marektamaskovic / strace2seccomp

strace2seccomp - generates libseccomp policies from strace logs

strace2seccomp - Bachelor's thesis

About

This bachelor's thesis is focused on an automatic generation of seccomp rules from strace logs. The output is generated in C/C++ syntax. Input can be optimized with three optimization algorithms. One is called strict, and it will produce 1:1 output compared to input. Another one is called minimax or weak. This algorithm will provide on the output only extremes as border values for allowance interval. The last one is called advanced which implements DBSCAN algorithm for clustering. The thesis can be found in another branch.

Usage

Usage:
	st2se [OPTION] filename ...

Generic options:
    -h [--help]			: print this message
    -v [--verbose]			: turn on verbose mode
    -d [--debug]			: turn on debug mode
    -t [--tracing]			: turn on debug mode
    -A [--analyze-grammar]		: analyze grammar
    -o FILE [--output=FILE]		: set output file

Configuration options:
    -w [--weak]			: use weak algotirthm
    -s [--strict]			: use strict algotirthm
    -a [--advanced]			: use advanced algotirthm
    --prolog				: generate function prolog
    --thread				: add filter synchronization among threads/processes
    --scOnly				: generate only syscall allowance

Examples

$ ./st2se -v -w --output=source.cpp filename1 filename2

In this case, we can see that verbose mode is turned on and minimax algorithm was chosen for the optimizer. The output of the program will be stored in source.cpp. Files filename1 and filename2 will be used as input.

$ ./st2se -w --output=source.cpp filename --thread --prolog

This command diverges only in the output format. The --thread will generate support for multithread or multiprocess applications and --prolog switch ensures that the filter will be located in function. This behavior is helpful for copy&paste output into an existing program.

$ ./st2se -A

When we want to check if the grammar in the parser is correct, we can use a built-in tool in parser library. This tool of the parser can be turned on with switch -A. On standard output will be printed number of found issues.

Compilation

Here will be shown how to compile the project

Dependencies

1. pegtl

• C++ parser library
• This library is already bundled in project.

2. MPark.Variant

• C++14 variant implementation
• This library is already bundled in project.

3. fmtlib

• C++ formating library
• This library is already bundled in project.

Compilation

To compile the project you must build the project in root directory of the project with make:

$ make release

If you want to make the project with the debug symbols you will run only make without any recipe:

$ make

If you want to make testsuite you will run

$ make check

Testing

Information about testsuite and how to run tests is located here.

Possible extensions

• Go language support,
• implement other algorithms,
• interactive allowance of rules combined with testsuite,
• switch between usage of local or system libraries.

Troubleshoot

• Problems with includes typicaly <mpark/variant> means that you haven't initialized submodules.

  Solution = $ git submodule update --init --recursive

strace2seccomp's Issues

Add clang-tidy recipe to Makefile

Create clang-tidy recipe
Check which checks are important.

Fix DBSCAN addresses clustering

There is error clustering addresses with DBSCAN algorithm.

Add doxygen

Add doxygen config and makefile recipe. Output should be in doc/doxygen

Remove debug output

Implement DBSCAN clustering

Implement DBSCAN clustering into project

Find a way to interpret multidimensional data

Find a way to interpret multidimensional data. Maybe contact the supervisor.

Create a specfile

Create a specfile

Remove boost

Please, consider removing boost dependency from this project. It is really overhead to use boost just due to one function (split).

 template<typename SequenceSequenceT, typename RangeT, typename PredicateT> 
      SequenceSequenceT & 
      split(SequenceSequenceT &, RangeT &, PredicateT, 
            token_compress_mode_type = token_compress_off);

Backport to c++14

Backport to c++14.

Interactive allowance of syscall

There should be an automated script which will generate the filter from strace afterward it will be applied into source code, compiled, run. The run should be monitored with strace or other system call monitoring tool which will provide the input for the automated script. That automated script should parse the last syscall that emitted the termination and interactively edit the previously generated filter. When the edit is finished it should generate a new filter that would be applied, etc. This will work in iterations until there will be a functional filter.

Unify variable names

Update sourcecode to new fmtlib 6.0.0 and remove local dependecy

Update sourcecode to new fmtlib 6.0.0

Move from astyle to clang-format

Write a config file for clang-format and remove astyle

Segfault

There is a segfault in source_dev branch.
Reproducer:

> ./st2se -s filename

where filename contains:
recvfrom(3, ""..., 10, MSG_PEEK|MSG_TRUNC, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("147.229.254.98")}, [16]) = 56 recvfrom(3, ""..., 10, MSG_PEEK|MSG_TRUNC, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("217.67.19.197")}, [16]) = 84 recvfrom(3, ""..., 2048, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.0.1")}, [28->16]) = 82 recvfrom(3, ""..., 56, MSG_TRUNC, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("147.229.254.98")}, [16]) = 56 recvfrom(3, ""..., 65536, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.0.1")}, [28->16]) = 79 recvfrom(3, ""..., 84, MSG_TRUNC, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("217.67.19.197")}, [16]) = 84

Fix some issues generated by clang-tidy

Fix most of the errors and warnings generated by clang-tidy.

Fix weak algortihm

constants bitfields

Document source code

Document the source code for doxygen.

add codeowners

https://help.github.com/en/articles/about-code-owners

Rename algorithm files according to algorithm they use

Algorithm_weak -> algorithm_minimax
Algorithm_advanced -> algorithm_dbscan

Link ISA-testovac repository to testsuite

Link ISA-testovac repository to testsuite
Create patches for runnig with strace and for loading libseccomp rules

Implement output generator for Go and libseccomp combination

Implement output generator for Go using libseccomp.

Fix showing zero instead of argument count in output source code

Fix showing zero instead of argument count in output source code

Parametrize template source code

remove hardcoded paths to source code template.

Implement dump of formated output after parsing part

Implement dump of formated output after parsing part (Something like dump of parsed objects).
Implement load of that dump.

Move all operators to one .cpp file

Move all operators for custom classes and types to operators.cpp and operators.hpp file.

Create a pkgbuild file

create a pkgbuild file (archlinux)

Add all necessary dependencies to VagrantFile

• clang-tidy
• libc++

Implement output generator for C/C++ and libseccomp combination

Implement output generator for C/C++ using libseccomp.

Test DBSCAN clustering

Create some test suite for DBSCAN clustering.

cpp11_support.hpp missing

I think you forgot to include (git add ...?) the cpp11_support.hpp in PR#41...

~/P/strace2seccomp> make
make[1]: Entering directory '/home/user/Projects/strace2seccomp/src'
make[1]: *** No rule to make target 'cpp11_support.hpp', needed by 'main.o'.  Stop.
make[1]: Leaving directory '/home/user/Projects/strace2seccomp/src'
make: *** [Makefile:7: all] Error 2

Fix clustered output

Add configure script Automake/Cmake/Meson

Create configure script

Unit tests

Create unit tests