Run a process from C with a seccomp profile

user_14121485 0
Viewed 159

I want to run a process with a seccomp profile applied to it (can be from C, terminal, etc.). In particular, I would like the target command to not be allowed to read and write any files, and it can just print to the console. The temporary C outline I have is this:

int main() {
    scmp_filter_ctx filter = load_filter();
    seccomp_load(filter);
    // execl([sample command with arguments], 0);
    execl("ls", 0)
}

The problem I am having is that the execl uses some sys calls that are blocked in my profile. How can I ensure that the only gets applied only to the [sample command with arguments]. Again, this does not have to be in C. Basically, I want to run some executables, and apply seccomp to those processes. I am using Ubuntu 18.04.

seccomp system-calls linux
1 Answers

exec* calls are frontend to execve, which implementation in user space looks like this:

int execve(const char *filename, char * const argv[], char * const envp[]) {
    return syscall(SYS_execve, filename, argv, envp);
}

ref: https://stackoverflow.com/a/7381910/544721

Therefore, you may want to instrument your desired binary to execute seccomp filters code after being loaded. e.g. via binary instrumentation (to add extra code) of actual binary.

user_5447210
Related