Compare commits

...

5 Commits

Author SHA1 Message Date
Gorgeous-Patrick
fa6ddd2119
Merge 369229e0d5 into 5f66dc11f5 2025-08-14 20:46:04 +05:30
criyle
5f66dc11f5 fix(config): fix syscall check on arm64 2025-08-13 22:22:53 +00:00
Patrick Li
369229e0d5 fix: allow more essential syscalls 2024-12-05 18:36:33 -05:00
Gorgeous-Patrick
d58b2485a2 test: makefile for test 2024-12-05 14:56:57 -05:00
Gorgeous-Patrick
6407c89d90 DOCKER NOT WORKING 2024-12-05 14:47:05 -05:00
12 changed files with 83 additions and 87 deletions

3
.gitignore vendored
View File

@ -2,7 +2,6 @@
.DS_Store
# Test Env
test*/
env*.sh
# Test Files
@ -10,3 +9,5 @@ env*.sh
/test
.vscode
runprog
*.test

7
Dockerfile Normal file
View File

@ -0,0 +1,7 @@
FROM golang
COPY . /app
WORKDIR /app/cmd/runprog
RUN apt update && apt install -y gcc libstdc++6 libseccomp-dev
RUN go build

View File

@ -16,6 +16,10 @@ var (
"/dev/urandom",
"/proc/meminfo",
"/etc/localtime",
"/usr/lib/libstdc++.so.6",
"/usr/lib/libc.so.6",
"/usr/lib/libm.so.6",
"/usr/lib/libgcc_s.so.1",
}
// default write permission files
@ -32,7 +36,6 @@ var (
"fstat",
"lseek",
"dup",
"dup2",
"dup3",
"ioctl",
"fcntl",
@ -65,16 +68,24 @@ var (
"exit_group",
// others
"arch_prctl",
"gettimeofday",
"getrlimit",
"getrusage",
"times",
"time",
"clock_gettime",
"restart_syscall",
"futex",
"gettid",
"getpid",
"prlimit64",
"getrandom",
"set_tid_address",
"set_robust_list",
"rseq",
"newfstatat",
}
// default syscalls to trace
@ -84,21 +95,15 @@ var (
"execveat",
// file open
"open",
"openat",
// file delete
"unlink",
"unlinkat",
// soft link
"readlink",
"readlinkat",
// permission check
"lstat",
"stat",
"access",
"faccessat",
}
@ -108,71 +113,11 @@ var (
// config for different type of program
// workpath and arg0 have additional read / stat permission
runptraceConfig = map[string]ProgramConfig{
"python2.7": {
Syscall: SyscallConfig{
ExtraAllow: []string{
"futex", "getdents", "getdents64", "prlimit64", "getpid", "sysinfo",
},
ExtraCount: map[string]int{
"set_tid_address": 1,
"set_robust_list": 1,
},
},
FileAccess: FileAccessConfig{
ExtraRead: []string{
"/usr/bin/python2.7",
"/usr/lib/python2.7/",
"/usr/bin/lib/python2.7/",
"/usr/local/lib/python2.7/",
"/usr/lib/pymodules/python2.7/",
"/usr/bin/Modules/",
"/usr/bin/pybuilddir.txt",
"/usr/lib/locale/",
"./answer.code",
},
ExtraStat: []string{
"/usr", "/usr/bin",
},
},
RunCommand: []string{"/usr/bin/python2.7", "-E", "-s", "-B"},
},
"python3": {
Syscall: SyscallConfig{
ExtraAllow: []string{
"futex", "getdents", "getdents64", "prlimit64", "getpid", "sysinfo", "getrandom",
},
ExtraCount: map[string]int{
"set_tid_address": 1,
"set_robust_list": 1,
},
},
FileAccess: FileAccessConfig{
ExtraRead: []string{
"/usr/bin/python3",
"/usr/lib/python3/",
"/usr/bin/python3.6",
"/usr/lib/python3.6/",
"/usr/bin/lib/python3.6/",
"/usr/local/lib/python3.6/",
"/usr/bin/pyvenv.cfg",
"/usr/pyvenv.cfg",
"/usr/bin/Modules",
"/usr/bin/pybuilddir.txt",
"/usr/lib/dist-python",
"/usr/lib/locale/",
"./answer.code",
},
ExtraStat: []string{
"/usr", "/usr/bin", "/usr/lib", "/usr/lib/python36.zip",
},
},
RunCommand: []string{"/usr/bin/python3", "-I", "-B"},
},
"compiler": {
Syscall: SyscallConfig{
ExtraAllow: []string{
"gettid", "set_tid_address", "set_robust_list", "futex",
"getpid", "vfork", "fork", "clone", "execve", "wait4",
"set_tid_address", "set_robust_list", "futex",
"vfork", "fork", "clone", "execve", "wait4",
"clock_gettime", "clock_getres",
"setrlimit", "pipe",
"getdents64", "getdents",

