From: Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
To: Sargun Dhillon <sargun-GaZTRHToo+CzQB+pC5nmwQ@public.gmane.org>
Cc: Will Drewry <wad-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>,
Daniel Borkmann <daniel-FeC+5ew28dpmcu3hnIyYJQ@public.gmane.org>,
Network Development
<netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
Linux Containers
<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>,
Alexei Starovoitov <ast-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>,
Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
Subject: Re: [PATCH net-next 3/3] bpf: Add eBPF seccomp sample programs
Date: Tue, 13 Feb 2018 12:18:18 -0800 [thread overview]
Message-ID: <CAGXu5jK6o7515-5hfy=3aHZDCY3fryS522sB4RxgjJ4m67arZA__40570.991804316$1518553043$gmane$org@mail.gmail.com> (raw)
In-Reply-To: <20180213154320.GA3319-du9IEJ8oIxHXYT48pCVpJ3c7ZZ+wIVaZYkHkVr5ML8kVGlcevz2xqA@public.gmane.org>
On Tue, Feb 13, 2018 at 7:43 AM, Sargun Dhillon <sargun-GaZTRHToo+CzQB+pC5nmwQ@public.gmane.org> wrote:
> +++ b/samples/bpf/seccomp1_kern.c
> @@ -0,0 +1,17 @@
> +#include <uapi/linux/seccomp.h>
> +#include <uapi/linux/bpf.h>
> +#include <uapi/linux/unistd.h>
> +#include "bpf_helpers.h"
> +#include <uapi/linux/errno.h>
> +
> +/* Returns EPERM when trying to close fd 999 */
> +SEC("seccomp")
> +int bpf_prog1(struct seccomp_data *ctx)
> +{
> + if (ctx->nr == __NR_close && ctx->args[0] == 999)
> + return SECCOMP_RET_ERRNO | EPERM;
> +
> + return SECCOMP_RET_ALLOW;
> +}
> +
> +char _license[] SEC("license") = "GPL";
> [...]
> +++ b/samples/bpf/seccomp2_kern.c
> @@ -0,0 +1,24 @@
> +#include <uapi/linux/seccomp.h>
> +#include <uapi/linux/bpf.h>
> +#include <uapi/linux/unistd.h>
> +#include "bpf_helpers.h"
> +#include <uapi/linux/errno.h>
> +
> +static inline int unknown(struct seccomp_data *ctx)
> +{
> + if (ctx->args[0] % 2 == 0)
> + return SECCOMP_RET_KILL;
> + return SECCOMP_RET_LOG;
> +}
> +
> +/* Returns errno on sched_yield syscall */
> +SEC("seccomp")
> +int bpf_prog1(struct seccomp_data *ctx)
> +{
> + if (ctx->nr == __NR_sched_yield)
> + return SECCOMP_RET_ERRNO | EPERM;
> +
> + return SECCOMP_RET_ALLOW;
> +}
> +
> +char _license[] SEC("license") = "aGPL";
Nit: these should check architecture before syscall number. Since
they're samples, people look at them for and copy them regularly, they
should be as safe/correct as possible.
-Kees
--
Kees Cook
Pixel Security
next parent reply other threads:[~2018-02-13 20:18 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20180213154320.GA3319@ircssh-2.c.rugged-nimbus-611.internal>
[not found] ` <20180213154320.GA3319-du9IEJ8oIxHXYT48pCVpJ3c7ZZ+wIVaZYkHkVr5ML8kVGlcevz2xqA@public.gmane.org>
2018-02-13 20:18 ` Kees Cook [this message]
2018-02-13 15:43 [PATCH net-next 3/3] bpf: Add eBPF seccomp sample programs Sargun Dhillon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAGXu5jK6o7515-5hfy=3aHZDCY3fryS522sB4RxgjJ4m67arZA__40570.991804316$1518553043$gmane$org@mail.gmail.com' \
--to=keescook-f7+t8e8rja9g9huczpvpmw@public.gmane.org \
--cc=ast-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=daniel-FeC+5ew28dpmcu3hnIyYJQ@public.gmane.org \
--cc=luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org \
--cc=netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=sargun-GaZTRHToo+CzQB+pC5nmwQ@public.gmane.org \
--cc=wad-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).