Seccomp filtering is a mechanism in the linux kernel that restricts the use of 
certain syscalls in your application. When your application is hacked or 
manipulated, and tries to call those disabled syscalls the kernel will kill 
your application.

For example, if you application needs to open files at the beginning, but then 
just appends to the files, you can drop the open/openat syscalls after you've 
opened the file.

We have a nice nim module that is very easy to use. 
<https://github.com/FedericoCeratto/nim-seccomp>
    
    
    import seccomp
    
    proc dropRights() =
      let ctx = seccomp_ctx()
      ctx.add_rule(Allow, "write")
      ctx.add_rule(Allow, "close")
      ctx.add_rule(Allow, "newfstatat")
      ctx.add_rule(Allow, "exit_group")
      # ctx.add_rule(Allow, "mmap") # needed for dynamic seq + strings etc
      ctx.load()
    
    # here open is still allowed
    let fh = open("/tmp/foo", fmWrite)
    
    dropRights() # here we drop all syscalls except the allowed ones
    echo "[x] Rights dropped"
    
    
    fh.write("write does still works")
    echo "[x] write works"
    
    # This will fail, since we've dropped the rights above.
    echo "[x] hacker tries to open another file:"
    let fh2 = open("/tmp/baa", fmWrite)
    
    
    
    Run

The output:
    
    
    Hint: /home/david/projects/nimPlayground/seccompt202401291758 [Exec]
    [x] Rights dropped
    [x] write works
    [x] hacker tries to open another file:
    Bad system call (core dumped)
    Error: execution of an external program failed: 
'/home/david/projects/nimPlayground/seccompt202401291758
    
    
    Run

When you need to know which syscalls is used you can use strace
    
    
    strace ./yourApplication
    
    
    Run
    
    
    [.....]
    newfstatat(3, "", {st_mode=S_IFREG|0664, st_size=0, ...}, AT_EMPTY_PATH) = 0
    write(1, "[x] write works\n", 16[x] write works
    )       = 16
    write(1, "[x] hacker tries to open another"..., 39[x] hacker tries to open 
another file:
    ) = 39
    openat(AT_FDCWD, "/tmp/baa", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 
257 # <---------- here we try to use "openat"
    +++ killed by SIGSYS (core dumped) +++    <--------- and here its killed
    Bad system call (core dumped)
    [ble: exit 159]
    
    
    Run

There is also a nice talk about this from a german hacker FeFe held at the CCC: 
<https://www.youtube.com/watch?v=TaE28fJVPTk>

Reply via email to