seccomp介绍

Posted on 2019-11-30 Edited on 2020-01-05

本文主要基于[2], 提取出核心的描述，并理清思路

seccomp的前世今生

seccomp最早出现在Linux kernel 2.6.12，时间是2005年。2012年的Linux 3.5版本，加入了"seccomp mode 2" (or "seccomp filter mode")功能。

It added a second mode for seccomp: SECCOMP_MODE_FILTER. Using that mode, processes can specify which system calls are permitted. By using a mini-program in the Berkeley packet filter (BPF) language, processes could restrict system calls entirely or only for certain argument values.

所以我们现在用的就是这个seccomp2，或者叫seccomp-bpf。那么为啥叫seccomp-bpf?BPF到底是什么？

BPF全称是Berkeley Packet Filter。

最初构想提出于1992年，其目的是为了提供一种过滤包的方法，并且要避免从内核空间到用户空间的无用的数据包复制行为。它最初是由从用户空间注入到内核的一个简单的字节码构成，它在那个位置利用一个校验器进行检查 —— 以避免内核崩溃或者安全问题 —— 并附着到一个套接字上。其简化的语言以及存在于内核中的即时编译器（JIT），使 BPF 成为一个性能卓越的工具。

为啥这两个东西会绑到一起呢？

因为seccomp在过滤syscall的时候，借助了BPF定义的过滤规则，以及处于内核的用BPF language写的mini-program。所以采用了BPF方法对syscall进行过滤的seccomp就是seccomp-bpf。

seccomp怎么用

The seccomp filter system uses the Berkley Packet Filter system. Combined with argument checking and the many possible filter return values (kill, trap, trace, errno), this is allows for extensive logic.[2]

[2]以及本文主要阐述了最基本的case，seccomp的高阶用法可以参考seccomp的内核文档。

Detect seccomp

root@kube-master:~#  cat /boot/config-`uname -r` | grep CONFIG_SECCOMP
CONFIG_SECCOMP_FILTER=y
CONFIG_SECCOMP=y

也可以参考这个链接（Detecting seccomp features at runtime）写一个Linux应用程序调用prctl系统调用来检测。

Basic seccomp filtering

基本的SYSCALL过滤非常简单，大致流程如下：

后面两步都差不多，可见关键的是第一步，也就是定义SYSCALL过滤列表。

struct sock_filter filter[] = {
    /* Validate architecture. */
    VALIDATE_ARCHITECTURE,
    /* Grab the system call number. */
    EXAMINE_SYSCALL,
    /* List allowed syscalls. */
    ALLOW_SYSCALL(rt_sigreturn),
    ...
    KILL_PROCESS,
};
struct sock_fprog prog = {
    .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
    .filter = filter,
};

if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
    perror("prctl(NO_NEW_PRIVS)");
    goto failed;
}
if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
    perror("prctl(SECCOMP)");
    goto failed;
}

BPF

这里值得注意的是EXAMINE_SYSCALL, ALLOW_SYSCALL和 KILL_PROCESS都不是标准库提供的。看本项目的seccomp-bpf.h可以知道。这些都是自定义的宏：

#define VALIDATE_ARCHITECTURE \
    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, arch_nr), \
    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)

#define EXAMINE_SYSCALL \
    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_nr)

#define ALLOW_SYSCALL(name) \
    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)

#define KILL_PROCESS \
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)

查看Linux源码可知, BPF_STMT

./include/uapi/linux/filter.h
48:#ifndef BPF_STMT
49:#define BPF_STMT(code, k) { (unsigned short)(code), 0, 0, k }

If one is "feeling masochistic", they could write BPF programs numerically, but there are some constants and macros available to make it easier. [3]

BPF提供了一套指令集来实现filter功能。你可以自行写二进制（汇编），也可以采用Linux抽象的宏，更高阶一点的API，可以参考Libseccomp。里面也有不少sample代码。Android使用的是minijai。

There are a number of tools and resources that can make it easier to work with seccomp filters and BPF. Libseccomp provides a higher-level API for creating filters. He noted that the project also has man pages (for example, seccomp_init()) with lots of examples. [3]

