path: root/src/arch-ppc64.c

/**
 * Enhanced Seccomp PPC64 Specific Code
 *
 * Copyright (c) 2014 Red Hat <pmoore@redhat.com>
 * Author: Paul Moore <paul@paul-moore.com>
 *
 */

/*
 * This library is free software; you can redistribute it and/or modify it
 * under the terms of version 2.1 of the GNU Lesser General Public License as
 * published by the Free Software Foundation.
 *
 * This library is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License
 * for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this library; if not, see <http://www.gnu.org/licenses>.
 */

#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <linux/audit.h>

#include "db.h"
#include "arch.h"
#include "arch-ppc64.h"

/* ppc64 syscall numbers */
#define __ppc64_NR_socketcall		102
#define __ppc64_NR_ipc			117

/**
 * Resolve a syscall name to a number
 * @param name the syscall name
 *
 * Resolve the given syscall name to the syscall number using the syscall table.
 * Returns the syscall number on success, including negative pseudo syscall
 * numbers; returns __NR_SCMP_ERROR on failure.
 *
 */
int ppc64_syscall_resolve_name_munge(const char *name)
{
	if (strcmp(name, "accept") == 0)
		return __PNR_accept;
	if (strcmp(name, "accept4") == 0)
		return __PNR_accept4;
	else if (strcmp(name, "bind") == 0)
		return __PNR_bind;
	else if (strcmp(name, "connect") == 0)
		return __PNR_connect;
	else if (strcmp(name, "getpeername") == 0)
		return __PNR_getpeername;
	else if (strcmp(name, "getsockname") == 0)
		return __PNR_getsockname;
	else if (strcmp(name, "getsockopt") == 0)
		return __PNR_getsockopt;
	else if (strcmp(name, "listen") == 0)
		return __PNR_listen;
	else if (strcmp(name, "msgctl") == 0)
		return __PNR_msgctl;
	else if (strcmp(name, "msgget") == 0)
		return __PNR_msgget;
	else if (strcmp(name, "msgrcv") == 0)
		return __PNR_msgrcv;
	else if (strcmp(name, "msgsnd") == 0)
		return __PNR_msgsnd;
	else if (strcmp(name, "recv") == 0)
		return __PNR_recv;
	else if (strcmp(name, "recvfrom") == 0)
		return __PNR_recvfrom;
	else if (strcmp(name, "recvmsg") == 0)
		return __PNR_recvmsg;
	else if (strcmp(name, "recvmmsg") == 0)
		return __PNR_recvmmsg;
	else if (strcmp(name, "semctl") == 0)
		return __PNR_semctl;
	else if (strcmp(name, "semget") == 0)
		return __PNR_semget;
	else if (strcmp(name, "semtimedop") == 0)
		return __PNR_semtimedop;
	else if (strcmp(name, "send") == 0)
		return __PNR_send;
	else if (strcmp(name, "sendmsg") == 0)
		return __PNR_sendmsg;
	else if (strcmp(name, "sendmmsg") == 0)
		return __PNR_sendmmsg;
	else if (strcmp(name, "sendto") == 0)
		return __PNR_sendto;
	else if (strcmp(name, "setsockopt") == 0)
		return __PNR_setsockopt;
	else if (strcmp(name, "shmat") == 0)
		return __PNR_shmat;
	else if (strcmp(name, "shmdt") == 0)
		return __PNR_shmdt;
	else if (strcmp(name, "shmget") == 0)
		return __PNR_shmget;
	else if (strcmp(name, "shmctl") == 0)
		return __PNR_shmctl;
	else if (strcmp(name, "shutdown") == 0)
		return __PNR_shutdown;
	else if (strcmp(name, "socket") == 0)
		return __PNR_socket;
	else if (strcmp(name, "socketpair") == 0)
		return __PNR_socketpair;

