1 // Copyright 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 // Seccomp BPF helper functions, modified from the Chromium OS version. The
16 // original notice is below.
17 //
18 // Copyright (c) 2012 The Chromium OS Authors <[email protected]>
19 // Author: Will Drewry <[email protected]>
20 //
21 // The code may be used by anyone for any purpose,
22 // and can serve as a starting point for developing
23 // applications using prctl(PR_ATTACH_SECCOMP_FILTER).
24
25 #include "sandboxed_api/sandbox2/util/bpf_helper.h"
26
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <string.h>
30
bpf_resolve_jumps(struct bpf_labels * labels,struct sock_filter * filter,size_t count)31 int bpf_resolve_jumps(struct bpf_labels *labels,
32 struct sock_filter *filter, size_t count)
33 {
34 size_t i;
35
36 if (count < 1 || count > BPF_MAXINSNS)
37 return -1;
38 /*
39 * Walk it once, backwards, to build the label table and do fixups.
40 * Since backward jumps are disallowed by BPF, this is easy.
41 */
42 for (i = 0; i < count; ++i) {
43 size_t offset = count - i - 1;
44 struct sock_filter *instr = &filter[offset];
45 if (instr->code != (BPF_JMP+BPF_JA))
46 continue;
47 switch ((instr->jt<<8)|instr->jf) {
48 case (JUMP_JT<<8)|JUMP_JF:
49 if (labels->labels[instr->k].location == 0xffffffff) {
50 fprintf(stderr, "Unresolved label: '%s'\n",
51 labels->labels[instr->k].label);
52 return 1;
53 }
54 instr->k = labels->labels[instr->k].location -
55 (offset + 1);
56 instr->jt = 0;
57 instr->jf = 0;
58 continue;
59 case (LABEL_JT<<8)|LABEL_JF:
60 if (labels->labels[instr->k].location != 0xffffffff) {
61 fprintf(stderr, "Duplicate label use: '%s'\n",
62 labels->labels[instr->k].label);
63 return 1;
64 }
65 labels->labels[instr->k].location = offset;
66 instr->k = 0; /* fall through */
67 instr->jt = 0;
68 instr->jf = 0;
69 continue;
70 }
71 }
72 return 0;
73 }
74
75 /* Simple lookup table for labels. */
seccomp_bpf_label(struct bpf_labels * labels,const char * label)76 __u32 seccomp_bpf_label(struct bpf_labels *labels, const char *label)
77 {
78 struct __bpf_label *begin = labels->labels, *end;
79 int id;
80
81 if (labels->count == BPF_LABELS_MAX) {
82 fprintf(stderr, "Too many labels\n");
83 exit(1);
84 }
85 if (labels->count == 0) {
86 begin->label = label;
87 begin->location = 0xffffffff;
88 labels->count++;
89 return 0;
90 }
91 end = begin + labels->count;
92 for (id = 0; begin < end; ++begin, ++id) {
93 if (!strcmp(label, begin->label))
94 return id;
95 }
96 begin->label = label;
97 begin->location = 0xffffffff;
98 labels->count++;
99 return id;
100 }
101
seccomp_bpf_print(struct sock_filter * filter,size_t count)102 void seccomp_bpf_print(struct sock_filter *filter, size_t count)
103 {
104 struct sock_filter *end = filter + count;
105 for ( ; filter < end; ++filter)
106 printf("{ code=%u,jt=%u,jf=%u,k=%u },\n",
107 filter->code, filter->jt, filter->jf, filter->k);
108 }
109