12

I'm writing a program that spawns child processes. For security reasons, I want to limit what these processes can do. I know of security measures from outside the program such as chroot or ulimit, but I want to do something more than that. I want to limit the system calls done by the child process (for example preventing calls to open(), fork() and such things). Is there any way to do that? Optimally, the blocked system calls should return with an error but if that's not possible, then killing the process is also good.

I guess it can be done wuth ptrace() but from the man page I don't really understand how to use it for this purpose.

petersohn
  • 11,292
  • 13
  • 61
  • 98
  • 3
    You probably want SELinux http://en.wikipedia.org/wiki/Security-Enhanced_Linux I'm not 100% sure, but it's should have a programmable API. – Šimon Tóth Nov 12 '12 at 11:45
  • 5
    [`prctl(PR_SET_SECCOMP, ...)`](http://www.kernel.org/doc/man-pages/online/pages/man2/prctl.2.html) may be what you want. That's as close to "not allow syscalls" as you can get. – Damon Nov 12 '12 at 11:48
  • 1
    The problem with `prctl(PR_SET_SECCOMP, ...)` is that it also blocks the `exec()` call, so it is unusable to me. – petersohn Nov 12 '12 at 15:01

2 Answers2

8

It sounds like SECCOMP_FILTER, added in kernel version 3.5, is what you're after. The libseccomp library provides an easy-to-use API for this functionality.

By the way, chroot() and setrlimit() are both system calls that can be called within your program - you'd probably want to use one or both of these in addition to seccomp filtering.

caf
  • 233,326
  • 40
  • 323
  • 462
5

If you want to do it the ptrace way, you have some options (and some are really simple). First of all, I recommend you to follow the tutorial explained here. With it you can learn how to know what system calls are being called, and also the basic ptrace knowledge (don't worry, it's a very short tutorial). The options (that I know) you have are the following:

  • The easiest one would be to kill the child, that is this exact code here.
  • Secondly you could make the child fail, just by changing the registers with PTRACE_SETREGS, putting wrong values in them, and you can also change the return value of the system call if you want (again, with PTRACE_SETREGS).
  • Finally you could skip the system call. But for that you should know the address after the system call call, make the intruction register point there and set it (again, with PTRACE_SETREGS).
Community
  • 1
  • 1
kosklain
  • 399
  • 3
  • 17
  • 2
    Note that there are some [big caveats](http://stackoverflow.com/a/4421762/134633) using ptrace for sandboxing. – caf Nov 12 '12 at 20:32