除了高阶API可用，[3]中还提及了一些编译BPF指令的方法：

There is also a BPF compiler (bpfc) that is part of the netsniff-ng toolkit project. LLVM has a BPF backend as of its 3.7 release that compiles a subset of C to BPF, though he noted that there is little documentation as yet.
Finally, the kernel has a just-in-time (JIT) compiler that turns the BPF bytecode into native machine code, which can achieve 2-3x performance (or even better in some cases). The JIT compiler is disabled by default, but it can be enabled by writing a "1" to: /proc/sys/net/core/bpf_jit_enable
Kerrisk's slides have a wealth of information, including additional >resources for more information.

seccomp高阶用法简介

seccomp的高阶用法还是要参考seccomp的内核文档，本节仅做一些罗列和提示。

在[2]中的example代码里，不符合要求的调用，会被直接kill process。其实还有很多返回值：

SECCOMP_RET_KILL_PROCESS
SECCOMP_RET_KILL_THREAD
SECCOMP_RET_TRAP
SECCOMP_RET_ERRNO
SECCOMP_RET_USER_NOTIF
SECCOMP_RET_TRACE
SECCOMP_RET_LOG
SECCOMP_RET_ALLOW

If multiple filters exist, the return value for the evaluation of a given system call will always use the highest precedent value.
Precedence is only determined using the SECCOMP_RET_ACTION mask. When multiple filters return values of the same precedence, only the SECCOMP_RET_DATA from the most recently installed filter will be returned.

坑（Pitfalls）

来自[5]，我只是搬运工

The biggest pitfall to avoid during use is filtering on system call number without checking the architecture value. Why? On any architecture that supports multiple system call invocation conventions, the system call numbers may vary based on the specific invocation. If the numbers in the different calling conventions overlap, then checks in the filters may be abused. Always check the arch value!

翻译一下，这里的意思是提醒seccomp的使用者，在设置filtering之前要记得验证体系架构，因为不同的体系架构，系统调用号可能是不同的。例如[2]的example中有：

struct sock_filter filter[] = {
    /* Validate architecture. */
    VALIDATE_ARCHITECTURE,
    ...
};

// in seccomp-bpf.h
#define syscall_nr (offsetof(struct seccomp_data, nr))
#define arch_nr (offsetof(struct seccomp_data, arch))

#if defined(__i386__)
# define REG_SYSCALL    REG_EAX
# define ARCH_NR    AUDIT_ARCH_I386
#elif defined(__x86_64__)
# define REG_SYSCALL    REG_RAX
# define ARCH_NR    AUDIT_ARCH_X86_64
#else
# warning "Platform does not support seccomp filter yet"
# define REG_SYSCALL    0
# define ARCH_NR    0
#endif

#define VALIDATE_ARCHITECTURE \
    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, arch_nr), \
    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)

seccomp_data是啥？

/**
 * struct seccomp_data - the format the BPF program executes over.
 * @nr: the system call number
 * @arch: indicates system call convention as an AUDIT_ARCH_* value
 *        as defined in <linux/audit.h>.
 * @instruction_pointer: at the time of the system call.
 * @args: up to 6 system call arguments always stored as 64-bit values
 *        regardless of the architecture.
 */
struct seccomp_data {
    int nr;
    __u32 arch;
    __u64 instruction_pointer;
    __u64 args[6];
};

我的理解：应用程序(example.c)把sock_filter结构体写入内核(通过prctl)，之后内核接受SYSCALL的时候，构造出seccomp_data数据结构来调用这一段BPF代码，并获得过滤的结果。

总结

seccomp是内核提供的一种SYSCALL过滤机制，它基于BPF过滤方法，通过写入BPF过滤器代码来达到过滤的目的。BPF规则语言原生是为了过滤网络包，情景比较复杂。针对SYSCALL场景，语法比较固定，可以自行撰写，也可以基于Libseccomp库提供的API来编写。

因为程序在fork/clone或execve时，BPF filter会从父进程继承到子进程，所以如果想控制第三方的程序调用SYSCALL，只需要在fork/clone或者execve时，传入合适的sock_filter即可。

Big Ben