subconsciouscompute / seccomp-pledge

seccomp-BPF filtering and pledge/unveil sandboxing for Linux

seccomp-pledge

Introduction

seccomp-pledge is a systems hardening tool for Linux that marries seccomp-bpf to pledge and unveil.

For reference, seccomp-bpf is a feature in the Linux kernel that allows specifying filters for system calls spawned by processes in the form of Berkeley Packet Filter (BPF) programs. A configurable set of policies (Allow, Errno, Trap, etc.) determines the kind of filtering that will be applied to system calls intercepted by seccomp. This minimizes the attack surface of the kernel that is exposed to userland applications.

pledge is a sandboxing mechanism implemented in OpenBSD that restricts the operational capabilities of processes by defining a set of promises that determine the system calls which will be made unavailable to the respective process. It has been ported to Linux as a standalone binary by Justine Tunney. Find more information about pledge here.

unveil is another OpenBSD sandboxing mechanism that is used to provide path permissions to processes. By default, a pledge sandbox will restrict access to the entire filesystem. It is possible to allow a process access to some path using unveil if required. The type of permissions granted (read-only, read-write, etc.) can also be specified. Justine Tunney's pledge port incorporates support for unveil.

This tool upholds the principle of the least privilege (PoLP) and limits processes to exactly what they are designed for, disallowng any non-essential operations as desired. It will cause core dumps if the user blocks a syscall that is fundamental to the execution of the process, which implies that the seccomp filters need to be constructed with care and pledge promises must be chosen appropriately.

A detailed list of syscalls with an explanation of the parameters can be found here.

Supported platforms

Since seccomp is Linux-specific, syscall filtering using this feature is supported only on Linux systems. Non-Linux systems will have to proceed without seccomp-bpf filters.

Features

• Accept the process to be executed (with optional flags) as an argument
• Perform optional dependency checking
• Display the list of syscalls (name and arguments) spawned by the process using lurk
• Use seccompiler as a high-level interface for defining seccomp-bpf filters
• Serialize the syscall list and filter list into JSON objects using serde and save at current path for later reference
• Install user-defined filters as BPF programs for current and child processes
• Support for running in three modes: interactively, non-interactively by directly supplying all necessary arguments during execution and via a Unix IPC socket as an API layer for communication
• Optionally fetch Justine Tunney's Linux port of pledge from upstream or use the local version to wrap around command invocations
• Provide intuitive prompts to simplify the process of constructing seccomp filters and selecting pledge promises and unveil path permissions

Dependencies

seccomp-pledge has the following dependencies:

• seccompiler - Provides easy-to-use Linux seccomp-bpf jailing
• lurk - A pretty (simple) alternative to strace
• pledge - Linux port of OpenBSD's pledge(2)
• serde - Framework for (de)serializing data structures in Rust
• wget - Retrieve files from the web using HTTP(S)
• optional-field - Provides a Rust type for values that can be missing/null

Installation

To run seccomp-pledge, ensure cargo is installed on your system and follow these steps:

git clone https://github.com/DeviousCilantro/seccomp-pledge.git
cd seccomp-pledge
cargo build --release
./target/release/seccomp-pledge [FLAGS] [COMMAND]

Usage

Here is a quick overview of seccomp-pledge:

USAGE:
    <path to seccomp-pledge binary> [--check | --no-check] [--local | --remote] [--api | --no-api] [COMMAND]...
    
ARGS:
    <command>... Sandbox command

FLAGS:
    --check
        Proceed with dependency checking
    --no-check
        Continue without dependency checking
    --local
        Use the local pledge binary supplied
    --remote
        Fetch remote pledge binary from upstream using wget
    --api
        Communicate via Unix socket API
    --no-api
        Disable Unix socket API
    -v [PERMS]:PATH
        Unveil path. Defaults to read-only operations
    -p  PROMISES
        Specify the pledge promises to be granted to the process. Defaults to 'stdio rpath'

When the -v and -p flags are supplied, seccomp-pledge will run in non-interactive mode, assuming all the necessary arguments have been provided during execution. This skips seccomp filtering.

