMETER(nr);
  UNREFERENCED_PARAMETER(info);

  syscall = ctx->uc_mcontext.gregs[REG_SYSCALL];
  switch (syscall) {
    case SYS_open:
      filename = (char *) ctx->uc_mcontext.gregs[REG_ARG0];
      n = snprintf(buf, BUF_SIZE,
                   "[SECCOMP BPF] Blocked open(\"%s\")\n", filename);
      fatal = 0;
      break;
    default:
      n = snprintf(buf, BUF_SIZE, "[SECCOMP BPF] "
                   "Linux syscall %d is not allowed by the policy\n",
                   syscall);
      break;
  }
  if (write(STDERR_FILENO, buf, n)) {}
  if (fatal) {
    _exit(255);
  }
  ctx->uc_mcontext.gregs[REG_RESULT] = -EACCES;
}

static struct sock_filter filter[] = {
  /*
   * Check that an x86-64 syscall is called.
   * This will save us from the case when x86-64 process
   * calls an x86-32 system call using int $0x80.
   * See http://scary.beasts.org/security/CESA-2009-001.html
   */
  BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SyscallArch),
  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, AUDIT_ARCH_X86_64, 1, 0),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_KILL),

  /* Grab the system call number */
  BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SyscallNr),
  /* Jump table for the allowed syscalls */
  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_rt_sigreturn, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

#ifdef __NR_sigreturn
  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_sigreturn, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),
#endif

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_exit_group, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_exit, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_read, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_write, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_brk, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_mmap, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

#ifdef __NR_mmap2
  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_mmap2, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),
#endif

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_munmap, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),
<commit_msg>Allow gettid syscall in seccomp-bpf policy<commit_after>/*
 * Copyright (c) 2013 The Native Client Authors. All rights reserved.
 * Use of this source code is governed by a BSD-style license that can be
 * found in the LICENSE file.
 */

/*
 * Seccomp filter policy for x86-64 with BPF macros
 */

#include <linux/ptrace.h>

#include "native_client/src/include/nacl_compiler_annotations.h"

#if defined(PTRACE_O_TRACESECCOMP)
#define SUPPORTED_OS 1
#endif

#if defined(SUPPORTED_OS)

#include <linux/audit.h>
#include <linux/errno.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/types.h>
#include <linux/unistd.h>
#include <signal.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <unistd.h>

#define SyscallArg(n) (offsetof(struct seccomp_data, args[n]))
#define SyscallArch (offsetof(struct seccomp_data, arch))
#define SyscallNr (offsetof(struct seccomp_data, nr))


#define REG_RESULT  REG_RAX
#define REG_SYSCALL  REG_RAX
#define REG_ARG0  REG_RDI
#define REG_ARG1  REG_RSI
#define REG_ARG2  REG_RDX
#define REG_ARG3  REG_R10
#define REG_ARG4  REG_R8
#define REG_ARG5  REG_R9

#ifndef PR_SET_NO_NEW_PRIVS
#define PR_SET_NO_NEW_PRIVS 38
#endif

#ifndef SYS_SECCOMP
#define SYS_SECCOMP 1
#endif

#define BUF_SIZE 1024

static void NaClSeccompBpfSigsysHandler(int nr, siginfo_t *info,
                                        void *void_context) {
  ucontext_t *ctx = (ucontext_t *) void_context;
  int syscall;
  char buf[BUF_SIZE];
  int n;
  char *filename;
  int fatal = 1;
  UNREFERENCED_PARAMETER(nr);
  UNREFERENCED_PARAMETER(info);

  syscall = ctx->uc_mcontext.gregs[REG_SYSCALL];
  switch (syscall) {
    case SYS_open:
      filename = (char *) ctx->uc_mcontext.gregs[REG_ARG0];
      n = snprintf(buf, BUF_SIZE,
                   "[SECCOMP BPF] Blocked open(\"%s\")\n", filename);
      fatal = 0;
      break;
    default:
      n = snprintf(buf, BUF_SIZE, "[SECCOMP BPF] "
                   "Linux syscall %d is not allowed by the policy\n",
                   syscall);
      break;
  }
  if (write(STDERR_FILENO, buf, n)) {}
  if (fatal) {
    _exit(255);
  }
  ctx->uc_mcontext.gregs[REG_RESULT] = -EACCES;
}

static struct sock_filter filter[] = {
  /*
   * Check that an x86-64 syscall is called.
   * This will save us from the case when x86-64 process
   * calls an x86-32 system call using int $0x80.
   * See http://scary.beasts.org/security/CESA-2009-001.html
   */
  BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SyscallArch),
  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, AUDIT_ARCH_X86_64, 1, 0),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_KILL),

  /* Grab the system call number */
  BPF_STMT(BPF_LD + BPF_W + BPF_ABS, SyscallNr),
  /* Jump table for the allowed syscalls */
  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_rt_sigreturn, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

#ifdef __NR_sigreturn
  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_sigreturn, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),
#endif

  /*
   * Note that gettid is an information leak if not running
   * under an outer sandbox that uses CLONE_NEWPID.
   * It's allowed here for the benefit of the ASan runtime.
   */
  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_gettid, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_exit_group, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_exit, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_read, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_write, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_brk, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_mmap, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

#ifdef __NR_mmap2
  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_mmap2, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),
#endif

  BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_munmap, 0, 1),
  BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

{'fraction_non_alphanumeric': 0.11422227704452942, 'fraction_numerical': 0.020476131738004194, 'mean_word_length': 3.94390243902439, 'pattern_counts': {'":': 0, '<': 33, '<?xml version=': 0, '>': 39, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2256017', 'n_tokens_mistral': 3739, 'n_tokens_neox': 3484, 'n_words': 757}