	return ppc64_syscall_resolve_name(name);
}

/**
 * Resolve a syscall number to a name
 * @param num the syscall number
 *
 * Resolve the given syscall number to the syscall name using the syscall table.
 * Returns a pointer to the syscall name string on success, including pseudo
 * syscall names; returns NULL on failure.
 *
 */
const char *ppc64_syscall_resolve_num_munge(int num)
{
	if (num == __PNR_accept)
		return "accept";
	else if (num == __PNR_accept4)
		return "accept4";
	else if (num == __PNR_bind)
		return "bind";
	else if (num == __PNR_connect)
		return "connect";
	else if (num == __PNR_getpeername)
		return "getpeername";
	else if (num == __PNR_getsockname)
		return "getsockname";
	else if (num == __PNR_getsockopt)
		return "getsockopt";
	else if (num == __PNR_listen)
		return "listen";
	else if (num == __PNR_msgctl)
		return "msgctl";
	else if (num == __PNR_msgget)
		return "msgget";
	else if (num == __PNR_msgrcv)
		return "msgrcv";
	else if (num == __PNR_msgsnd)
		return "msgsnd";
	else if (num == __PNR_recv)
		return "recv";
	else if (num == __PNR_recvfrom)
		return "recvfrom";
	else if (num == __PNR_recvmsg)
		return "recvmsg";
	else if (num == __PNR_recvmmsg)
		return "recvmmsg";
	else if (num == __PNR_semctl)
		return "semctl";
	else if (num == __PNR_semget)
		return "semget";
	else if (num == __PNR_semtimedop)
		return "semtimedop";
	else if (num == __PNR_send)
		return "send";
	else if (num == __PNR_sendmsg)
		return "sendmsg";
	else if (num == __PNR_sendmmsg)
		return "sendmmsg";
	else if (num == __PNR_sendto)
		return "sendto";
	else if (num == __PNR_setsockopt)
		return "setsockopt";
	else if (num == __PNR_shmat)
		return "shmat";
	else if (num == __PNR_shmdt)
		return "shmdt";
	else if (num == __PNR_shmget)
		return "shmget";
	else if (num == __PNR_shmctl)
		return "shmctl";
	else if (num == __PNR_shutdown)
		return "shutdown";
	else if (num == __PNR_socket)
		return "socket";
	else if (num == __PNR_socketpair)
		return "socketpair";

	return ppc64_syscall_resolve_num(num);
}

/**
 * Convert a multiplexed pseudo socket syscall into a direct syscall
 * @param syscall the multiplexed pseudo syscall number
 *
 * Return the related direct syscall number, __NR_SCMP_UNDEF is there is
 * no related syscall, or __NR_SCMP_ERROR otherwise.
 *
 */
static int _ppc64_syscall_demux(int syscall)
{
	switch (syscall) {
	case -101:
		/* socket */
		return 326;
	case -102:
		/* bind */
		return 327;
	case -103:
		/* connect */
		return 328;
	case -104:
		/* listen */
		return 329;
	case -105:
		/* accept */
		return 330;
	case -106:
		/* getsockname */
		return 331;
	case -107:
		/* getpeername */
		return 332;
	case -108:
		/* socketpair */
		return 333;
	case -109:
		/* send */
		return 334;
	case -110:
		/* recv */
		return 336;
	case -111:
		/* sendto */
		return 335;
	case -112:
		/* recvfrom */
		return 337;
	case -113:
		/* shutdown */
		return 338;
	case -114:
		/* setsockopt */
		return 339;
	case -115:
		/* getsockopt */
		return 340;
	case -116:
		/* sendmsg */
		return 341;
	case -117:
		/* recvmsg */
		return 342;
	case -118:
		/* accept4 */
		return 344;
	case -119:
		/* recvmmsg */
		return 343;
	case -120:
		/* sendmmsg */
		return 349;
	case -201:
		/* semop - not defined */
		return __NR_SCMP_UNDEF;
	case -202:
		/* semget */
		return 393;
	case -203:
		/* semctl */
		return 394;
	case -204:
		/* semtimedop */
		return 392;
	case -211:
		/* msgsnd */
		return 400;
	case -212:
		/* msgrcv */
		return 401;
	case -213:
		/* msgget */
		return 399;
	case -214:
		/* msgctl */
		return 402;
	case -221:
		/* shmat */
		return 397;
	case -222:
		/* shmdt */
		return 398;
	case -223:
		/* shmget */
		return 395;
	case -224:
		/* shmctl */
		return 396;
	}