View File

@ -8,7 +8,19 @@ var (
"/usr/lib/x86_64-linux-gnu/",
}
archSyscallAllows = []string{}
archSyscallAllows = []string{
"dup2",
"time",
"arch_prctl",
}
archSyscallTraces = []string{}
archSyscallTraces = []string{
"open",
"unlink",
"readlink",
"lstat",
"stat",
"access",
"newfstatat",
}
)

View File

@ -17,10 +17,19 @@ var (
"uname",
"set_tls",
"arm_fadvise64_64",
"dup2",
}
archSyscallTraces = []string{
"lstat64", // 32-bit
"stat64", // 32-bit
"open",
"unlink",
"readlink",
"lstat",
"stat",
"access",
"fstatat",
"fstatat64",
}
)

View File

@ -8,9 +8,9 @@ var (
"/usr/lib/aarch64-linux-gnu/",
}
archSyscallAllows = []string{
"newfstatat",
}
archSyscallAllows = []string{}
archSyscallTraces = []string{}
archSyscallTraces = []string{
"fstatat",
}
)

4
go.mod
View File

@ -4,6 +4,6 @@ go 1.24
require (
github.com/elastic/go-seccomp-bpf v1.6.0
golang.org/x/net v0.41.0
golang.org/x/sys v0.33.0
golang.org/x/net v0.43.0
golang.org/x/sys v0.35.0
)

8
go.sum
View File

@ -6,9 +6,9 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

View File

@ -66,11 +66,12 @@ func (h *tracerHandler) Handle(ctx *ptracer.Context) ptracer.TraceAction {
return ptracer.TraceKill
}
// not checking dirfd for now (maybe unsafe)
action := ptracer.TraceKill
switch syscallName {
case "open":
action = h.checkOpen(ctx, ctx.Arg0(), ctx.Arg1())
case "openat":
case "openat", "openat2":
action = h.checkOpen(ctx, ctx.Arg1(), ctx.Arg2())
case "readlink":
@ -85,13 +86,15 @@ func (h *tracerHandler) Handle(ctx *ptracer.Context) ptracer.TraceAction {
case "access":
action = h.checkStat(ctx, ctx.Arg0())
case "faccessat", "newfstatat":
case "faccessat", "faccessat2":
action = h.checkStat(ctx, ctx.Arg1())
case "stat", "stat64":
action = h.checkStat(ctx, ctx.Arg0())
case "lstat", "lstat64":
action = h.checkStat(ctx, ctx.Arg0())
case "statx", "fstatat", "fstatat64", "newfstatat":
action = h.checkStat(ctx, ctx.Arg1())
case "execve":
action = h.checkRead(ctx, ctx.Arg0())

10
test_c/Makefile Normal file
View File

@ -0,0 +1,10 @@
all: helloworld/main.test nonzeroexit/main.test
helloworld/main.test: helloworld/main.cpp
g++ helloworld/main.cpp -o helloworld/main.test -DNDEBUG -O3
nonzeroexit/main.test: nonzeroexit/main.cpp
g++ nonzeroexit/main.cpp -o nonzeroexit/main.test -DNDEBUG -O3
clean:
rm -rf helloworld/*.test nonzeroexit/*.test

View File

@ -0,0 +1,6 @@
#include<iostream>
int main() {
std::cout << "Hello, world" << std::endl;
return 0;
}

View File

@ -0,0 +1,3 @@
int main() {
return 100;
}