Orange Pi5 kernel

^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  3)  * Naive system call dropper built on seccomp_filter.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  4)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  5)  * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  6)  * Author: Will Drewry <wad@chromium.org>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  7)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  8)  * The code may be used by anyone for any purpose,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  9)  * and can serve as a starting point for developing
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)  * applications using prctl(PR_SET_SECCOMP, 2, ...).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)  * When run, returns the specified errno for the specified
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13)  * system call number against the given architecture.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <errno.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/audit.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/filter.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include <linux/seccomp.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include <linux/unistd.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <stdio.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <stddef.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #include <stdlib.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <sys/prctl.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #include <unistd.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) static int install_filter(int nr, int arch, int error)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) 	struct sock_filter filter[] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) 		BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) 			 (offsetof(struct seccomp_data, arch))),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) 		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, arch, 0, 3),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) 		BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) 			 (offsetof(struct seccomp_data, nr))),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) 		BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, nr, 0, 1),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) 		BPF_STMT(BPF_RET+BPF_K,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) 			 SECCOMP_RET_ERRNO|(error & SECCOMP_RET_DATA)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) 		BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) 	};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) 	struct sock_fprog prog = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) 		.len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) 		.filter = filter,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) 	};
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) 	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) 		perror("prctl(NO_NEW_PRIVS)");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) 		return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) 	if (prctl(PR_SET_SECCOMP, 2, &prog)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) 		perror("prctl(PR_SET_SECCOMP)");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) 		return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) 	return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) int main(int argc, char **argv)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) 	if (argc < 5) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) 		fprintf(stderr, "Usage:\n"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) 			"dropper <syscall_nr> <arch> <errno> <prog> [<args>]\n"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) 			"Hint:	AUDIT_ARCH_I386: 0x%X\n"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) 			"	AUDIT_ARCH_X86_64: 0x%X\n"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) 			"\n", AUDIT_ARCH_I386, AUDIT_ARCH_X86_64);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) 		return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) 	if (install_filter(strtol(argv[1], NULL, 0), strtol(argv[2], NULL, 0),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) 			   strtol(argv[3], NULL, 0)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) 		return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) 	execv(argv[4], &argv[4]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) 	printf("Failed to execv\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) 	return 255;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) }