	return __NR_SCMP_ERROR;
}

/**
 * Convert a direct socket syscall into multiplexed pseudo socket syscall
 * @param syscall the direct syscall
 *
 * Return the related multiplexed pseduo syscall number, __NR_SCMP_UNDEF is
 * there is no related pseudo syscall, or __NR_SCMP_ERROR otherwise.
 *
 */
static int _ppc64_syscall_mux(int syscall)
{
	switch (syscall) {
	case 326:
		/* socket */
		return -101;
	case 327:
		/* bind */
		return -102;
	case 328:
		/* connect */
		return -103;
	case 329:
		/* listen */
		return -104;
	case 330:
		/* accept */
		return -105;
	case 331:
		/* getsockname */
		return -106;
	case 332:
		/* getpeername */
		return -107;
	case 333:
		/* socketpair */
		return -108;
	case 334:
		/* send */
		return -109;
	case 335:
		/* sendto */
		return -111;
	case 336:
		/* recv */
		return -110;
	case 337:
		/* recvfrom */
		return -112;
	case 338:
		/* shutdown */
		return -113;
	case 339:
		/* setsockopt */
		return -114;
	case 340:
		/* getsockopt */
		return -115;
	case 341:
		/* sendmsg */
		return -116;
	case 342:
		/* recvmsg */
		return -117;
	case 343:
		/* recvmmsg */
		return -119;
	case 344:
		/* accept4 */
		return -118;
	case 349:
		/* sendmmsg */
		return -120;
	case 392:
		/* semtimedop */
		return -204;
	case 393:
		/* semget */
		return -202;
	case 394:
		/* semctl */
		return -203;
	case 395:
		/* shmget */
		return -223;
	case 396:
		/* shmctl */
		return -224;
	case 397:
		/* shmat */
		return -221;
	case 398:
		/* shmdt */
		return -222;
	case 399:
		/* msgget */
		return -213;
	case 400:
		/* msgsnd */
		return -211;
	case 401:
		/* msgrcv */
		return -212;
	case 402:
		/* msgctl */
		return -214;
	}

	return __NR_SCMP_ERROR;
}

/**
 * Rewrite a syscall value to match the architecture
 * @param syscall the syscall number
 *
 * Syscalls can vary across different architectures so this function rewrites
 * the syscall into the correct value for the specified architecture.  Returns
 * zero on success, negative values on failure.
 *
 */
int ppc64_syscall_rewrite(int *syscall)
{
	int sys = *syscall;

	if (sys <= -100 && sys >= -120)
		*syscall = __ppc64_NR_socketcall;
	else if (sys <= -200 && sys >= -224)
		*syscall = __ppc64_NR_ipc;
	else if (sys < 0)
		return -EDOM;

	return 0;
}

/**
 * add a new rule to the ppc64 seccomp filter
 * @param db the seccomp filter db
 * @param rule the filter rule
 *
 * This function adds a new syscall filter to the seccomp filter db, making any
 * necessary adjustments for the ppc64 ABI.  Returns zero on success, negative
 * values on failure.
 *
 * It is important to note that in the case of failure the db may be corrupted,
 * the caller must use the transaction mechanism if the db integrity is
 * important.
 *
 */
int ppc64_rule_add(struct db_filter *db, struct db_api_rule_list *rule)
{
	int rc = 0;
	unsigned int iter;
	int sys = rule->syscall;
	int sys_a, sys_b;
	struct db_api_rule_list *rule_a, *rule_b, *rule_dup = NULL;

	if ((sys <= -100 && sys >= -120) || (sys >= 326 && sys <= 344) ||
	    (sys == 349)) {
		/* (-100 to -120) : multiplexed socket syscalls
		   (326 to 344)   : direct socket syscalls, Linux 4.3+
		   (349)          : sendmmsg */

		/* strict check for the multiplexed socket syscalls */
		for (iter = 0; iter < ARG_COUNT_MAX; iter++) {
			if ((rule->args[iter].valid != 0) && (rule->strict)) {
				rc = -EINVAL;
				goto add_return;
			}
		}

		/* determine both the muxed and direct syscall numbers */
		if (sys > 0) {
			sys_a = _ppc64_syscall_mux(sys);
			if (sys_a == __NR_SCMP_ERROR) {
				rc = __NR_SCMP_ERROR;
				goto add_return;
			}
			sys_b = sys;
		} else {
			sys_a = sys;
			sys_b = _ppc64_syscall_demux(sys);
			if (sys_b == __NR_SCMP_ERROR) {
				rc = __NR_SCMP_ERROR;
				goto add_return;
			}
		}

		/* use rule_a for the multiplexed syscall and use rule_b for
		 * the direct wired syscall */

		if (sys_a == __NR_SCMP_UNDEF) {
			rule_a = NULL;
			rule_b = rule;
		} else if (sys_b == __NR_SCMP_UNDEF) {
			rule_a = rule;
			rule_b = NULL;
		} else {
			/* need two rules, dup the first and link together */
			rule_a = rule;
			rule_dup = db_rule_dup(rule_a);
			rule_b = rule_dup;
			if (rule_b == NULL) {
				rc = -ENOMEM;
				goto add_return;
			}
			rule_b->prev = rule_a;
			rule_b->next = NULL;
			rule_a->next = rule_b;
		}