When the --api flag is supplied, seccomp-pledge will run in API mode, creating a Unix socket at /tmp/seccomp-pledge.sock which can then be used for communication using, for instance, the Linux port of OpenBSD's netcat available in most package manager repositories. After installing netcat, run the following command to use the socket: nc -U /tmp/seccomp-pledge.sock

Otherwise, seccomp-pledge runs in standard interactive mode, guiding the user through the different stages of creating the seccomp filtering policy and defining the pledge sandbox.

Demonstrations

This is a series of demonstrations on the three modes of using seccomp-pledge for sandboxing, for instance, ls. The pledge promises supplied are stdio, rpath, and tty and the current directory is unveiled with the default read-only permissions. seccomp filtering is disabled for the non-interactive mode.

Non-interactive mode:

Interactive mode:

API mode:

seccomp-pledge's Issues

todo list for completion of seccomp-pledge

Great work on the project and related materials, @DeviousCilantro! 🎉 Keep up the good work. We're now going to use this issue to create a checklist of small tasks that still need to be done.

• Run cargo clippy -- -W clippy::pedantic and apply appropriate changes (you might wanna read all of them as some might cause regression, you can apply them automatically using cargo clippy --fix -- -W clippy::pedantic but best to go through them)
• Move checks for BIF JIT, dependencies, etc. out of the fn main function. This way, we can avoid a bit of overhead. Instead, we should ideally have a fn check() function that is called through a command line argument, such as -check or -no_check.
• Tests: We can launch commands like ls with and without restrictions (ls the project folder) to see if we get the expected output.
• Benchmarks: While there may not be a specific need for them, we will include tests in the benchmarking process for the sake of completeness.
• Non-interactive mode: The current program runs in an interactive way, but we should also have a simple one-liner, for example: ./seccomp_pledge -check -v -p 'stdio rpath' ls similar to pledge.
• Add more examples in README

Don't worry about CI and other things, I will update the project with it, along with the skeleton for tests and benchmarks. A few good starting points for you might be:

A few good starting points for you might be:

• writing tests and writing tests for command line
• benchmarking, just throw every test inside blackbox
• Command Line Applications in Rust

Unable to Cross compile seccom-pledge for OpenWrt

Hi,

We are unable to cross-compile the project for OpenWrt. Please let us know what are the architectures it can support. The OpenWrt router we have has MIPS architecture.

• CPU info for OpenWrt router

root@OpenWrt:~# cat /proc/cpuinfo                                                               
system type             : MediaTek MT7621 ver:1 eco:3                                           
machine                 : Linksys E5600                                                         
processor               : 0                                                                     
cpu model               : MIPS 1004Kc V2.15                                                     
BogoMIPS                : 586.13                                                                
wait instruction        : yes                                                                   
microsecond timers      : yes                                                                   
tlb_entries             : 32                                                                    
extra interrupt vector  : yes                                                                   
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]     
isa                     : mips1 mips2 mips32r1 mips32r2                                         
ASEs implemented        : mips16 dsp mt                                                         
Options implemented     : tlb 4kex 4k_cache prefetch mcheck ejtag llsc pindexed_dcache userlocal
 vint perf_cntr_intr_bit cdmm perf                                                              
shadow register sets    : 1                                                                     
kscratch registers      : 0                                                                     
package                 : 0                                                                     
core                    : 0                                                                     
VPE                     : 0                                                                     
VCED exceptions         : not available                                                         
VCEI exceptions         : not available                                                         
                                                                                                
processor               : 1                                                                     
cpu model               : MIPS 1004Kc V2.15                                                     
BogoMIPS                : 586.13                                                                
wait instruction        : yes                                                                   
microsecond timers      : yes                                                                   
tlb_entries             : 32                                                                    
extra interrupt vector  : yes                                                                   
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]     
isa                     : mips1 mips2 mips32r1 mips32r2                                         
ASEs implemented        : mips16 dsp mt                                                         
Options implemented     : tlb 4kex 4k_cache prefetch mcheck ejtag llsc pindexed_dcache userlocal
 vint perf_cntr_intr_bit cdmm perf                                                              
shadow register sets    : 1                                                                     
kscratch registers      : 0                                                                     
package                 : 0                                                                     
core                    : 0                                                                     
VPE                     : 1                                                                     
VCED exceptions         : not available                                                         
VCEI exceptions         : not available                                                         
                                                                                                
