Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use libseccomp in cmark, when available #381

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Use libseccomp in cmark, when available #381

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions src/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,3 +195,10 @@ if(CMARK_LIB_FUZZER)
set_target_properties(cmark-fuzz PROPERTIES
LINKER_LANGUAGE CXX)
endif()

find_package(PkgConfig)
pkg_check_modules(LIBSECCOMP IMPORTED_TARGET libseccomp)
if(LIBSECCOMP_FOUND)
add_definitions(-DHAVE_LIBSECCOMP)
target_link_libraries(${PROGRAM} PkgConfig::LIBSECCOMP)
endif()
72 changes: 72 additions & 0 deletions src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@
#include "cmark.h"
#include "node.h"

#if defined(HAVE_LIBSECCOMP)
# include <seccomp.h>
# include <fcntl.h> /* O_RDONLY */
#endif

#if defined(__OpenBSD__)
# include <sys/param.h>
# if OpenBSD >= 201605
Expand Down Expand Up @@ -73,6 +78,70 @@ static void print_document(cmark_node *document, writer_format writer,
document->mem->free(result);
}

#ifdef HAVE_LIBSECCOMP
static void enable_seccomp(int argc, char *argv[]) {
int i;
int rc = -1;
scmp_filter_ctx ctx;

ctx = seccomp_init(SCMP_ACT_KILL);
if (ctx == NULL)
goto out;

/* Allow opening files on the command line, and only as read-only */
for (i = 1; i < argc; i++) {
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 2,
SCMP_A1(SCMP_CMP_EQ, (size_t)argv[i]),
SCMP_A2(SCMP_CMP_EQ, O_RDONLY));
if (rc < 0)
goto out;
}

/* Allow reading from open file descriptors */
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
if (rc < 0)
goto out;
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(close), 0);
if (rc < 0)
goto out;

/* Allow fstat (needed by C stdio) */
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fstatat64), 0);
if (rc < 0)
goto out;
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(newfstatat), 0);
if (rc < 0)
goto out;

/* Gracefully reject ioctl (needed by C stdio) */
rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCES), SCMP_SYS(ioctl), 0);
if (rc < 0)
goto out;

/* Allow writing to stdout */
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
SCMP_A0(SCMP_CMP_EQ, 1));
if (rc < 0)
goto out;

/* Allow exiting */
rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
if (rc < 0)
goto out;

rc = seccomp_load(ctx);
if (rc < 0)
goto out;

rc = 0;
out:
if (rc < 0) {
fprintf(stderr, "seccomp initialization failed: %d\n", rc);
}
seccomp_release(ctx);
}
#endif

int main(int argc, char *argv[]) {
int i, numfps = 0;
int *files;
Expand All @@ -91,6 +160,9 @@ int main(int argc, char *argv[]) {
return 1;
}
#endif
#ifdef HAVE_LIBSECCOMP
enable_seccomp(argc, argv);
#endif

#if defined(_WIN32) && !defined(__CYGWIN__)
_setmode(_fileno(stdin), _O_BINARY);
Expand Down