AC_CHECK_DECL([SCMP_ARCH_NATIVE], [have_libseccomp_filter=1], , [

	#include <sys/types.h>

	#include <seccomp.h>

])

if test "x$have_libseccomp_filter" = "x1" ; then

	AC_CHECK_LIB([seccomp], [seccomp_init],

				 [LIBS="$LIBS -lseccomp"],

				 [have_libseccomp_filter=0])

fi

elif test "x$sandbox_arg" = "xlibseccomp_filter" || \

     ( test -z "$sandbox_arg" && \

       test "x$have_libseccomp_filter" = "x1" ) ; then

	test "x$have_libseccomp_filter" != "x1" && \

		AC_MSG_ERROR([libseccomp_filter sandbox not supported on $host])

        SANDBOX_STYLE="libseccomp_filter"

        AC_DEFINE([SANDBOX_LIBSECCOMP_FILTER], [1], [Sandbox using libseccomp filter])

/*

 * Copyright (c) 2012 Will Drewry <wad@dataspill.org>

 *

 * Permission to use, copy, modify, and distribute this software for any

 * purpose with or without fee is hereby granted, provided that the above

 * copyright notice and this permission notice appear in all copies.

 *

 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 */

#include "includes.h"

#ifdef SANDBOX_LIBSECCOMP_FILTER

#include <sys/types.h>

#include <sys/resource.h>

#include <seccomp.h>

#include <errno.h>

#include <signal.h>

#include <stdarg.h>

#include <stddef.h>  /* for offsetof */

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

#include "log.h"

#include "ssh-sandbox.h"

#include "xmalloc.h"

struct ssh_sandbox {

	pid_t child_pid;

};

struct ssh_sandbox *

ssh_sandbox_init(struct monitor *monitor)

{

	struct ssh_sandbox *box;

	/*

	 * Strictly, we don't need to maintain any state here but we need

	 * to return non-NULL to satisfy the API.

	 */

	debug3("%s: preparing libseccomp filter sandbox", __func__);

	box = xcalloc(1, sizeof(*box));

	box->child_pid = 0;

	return box;

}

static int

seccomp_add_secondary_archs(scmp_filter_ctx *c)

{

#if defined(__i386__) || defined(__x86_64__)

	int r;

	r = seccomp_arch_add(c, SCMP_ARCH_X86);

	if (r < 0 && r != -EEXIST)

		return r;

	r = seccomp_arch_add(c, SCMP_ARCH_X86_64);

	if (r < 0 && r != -EEXIST)

		return r;

	r = seccomp_arch_add(c, SCMP_ARCH_X32);

	if (r < 0 && r != -EEXIST)

		return r;

#endif

	return 0;

}

struct scmp_action_def {

	uint32_t action;

	int syscall;

};

static const struct scmp_action_def preauth_insns[] = {

	{SCMP_ACT_ERRNO(EACCES), SCMP_SYS(open)},

	{SCMP_ACT_ERRNO(EACCES), SCMP_SYS(stat)},

	{SCMP_ACT_ALLOW, SCMP_SYS(getpid)},

	{SCMP_ACT_ALLOW, SCMP_SYS(getpid)},

	{SCMP_ACT_ALLOW, SCMP_SYS(gettimeofday)},

	{SCMP_ACT_ALLOW, SCMP_SYS(clock_gettime)},

#ifdef __NR_time /* not defined on EABI ARM */

	{SCMP_ACT_ALLOW, SCMP_SYS(time)},

#endif

	{SCMP_ACT_ALLOW, SCMP_SYS(read)},

	{SCMP_ACT_ALLOW, SCMP_SYS(write)},

	{SCMP_ACT_ALLOW, SCMP_SYS(close)},

#ifdef __NR_shutdown /* not defined on archs that go via socketcall(2) */

	{SCMP_ACT_ALLOW, SCMP_SYS(shutdown)},

#endif

	{SCMP_ACT_ALLOW, SCMP_SYS(brk)},

	{SCMP_ACT_ALLOW, SCMP_SYS(poll)},

#ifdef __NR__newselect

	{SCMP_ACT_ALLOW, SCMP_SYS(_newselect)},

#endif

	{SCMP_ACT_ALLOW, SCMP_SYS(select)},

	{SCMP_ACT_ALLOW, SCMP_SYS(madvise)},

#ifdef __NR_mmap2 /* EABI ARM only has mmap2() */

	{SCMP_ACT_ALLOW, SCMP_SYS(mmap2)},

#endif

#ifdef __NR_mmap

	{SCMP_ACT_ALLOW, SCMP_SYS(mmap)},

#endif

#ifdef __dietlibc__

	{SCMP_ACT_ALLOW, SCMP_SYS(mremap)},

	{SCMP_ACT_ALLOW, SCMP_SYS(exit)},

#endif

	{SCMP_ACT_ALLOW, SCMP_SYS(munmap)},

	{SCMP_ACT_ALLOW, SCMP_SYS(exit_group)},

#ifdef __NR_rt_sigprocmask

	{SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask)},

#else

	{SCMP_ACT_ALLOW, SCMP_SYS(sigprocmask)},

#endif

	{0, 0}

};

void

ssh_sandbox_child(struct ssh_sandbox *box)

{

	scmp_filter_ctx *seccomp;

	struct rlimit rl_zero;

	const struct scmp_action_def *insn;

	int r;

	/* Set rlimits for completeness if possible. */

	rl_zero.rlim_cur = rl_zero.rlim_max = 0;

	if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)

		fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",

			__func__, strerror(errno));

	if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)

		fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",

			__func__, strerror(errno));

	if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)

		fatal("%s: setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",

			__func__, strerror(errno));

	seccomp = seccomp_init(SCMP_ACT_KILL);

	if (!seccomp)

		fatal("%s:libseccomp activation failed", __func__);

	if (seccomp_add_secondary_archs(seccomp))

		fatal("%s:libseccomp secondary arch setup failed", __func__);

	for (insn = preauth_insns; insn->action; insn++) {

		if (seccomp_rule_add(seccomp, insn->action, insn->syscall, 0) < 0)

			fatal("%s:libseccomp rule failed", __func__);

	}

	if ((r = seccomp_load(seccomp)) < 0)

		fatal("%s:libseccomp unable to load filter %d", __func__, r);

	seccomp_release(seccomp);

}

void

ssh_sandbox_parent_finish(struct ssh_sandbox *box)

{

	free(box);

	debug3("%s: finished", __func__);

}

void

ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid)

{

	box->child_pid = child_pid;

}

#endif /* SANDBOX_LIBSECCOMP_FILTER */