lkml.org 
[lkml]   [2012]   [Apr]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectANN: libseccomp
Date
With the seccomp patches finally stabilizing a bit, it seems like now is a 
good time to announce libseccomp: a library designed to make it easier to
create complex, architecture independent seccomp filters.

* http://sourceforge.net/projects/libseccomp/
* git clone git://git.code.sf.net/p/libseccomp/libseccomp

The library has only been in development for the past couple months, so it may
be a little rough around the edges, and definitely could use more testing, but
it is functional and has had some basic testing against the seccomp v17
patches. The project currently lacks any online documentation or a website
beyond the basic SF.net tools, but there are current man pages in the source
repository and the code is reasonably well commented.

For those of you who are interested in making use of the library, or
contributing to its development and testing, we do have a mailing list setup
(see the To/CC line above) and you can subscribe at the link below; all are
welcome.

* https://lists.sourceforge.net/lists/listinfo/libseccomp-discuss

To demonstrate some of the basic libseccomp capabilities, I've included a
short example below. The example is trivial, it opens /dev/zero and writes to
/dev/null, but it shows how to use libseccomp to create a simple filter and
load it into the kernel; filtering both on just the syscall and a syscall with
specific arguments.

> #include <errno.h>
> #include <stdlib.h>
> #include <stdio.h>
> #include <unistd.h>
>
> #include <seccomp.h>
>
> #define BUF_LEN 256
>
> int main(int argc, char *argv[])
> {
> int rc;
> FILE *read_stream, *write_stream;
> unsigned char buf[BUF_LEN];
> size_t op_len;
>
> /* initialize the seccomp filter */
> printf("scmp: initializing the seccomp filter ...");
> rc = seccomp_init(SCMP_ACT_KILL);
> if (rc < 0)
> goto failure_scmp;
> printf("ok\n");
>
> /* do the setup */
> printf("info: opening /dev/zero for reading ... ");
> read_stream = fopen("/dev/zero", "r");
> if (read_stream == NULL)
> goto failure;
> printf("ok\n");
> printf("info: opening /dev/null for writing ... ");
> write_stream = fopen("/dev/null", "w");
> if (write_stream == NULL)
> goto failure;
> printf("ok\n");
>
> /* configure the seccomp filter */
> printf("scmp: configuring the seccomp_filter ... ");
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(read), 1,
> SCMP_A0(SCMP_CMP_EQ, fileno(read_stream)));
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
> SCMP_A0(SCMP_CMP_EQ, STDOUT_FILENO));
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
> SCMP_A0(SCMP_CMP_EQ, STDERR_FILENO));
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
> SCMP_A0(SCMP_CMP_EQ, fileno(write_stream)));
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(close), 0);
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(fstat), 0);
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(ioctl), 0);
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0);
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 0);
> if (rc < 0)
> goto failure_scmp;
> rc = seccomp_rule_add(SCMP_ACT_ALLOW, SCMP_SYS(munmap), 0);
> if (rc < 0)
> goto failure_scmp;
> printf("ok\n");
>
> /* load the seccomp filter into the kernel */
> printf("scmp: load the filter ... ");
> rc = seccomp_load();
> if (rc < 0)
> goto failure_scmp;
> seccomp_release();
> printf("ok\n");
>
> /* perform the i/o */
> printf("info: attempting to read BUF_LEN bytes ... ");
> op_len = fread(buf, BUF_LEN, 1, read_stream);
> if (op_len != 1)
> return errno;
> printf("ok\n");
>
> printf("info: attempting to write BUF_LEN bytes ... ");
> op_len = fwrite(buf, BUF_LEN, 1, write_stream);
> if (op_len != 1)
> return errno;
> printf("ok\n");
>
> /* shutdown */
> printf("info: closing file streams and exiting\n");
> fclose(write_stream);
> fclose(read_stream);
> return 0;
>
> failure_scmp:
> errno = -rc;
> failure:
> /* oops ... */
> printf("failed, errno = %u\n", errno);
> return errno;
> }

--
paul moore
www.paul-moore.com



\
 
 \ /
  Last update: 2012-04-09 21:01    [W:0.112 / U:0.476 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site