1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_ERRORCODE_H__
6 #define SANDBOX_LINUX_SECCOMP_BPF_ERRORCODE_H__
8 #include "sandbox/linux/sandbox_export.h"
9 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h"
10 #include "sandbox/linux/seccomp-bpf/trap.h"
14 struct arch_seccomp_data;
16 // This class holds all the possible values that can be returned by a sandbox
18 // We can either wrap a symbolic ErrorCode (i.e. ERR_XXX enum values), an
19 // errno value (in the range 0..4095), a pointer to a TrapFnc callback
20 // handling a SECCOMP_RET_TRAP trap, or a complex constraint.
21 // All of the commonly used values are stored in the "err_" field. So, code
22 // that is using the ErrorCode class typically operates on a single 32bit
24 class SANDBOX_EXPORT ErrorCode {
27 // Allow this system call. The value of ERR_ALLOWED is pretty much
28 // completely arbitrary. But we want to pick it so that is is unlikely
29 // to be passed in accidentally, when the user intended to return an
30 // "errno" (see below) value instead.
31 ERR_ALLOWED = 0x04000000,
33 // Deny the system call with a particular "errno" value.
34 // N.B.: It is also possible to return "0" here. That would normally
35 // indicate success, but it won't actually run the system call.
36 // This is very different from return ERR_ALLOWED.
38 // TODO(markus): Android only supports errno up to 255
39 // (crbug.com/181647).
43 // While BPF filter programs always operate on 32bit quantities, the kernel
44 // always sees system call arguments as 64bit values. This statement is true
45 // no matter whether the host system is natively operating in 32bit or 64bit.
46 // The BPF compiler hides the fact that BPF instructions cannot directly
47 // access 64bit quantities. But policies are still advised to specify whether
48 // a system call expects a 32bit or a 64bit quantity.
50 // When passed as an argument to SandboxBPF::Cond(), TP_32BIT requests that
51 // the conditional test should operate on the 32bit part of the system call
53 // On 64bit architectures, this verifies that user space did not pass
54 // a 64bit value as an argument to the system call. If it did, that will be
55 // interpreted as an attempt at breaking the sandbox and results in the
56 // program getting terminated.
57 // In other words, only perform a 32bit test, if you are sure this
58 // particular system call would never legitimately take a 64bit
60 // Implementation detail: TP_32BIT does two things. 1) it restricts the
61 // conditional test to operating on the LSB only, and 2) it adds code to
62 // the BPF filter program verifying that the MSB the kernel received from
63 // user space is either 0, or 0xFFFFFFFF; the latter is acceptable, iff bit
64 // 31 was set in the system call argument. It deals with 32bit arguments
65 // having been sign extended.
68 // When passed as an argument to SandboxBPF::Cond(), TP_64BIT requests that
69 // the conditional test should operate on the full 64bit argument. It is
70 // generally harmless to perform a 64bit test on 32bit systems, as the
71 // kernel will always see the top 32 bits of all arguments as zero'd out.
72 // This approach has the desirable property that for tests of pointer
73 // values, we can always use TP_64BIT no matter the host architecture.
74 // But of course, that also means, it is possible to write conditional
75 // policies that turn into no-ops on 32bit systems; this is by design.
80 // Test whether the system call argument is equal to the operand.
83 // Test whether the system call argument is greater (or equal) to the
84 // operand. Please note that all tests always operate on unsigned
85 // values. You can generally emulate signed tests, if that's what you
87 // TODO(markus): Check whether we should automatically emulate signed
90 OP_GREATER_EQUAL_UNSIGNED,
92 // Tests a system call argument against a bit mask.
93 // The "ALL_BITS" variant performs this test: "arg & mask == mask"
94 // This implies that a mask of zero always results in a passing test.
95 // The "ANY_BITS" variant performs this test: "arg & mask != 0"
96 // This implies that a mask of zero always results in a failing test.
100 // Total number of operations.
111 // We allow the default constructor, as it makes the ErrorCode class
112 // much easier to use. But if we ever encounter an invalid ErrorCode
113 // when compiling a BPF filter, we deliberately generate an invalid
114 // program that will get flagged both by our Verifier class and by
116 ErrorCode() : error_type_(ET_INVALID), err_(SECCOMP_RET_INVALID) {}
117 explicit ErrorCode(int err);
119 // For all practical purposes, ErrorCodes are treated as if they were
120 // structs. The copy constructor and assignment operator are trivial and
121 // we do not need to explicitly specify them.
122 // Most notably, it is in fact perfectly OK to directly copy the passed_ and
123 // failed_ field. They only ever get set by our private constructor, and the
124 // callers handle life-cycle management for these objects.
129 bool Equals(const ErrorCode& err) const;
130 bool LessThan(const ErrorCode& err) const;
132 uint32_t err() const { return err_; }
133 ErrorType error_type() const { return error_type_; }
135 bool safe() const { return safe_; }
137 uint64_t value() const { return value_; }
138 int argno() const { return argno_; }
139 ArgType width() const { return width_; }
140 Operation op() const { return op_; }
141 const ErrorCode* passed() const { return passed_; }
142 const ErrorCode* failed() const { return failed_; }
145 bool operator()(const ErrorCode& a, const ErrorCode& b) const {
146 return a.LessThan(b);
151 friend class CodeGen;
152 friend class SandboxBPF;
155 // If we are wrapping a callback, we must assign a unique id. This id is
156 // how the kernel tells us which one of our different SECCOMP_RET_TRAP
157 // cases has been triggered.
158 ErrorCode(Trap::TrapFnc fnc, const void* aux, bool safe, uint16_t id);
160 // Some system calls require inspection of arguments. This constructor
161 // allows us to specify additional constraints.
166 const ErrorCode* passed,
167 const ErrorCode* failed);
169 ErrorType error_type_;
172 // Fields needed for SECCOMP_RET_TRAP callbacks
174 Trap::TrapFnc fnc_; // Callback function and arg, if trap was
175 void* aux_; // triggered by the kernel's BPF filter.
176 bool safe_; // Keep sandbox active while calling fnc_()
179 // Fields needed when inspecting additional arguments.
181 uint64_t value_; // Value that we are comparing with.
182 int argno_; // Syscall arg number that we are inspecting.
183 ArgType width_; // Whether we are looking at a 32/64bit value.
184 Operation op_; // Comparison operation.
185 const ErrorCode* passed_; // Value to be returned if comparison passed,
186 const ErrorCode* failed_; // or if it failed.
190 // 32bit field used for all possible types of ErrorCode values. This is
191 // the value that uniquely identifies any ErrorCode and it (typically) can
192 // be emitted directly into a BPF filter program.
196 } // namespace sandbox
198 #endif // SANDBOX_LINUX_SECCOMP_BPF_ERRORCODE_H__