From c0bdd416303e75322d1689adfbfd7b66e5d6cdc8 Mon Sep 17 00:00:00 2001 From: valoq Date: Tue, 20 Feb 2018 12:19:07 +0100 Subject: [PATCH] fixed read only mode --- zathura/libsec.c | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/zathura/libsec.c b/zathura/libsec.c index 68d14a8..47b1a13 100644 --- a/zathura/libsec.c +++ b/zathura/libsec.c @@ -397,7 +397,7 @@ int seccomp_enable_strict_filter(void){ ALLOW_RULE (bind); ALLOW_RULE (brk); ALLOW_RULE (clock_getres); - ALLOW_RULE (clone); + ALLOW_RULE (clone); /* TODO: investigate */ ALLOW_RULE (close); /* ALLOW_RULE (connect); */ ALLOW_RULE (eventfd2); @@ -435,8 +435,8 @@ int seccomp_enable_strict_filter(void){ ALLOW_RULE (mprotect); ALLOW_RULE (mremap); ALLOW_RULE (munmap); - ALLOW_RULE (open); /* (zathura needs to open for writing) TODO: avoid needing this somehow */ - ALLOW_RULE (openat); + //ALLOW_RULE (open); /* (zathura needs to open for writing) TODO: avoid needing this somehow */ + //ALLOW_RULE (openat); ALLOW_RULE (pipe); ALLOW_RULE (poll); ALLOW_RULE (pwrite64); /* TODO: build detailed filter */ @@ -492,7 +492,34 @@ int seccomp_enable_strict_filter(void){ SCMP_CMP(0, SCMP_CMP_EQ, PR_SET_PDEATHSIG)) < 0) goto out; - + + /* special restrictions for open, prevent opening files for writing */ + if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1, + SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY | O_RDWR, 0)) < 0) + goto out; + + if (seccomp_rule_add (ctx, SCMP_ACT_ERRNO (EACCES), SCMP_SYS(open), 1, + SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) < 0) + goto out; + + if (seccomp_rule_add (ctx, SCMP_ACT_ERRNO (EACCES), SCMP_SYS(open), 1, + SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) < 0) + goto out; + + /* special restrictions for openat, prevent opening files for writing */ + if (seccomp_rule_add (ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1, + SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY | O_RDWR, 0)) < 0) + goto out; + + if (seccomp_rule_add (ctx, SCMP_ACT_ERRNO (EACCES), SCMP_SYS(openat), 1, + SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) < 0) + goto out; + + if (seccomp_rule_add (ctx, SCMP_ACT_ERRNO (EACCES), SCMP_SYS(openat), 1, + SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) < 0) + goto out; + + /* allowed for debugging: */ /* ALLOW_RULE (prctl); */