NiccoloN
61 lines
2.4 KiB
C
61 lines
2.4 KiB
C
// Test-only process guard. The compiler can read static inputs but cannot execute a child program.
|
|
#define _GNU_SOURCE
|
|
#include <linux/filter.h>
|
|
#include <linux/seccomp.h>
|
|
#include <stddef.h>
|
|
#include <sys/prctl.h>
|
|
#include <sys/syscall.h>
|
|
#include <unistd.h>
|
|
|
|
__attribute__((constructor)) static void forbidExecution(void) {
|
|
struct sock_filter instructions[] = {
|
|
BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_execve, 0, 1),
|
|
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),
|
|
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_execveat, 0, 1),
|
|
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL_PROCESS),
|
|
BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
|
|
};
|
|
struct sock_fprog program = {sizeof(instructions) / sizeof(instructions[0]), instructions};
|
|
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) || prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &program))
|
|
_exit(98);
|
|
}
|
|
|
|
#include <spawn.h>
|
|
pid_t fork(void) { _exit(99); }
|
|
pid_t vfork(void) { _exit(99); }
|
|
int posix_spawn(pid_t *pid, const char *path, const posix_spawn_file_actions_t *actions,
|
|
const posix_spawnattr_t *attributes, char *const arguments[], char *const environment[]) { _exit(99); }
|
|
int posix_spawnp(pid_t *pid, const char *path, const posix_spawn_file_actions_t *actions,
|
|
const posix_spawnattr_t *attributes, char *const arguments[], char *const environment[]) { _exit(99); }
|
|
|
|
#include <dlfcn.h>
|
|
#include <fcntl.h>
|
|
#include <stdarg.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
static void rejectHistory(const char *path) {
|
|
const char *forbidden[] = {"results_comparison.csv", "results_ablation.csv", "fast.json",
|
|
"selection-frozen.json", "latency.json", ".trace"};
|
|
for (size_t i = 0; i < sizeof(forbidden) / sizeof(forbidden[0]); ++i)
|
|
if (strstr(path, forbidden[i])) _exit(97);
|
|
}
|
|
#define AUDIT_OPEN(name) \
|
|
int name(const char *path, int flags, ...) { \
|
|
rejectHistory(path); \
|
|
mode_t mode = 0; \
|
|
if (flags & O_CREAT) { va_list arguments; va_start(arguments, flags); mode = va_arg(arguments, int); va_end(arguments); } \
|
|
int (*original)(const char *, int, ...) = dlsym(RTLD_NEXT, #name); \
|
|
return original(path, flags, mode); \
|
|
}
|
|
AUDIT_OPEN(open)
|
|
AUDIT_OPEN(open64)
|
|
#define AUDIT_FOPEN(name) \
|
|
FILE *name(const char *path, const char *mode) { \
|
|
rejectHistory(path); \
|
|
FILE *(*original)(const char *, const char *) = dlsym(RTLD_NEXT, #name); \
|
|
return original(path, mode); \
|
|
}
|
|
AUDIT_FOPEN(fopen)
|
|
AUDIT_FOPEN(fopen64)
|