| 291 | #include <linux/seccomp.h> |
| 292 | #include <linux/filter.h> |
| 293 | static void e9filter(struct e9scratch_s *scratch) |
| 294 | { |
| 295 | intptr_t r = e9syscall(SYS_prctl, PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); |
| 296 | if (r < 0) |
| 297 | e9panic("prctl() failed (errno=%u)", -r); |
| 298 | struct sock_filter filter[] = |
| 299 | { |
| 300 | BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)), |
| 301 | BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_rt_sigaction, 0, 5), |
| 302 | BPF_STMT(BPF_LD | BPF_W | BPF_ABS, |
| 303 | offsetof(struct seccomp_data, args[4])), |
| 304 | // Backdoor: TODO: think of a better solution |
| 305 | BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, E9_BACKDOOR, 3, 0), |
| 306 | BPF_STMT(BPF_LD | BPF_W | BPF_ABS, |
| 307 | offsetof(struct seccomp_data, args[0])), |
| 308 | BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SIGILL, 0, 1), |
| 309 | BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | ENOSYS), |
| 310 | BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW), |
| 311 | }; |
| 312 | struct sock_fprog fprog = |
| 313 | { |
| 314 | (unsigned short)(sizeof(filter) / sizeof(filter[0])), |
| 315 | filter |
| 316 | }; |
| 317 | r = e9syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, /*flags=*/0x0, |
| 318 | &fprog); |
| 319 | if (r < 0) |
| 320 | e9panic("seccomp() failed (errno=%u)", -r); |
| 321 | } |
| 322 | |
| 323 | /* |
| 324 | * Get an address. |