processor               : 2                                                                     
cpu model               : MIPS 1004Kc V2.15                                                     
BogoMIPS                : 586.13                                                                
wait instruction        : yes                                                                   
microsecond timers      : yes                                                                   
tlb_entries             : 32                                                                    
extra interrupt vector  : yes                                                                   
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]     
isa                     : mips1 mips2 mips32r1 mips32r2                                         
ASEs implemented        : mips16 dsp mt                                                         
Options implemented     : tlb 4kex 4k_cache prefetch mcheck ejtag llsc pindexed_dcache userlocal
 vint perf_cntr_intr_bit cdmm perf                                                              
shadow register sets    : 1                                                                     
kscratch registers      : 0                                                                     
package                 : 0                                                                     
core                    : 1                                                                     
VPE                     : 0                                                                     
VCED exceptions         : not available                                                         
VCEI exceptions         : not available                                                         
                                                                                                
processor               : 3                                                                     
cpu model               : MIPS 1004Kc V2.15                                                     
BogoMIPS                : 586.13                                                                
wait instruction        : yes                                                                   
microsecond timers      : yes                                                                   
tlb_entries             : 32                                                                    
extra interrupt vector  : yes                                                                   
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]     
isa                     : mips1 mips2 mips32r1 mips32r2                                         
ASEs implemented        : mips16 dsp mt                                                         
Options implemented     : tlb 4kex 4k_cache prefetch mcheck ejtag llsc pindexed_dcache userlocal
 vint perf_cntr_intr_bit cdmm perf                                                              
shadow register sets    : 1                                                                     
kscratch registers      : 0                                                                     
package                 : 0                                                                     
core                    : 1                                                                     
VPE                     : 1                                                                     
VCED exceptions         : not available                                                         
VCEI exceptions         : not available

• Following errors occurred while we build the project

dora@openwrtbuildpc:~/coderepo/openwrt/seccomp-pledge$ cargo build --release --target mips-unknown-linux-musl
   Compiling serde v1.0.152
   Compiling libc v0.2.139
   Compiling serde_json v1.0.91
   Compiling itoa v1.0.5
   Compiling ryu v1.0.12
   Compiling optional-fields-serde-macro v0.1.1
   Compiling optional-field v0.1.3
   Compiling seccompiler v0.3.0
   Compiling seccomp-pledge v0.1.0 (/home/dora/coderepo/openwrt/seccomp-pledge)
error[E0432]: unresolved import `seccompiler::BpfMap`
 --> src/main.rs:2:5
  |
2 | use seccompiler::BpfMap;
  |     ^^^^^^^^^^^^^^^^^^^ no `BpfMap` in the root

error[E0433]: failed to resolve: could not find `TargetArch` in `seccompiler`
   --> src/main.rs:411:22
    |
411 |         seccompiler::TargetArch::x86_64,
    |                      ^^^^^^^^^^ could not find `TargetArch` in `seccompiler`

error[E0425]: cannot find function `compile_from_json` in crate `seccompiler`
   --> src/main.rs:409:66
    |
409 | ...compiler::compile_from_json(
    |              ^^^^^^^^^^^^^^^^^ not found in `seccompiler`

error[E0425]: cannot find function `apply_filter` in crate `seccompiler`
   --> src/main.rs:428:21
    |
428 |     if seccompiler::apply_filter(filter).is_err() {
    |                     ^^^^^^^^^^^^ not found in `seccompiler`

Some errors have detailed explanations: E0425, E0432, E0433.
For more information about an error, try `rustc --explain E0425`.
error: could not compile `seccomp-pledge` due to 4 previous errors
dora@openwrtbuildpc:~/coderepo/openwrt/seccomp-pledge$

You can find the further details here
https://www.notion.so/subcom/Daily-Logs-ef770c7e27f7457f875a198c65a5f604

Please let us know how to solve these errors.