-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Whitelist syscalls on Linux amd64 with seccomp. Other Linux architectures have to be checked.
- Loading branch information
Showing
8 changed files
with
70 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| //go:build linux && amd64 && !openbsd && !unsafe | ||
|
|
||
| package security | ||
|
|
||
| import ( | ||
| seccomp "github.com/seccomp/libseccomp-golang" | ||
| ) | ||
|
|
||
| // IsHardened reports whether security sandbox is enabled. | ||
| const IsHardened = true | ||
|
|
||
| // Sandbox restrict application access to necessary system calls needed by | ||
| // network connections and standard i/o. | ||
| func Sandbox() error { | ||
| // How to create minimal whitelist: | ||
| // 1. Create empty list of allowed syscalls | ||
| // 2. Set `seccomp.ActLog` as default filter action | ||
| // 3. Compile and run program | ||
| // 4. Use `dmesg` to find logged syscalls (started with _audit_) | ||
| // 5. Translate syscalls numbers to names and add them to allowed list | ||
| // 6. Go to point 3 and repeat until no new audit logs | ||
| // 7. Reset default filter action to `seccomp.ActKillProcess` | ||
| allowedSyscalls := []string{ | ||
| // similar to stdio pledge | ||
| "clone3", "close", "epoll_create1", "epoll_ctl", "epoll_pwait", | ||
| "exit_group", "fcntl", "fstat", "futex", "getpid", "getrandom", | ||
| "getsockopt", "gettid", "mmap", "mprotect", "munmap", "nanosleep", | ||
| "pipe2", "read", "rseq", "rt_sigprocmask", "rt_sigreturn", | ||
| "sched_getaffinity", "sched_yield", "set_robust_list", "setsockopt", | ||
| "sigaltstack", "tgkill", "uname", "write", | ||
|
|
||
| // similar to inet pledge | ||
| "connect", "getpeername", "getsockname", "socket", | ||
|
|
||
| // similar to rpath pledge | ||
| "getdents64", "newfstatat", "openat", "readlinkat", | ||
| } | ||
|
|
||
| // By default goroutines don't play well with seccomp. Program will hang | ||
| // when underlying thread is terminated silently. We need to kill process - | ||
| // see: https://github.com/golang/go/issues/3405#issuecomment-750816828 | ||
| whitelist, err := seccomp.NewFilter(seccomp.ActKillProcess) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| for _, callName := range allowedSyscalls { | ||
| callId, err := seccomp.GetSyscallFromName(callName) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| whitelist.AddRule(callId, seccomp.ActAllow) | ||
| } | ||
| whitelist.Load() | ||
|
|
||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| //go:build openbsd && !unsafe | ||
| //go:build openbsd && !(linux && amd64) && !unsafe | ||
|
|
||
| package security | ||
|
|
||
|
|
||