small reproducer

test.c (text/x-csrc), 1.62 KB, created by Andreas Fink on 2021-12-03 12:22:30 UTC

#define _GNU_SOURCE
#include <err.h>
#include <errno.h>
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/utsname.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <seccomp.h>
#include <signal.h>
#include <unistd.h>

#define SECCOMP_REG(_ctx, _reg) ((_ctx)->uc_mcontext.gregs[(_reg)])
#define SECCOMP_RESULT(_ctx)    SECCOMP_REG(_ctx, REG_RAX)
void sigsys_handler(int signum, siginfo_t *info, void *vctx) {
    static int ctr = 0;
    ucontext_t * ctx = vctx;
    intptr_t ret_val = 0;
    if (++ctr > 1)
        ret_val = -13; // EACCESS
    SECCOMP_RESULT(ctx) = (greg_t)ret_val;
}

static void sandbox(void)
{
    /* allow all syscalls by default */
    scmp_filter_ctx seccomp_ctx = seccomp_init(SCMP_ACT_ALLOW);
    if (!seccomp_ctx)
        err(1, "seccomp_init failed");

    /* kill the process, if it tries to use "newfstatat" syscall */
    if (seccomp_rule_add_exact(seccomp_ctx, SCMP_ACT_TRAP, seccomp_syscall_resolve_name("newfstatat"), 0)) {
        perror("seccomp_rule_add_exact failed");
        exit(1);
    }

    /* apply the composed filter */
    if (seccomp_load(seccomp_ctx)) {
        perror("seccomp_load failed");
        exit(1);
    }

    /* release allocated context */
    seccomp_release(seccomp_ctx);
}


int main(int argc, char** argv) {
    struct sigaction sa, old_sa;
    sa.sa_sigaction = sigsys_handler;
    sa.sa_flags = SA_SIGINFO | SA_NODEFER;
    sigaction(SIGSYS, &sa, &old_sa);
    sandbox();
    struct passwd *pwd = getpwuid(getuid());
    if (pwd) {
        printf("%s\n", pwd->pw_name);
    } else {
        perror("getpwuid failed\n");
    }
    return 0;
}