		/* multiplexed socket syscalls */
		if (rule_a != NULL) {
			rule_a->syscall = __ppc64_NR_socketcall;
			rule_a->args[0].arg = 0;
			rule_a->args[0].op = SCMP_CMP_EQ;
			rule_a->args[0].mask = DATUM_MAX;
			rule_a->args[0].datum = (-sys_a) % 100;
			rule_a->args[0].valid = 1;
		}

		/* direct wired socket syscalls */
		if (rule_b != NULL)
			rule_b->syscall = sys_b;

		/* we should be protected by a transaction checkpoint */
		if (rule_a != NULL) {
			rc = db_rule_add(db, rule_a);
			if (rc < 0)
				goto add_return;
		}
		if (rule_b != NULL) {
			rc = db_rule_add(db, rule_b);
			if (rc < 0)
				goto add_return;
		}
	} else if ((sys <= -200 && sys >= -224) || (sys >= 392 && sys <= 402)) {
		/* (-200 to -224) : multiplexed ipc syscalls
		   (392 to 402) : direct ipc syscalls */

		/* strict check for the multiplexed socket syscalls */
		for (iter = 0; iter < ARG_COUNT_MAX; iter++) {
			if ((rule->args[iter].valid != 0) && (rule->strict)) {
				rc = -EINVAL;
				goto add_return;
			}
		}

		/* determine both the muxed and direct syscall numbers */
		if (sys > 0) {
			sys_a = _ppc64_syscall_mux(sys);
			if (sys_a == __NR_SCMP_ERROR) {
				rc = __NR_SCMP_ERROR;
				goto add_return;
			}
			sys_b = sys;
		} else {
			sys_a = sys;
			sys_b = _ppc64_syscall_demux(sys);
			if (sys_b == __NR_SCMP_ERROR) {
				rc = __NR_SCMP_ERROR;
				goto add_return;
			}
		}

		/* use rule_a for the multiplexed syscall and use rule_b for
		 * the direct wired syscall */

		if (sys_a == __NR_SCMP_UNDEF) {
			rule_a = NULL;
			rule_b = rule;
		} else if (sys_b == __NR_SCMP_UNDEF) {
			rule_a = rule;
			rule_b = NULL;
		} else {
			/* need two rules, dup the first and link together */
			rule_a = rule;
			rule_dup = db_rule_dup(rule_a);
			rule_b = rule_dup;
			if (rule_b == NULL)
				goto add_return;
			rule_b->prev = rule_a;
			rule_b->next = NULL;
			rule_a->next = rule_b;
		}

		/* multiplexed socket syscalls */
		if (rule_a != NULL) {
			rule_a->syscall = __ppc64_NR_ipc;
			rule_a->args[0].arg = 0;
			rule_a->args[0].op = SCMP_CMP_EQ;
			rule_a->args[0].mask = DATUM_MAX;
			rule_a->args[0].datum = (-sys_a) % 200;
			rule_a->args[0].valid = 1;
		}

		/* direct wired socket syscalls */
		if (rule_b != NULL)
			rule_b->syscall = sys_b;

		/* we should be protected by a transaction checkpoint */
		if (rule_a != NULL) {
			rc = db_rule_add(db, rule_a);
			if (rc < 0)
				goto add_return;
		}
		if (rule_b != NULL) {
			rc = db_rule_add(db, rule_b);
			if (rc < 0)
				goto add_return;
		}
	} else if (sys >= 0) {
		/* normal syscall processing */
		rc = db_rule_add(db, rule);
		if (rc < 0)
			goto add_return;
	} else if (rule->strict) {
		rc = -EDOM;
		goto add_return;
	}

add_return:
	if (rule_dup != NULL)
		free(rule_dup);
	return rc;
}

const struct arch_def arch_def_ppc64 = {
	.token = SCMP_ARCH_PPC64,
	.token_bpf = AUDIT_ARCH_PPC64,
	.size = ARCH_SIZE_64,
	.endian = ARCH_ENDIAN_BIG,
	.syscall_resolve_name = ppc64_syscall_resolve_name_munge,
	.syscall_resolve_num = ppc64_syscall_resolve_num_munge,
	.syscall_rewrite = ppc64_syscall_rewrite,
	.rule_add = ppc64_rule_add,
};

const struct arch_def arch_def_ppc64le = {
	.token = SCMP_ARCH_PPC64LE,
	.token_bpf = AUDIT_ARCH_PPC64LE,
	.size = ARCH_SIZE_64,
	.endian = ARCH_ENDIAN_LITTLE,
	.syscall_resolve_name = ppc64_syscall_resolve_name_munge,
	.syscall_resolve_num = ppc64_syscall_resolve_num_munge,
	.syscall_rewrite = ppc64_syscall_rewrite,
	.rule_add = ppc64_rule_add,
};