#include<fcntl.h>#include<stdio.h>#include<unistd.h>#include<string.h>#include<linux/seccomp.h>#include<sys/prctl.h>//From https://sysdig.com/blog/selinux-seccomp-falco-technical-discussion///gcc seccomp_strict.c -o seccomp_strictintmain(int argc,char**argv){int output =open("output.txt", O_WRONLY);constchar*val ="test";//enables strict seccomp modeprintf("Calling prctl() to set seccomp strict mode...\n");prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT);//This is allowed as the file was already openedprintf("Writing to an already open file...\n");write(output, val, strlen(val)+1);//This isn't allowedprintf("Trying to open file for reading...\n");int input =open("output.txt", O_RDONLY);printf("You will not see this message--the process will be killed first\n");}
Seccomp-bpf
此模式允许使用可配置策略过滤系统调用，该策略是通过伯克利数据包过滤器规则实现的。
seccomp_bpf.c
#include<seccomp.h>#include<unistd.h>#include<stdio.h>#include<errno.h>//https://security.stackexchange.com/questions/168452/how-is-sandboxing-implemented/175373//gcc seccomp_bpf.c -o seccomp_bpf -lseccompvoidmain(void) {/* initialize the libseccomp context */scmp_filter_ctx ctx =seccomp_init(SCMP_ACT_KILL);/* allow exiting */printf("Adding rule : Allow exit_group\n");seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group),0);/* allow getting the current pid *///printf("Adding rule : Allow getpid\n");//seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getpid), 0);printf("Adding rule : Deny getpid\n");seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EBADF), SCMP_SYS(getpid),0);/* allow changing data segment size, as required by glibc */printf("Adding rule : Allow brk\n");seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(brk),0);/* allow writing up to 512 bytes to fd 1 */printf("Adding rule : Allow write upto 512 bytes to FD 1\n");seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write),2,SCMP_A0(SCMP_CMP_EQ,1),SCMP_A2(SCMP_CMP_LE,512));/* if writing to any other fd, return -EBADF */printf("Adding rule : Deny write to any FD except 1 \n");seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EBADF), SCMP_SYS(write),1,SCMP_A0(SCMP_CMP_NE,1));/* load and enforce the filters */printf("Load rules and enforce \n");seccomp_load(ctx);seccomp_release(ctx);//Get the getpid is denied, a weird number will be returned like//this process is -9printf("this process is %d\n", getpid());}
