Initial code for webtry, a web application for allowing users to try out Skia.

experimental/webtry/seccomp_bpf.h

+/*
+ * seccomp example for x86 (32-bit and 64-bit) with BPF macros
+ *
+ * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
+ * Authors:
+ *  Will Drewry <wad@chromium.org>
+ *  Kees Cook <keescook@chromium.org>
+ *
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */

[mtklein, 2014/04/08 19:00:23]

I gather this is pulled from chromium/src somewhere?  Can you provide a pointer
so that it's clear where to look if we want to update, or if for some reason
someone actually wanted to look at LICENSE?

Actually, can we grab these couple files and the LICENSE and put them in their
own dir in third_party with a note about how they got there?

[jcgregorio, 2014/04/09 14:10:31]

Stripped the file down to its absolute minimum and added a pointer to the
original file.

On 2014/04/08 19:00:23, mtklein wrote:

+#ifndef _SECCOMP_BPF_H_
+#define _SECCOMP_BPF_H_
+
+#define _GNU_SOURCE 1
+#include <stdio.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <signal.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <sys/prctl.h>
+#ifndef PR_SET_NO_NEW_PRIVS
+# define PR_SET_NO_NEW_PRIVS 38
+#endif
+
+#include <linux/unistd.h>
+#include <linux/audit.h>
+#include <linux/filter.h>
+#ifdef HAVE_LINUX_SECCOMP_H
+# include <linux/seccomp.h>
+#endif
+#ifndef SECCOMP_MODE_FILTER
+# define SECCOMP_MODE_FILTER    2 /* uses user-supplied filter. */
+# define SECCOMP_RET_KILL       0x00000000U /* kill the task immediately */
+# define SECCOMP_RET_TRAP       0x00030000U /* disallow and force a SIGSYS */
+# define SECCOMP_RET_ALLOW      0x7fff0000U /* allow */
+struct seccomp_data {
+    int nr;
+    __u32 arch;
+    __u64 instruction_pointer;
+    __u64 args[6];
+};
+#endif
+#ifndef SYS_SECCOMP
+# define SYS_SECCOMP 1
+#endif
+
+#define syscall_nr (offsetof(struct seccomp_data, nr))
+#define arch_nr (offsetof(struct seccomp_data, arch))
+
+#if defined(__i386__)
+# define REG_SYSCALL    REG_EAX
+# define ARCH_NR        AUDIT_ARCH_I386
+#elif defined(__x86_64__)
+# define REG_SYSCALL    REG_RAX
+# define ARCH_NR        AUDIT_ARCH_X86_64
+#else
+# warning "Platform does not support seccomp filter yet"
+# define REG_SYSCALL    0
+# define ARCH_NR        0
+#endif
+
+#define VALIDATE_ARCHITECTURE \

[mtklein, 2014/04/08 19:00:23]

Is it important that I (or we, you?) understand what's going on in here?  I'm
willing to learn, of course, but just as willing to glaze over magic if this is
unmodified working code.

[jcgregorio, 2014/04/09 14:10:31]

See above.

On 2014/04/08 19:00:23, mtklein wrote:

+        BPF_STMT(BPF_LD+BPF_W+BPF_ABS, arch_nr), \
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
+        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
+
+#define EXAMINE_SYSCALL \
+        BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_nr)
+
+#define ALLOW_SYSCALL(name) \
+        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
+        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
+
+#define KILL_PROCESS \
+        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
+
+#endif /* _SECCOMP_BPF_H_ */