/*
 * seccomp_profile.c -- seccomp profile support
 *
 * (c) Copyright IBM Corporation 2019.
 *
 * Author: Stefan Berger <stefanb@us.ibm.com>
 *
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 * Redistributions of source code must retain the above copyright notice,
 * this list of conditions and the following disclaimer.
 *
 * Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 *
 * Neither the names of the IBM Corporation nor the names of its
 * contributors may be used to endorse or promote products derived from
 * this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "config.h"

#include <stdbool.h>
#include <string.h>

#ifdef WITH_SECCOMP
# include <seccomp.h>
#endif

#include "logging.h"
#include "utils.h"
#include "seccomp_profile.h"
#include "swtpm_utils.h"

#ifdef WITH_SECCOMP
static int create_seccomp_profile_add_rules(scmp_filter_ctx ctx,
                                            int *syscalls, size_t syscalls_len,
                                            unsigned int action)
{
    int ret = 0;
    unsigned i = 0;
    uint32_t act = SCMP_ACT_KILL;

#ifdef SCMP_ACT_LOG
    if (action == SWTPM_SECCOMP_ACTION_LOG)
        act = SCMP_ACT_LOG;
#endif

    for (i = 0; i < syscalls_len; i++) {
        ret = seccomp_rule_add(ctx, act, syscalls[i], 0);
        if (ret < 0) {
            logprintf(STDERR_FILENO,
                      "seccomp_rule_add failed with errno %d: %s\n",
                      -ret, strerror(-ret));
            break;
        }
    }
    return ret;
}

/*
 * create_seccomp_profile: Build a blacklist of syscalls
 *
 * cusetpm: whether to build for the CUSE tpm
 * action: the seccomp action
 */
int create_seccomp_profile(bool cusetpm, unsigned int action)
{
    int blacklist[] = {
        /* high concern */
        SCMP_SYS(capset),
        SCMP_SYS(pivot_root),
        SCMP_SYS(chroot),
        SCMP_SYS(settimeofday),
        SCMP_SYS(clock_adjtime),
        SCMP_SYS(clock_settime),
#ifdef __NR_clock_settime64
        SCMP_SYS(clock_settime64),
#endif
        SCMP_SYS(adjtimex),
        SCMP_SYS(mount),
        SCMP_SYS(umount2),
#ifdef __NR_fsmount
        SCMP_SYS(fsmount),
#endif
#ifdef __NR_move_mount
        SCMP_SYS(move_mount),
#endif
        SCMP_SYS(swapon),
        SCMP_SYS(swapoff),
        SCMP_SYS(reboot),
        SCMP_SYS(tgkill),
        SCMP_SYS(kexec_load),
        SCMP_SYS(unshare),
        SCMP_SYS(setns),
        SCMP_SYS(kcmp),
        SCMP_SYS(init_module),
        SCMP_SYS(finit_module),
        SCMP_SYS(delete_module), 
        SCMP_SYS(seccomp),
        SCMP_SYS(kexec_file_load),
#ifdef __NR_sysctl
        SCMP_SYS(sysctl),
#endif
        /* semaphores and messages queues */
        SCMP_SYS(semget),
        SCMP_SYS(semop),
        SCMP_SYS(shmget),
        SCMP_SYS(shmat),
        SCMP_SYS(shmctl),
        SCMP_SYS(shmdt),
        SCMP_SYS(msgget),
        SCMP_SYS(msgsnd),
        SCMP_SYS(msgrcv),
        SCMP_SYS(msgctl),
        SCMP_SYS(mq_open),
        SCMP_SYS(mq_unlink),
        SCMP_SYS(mq_timedsend),
        SCMP_SYS(mq_timedreceive),
        SCMP_SYS(mq_notify),
        SCMP_SYS(mq_getsetattr),
        /* misc */
        SCMP_SYS(ptrace),
        SCMP_SYS(syslog),
        SCMP_SYS(capget),
        SCMP_SYS(capset),
        SCMP_SYS(sigaltstack),
        SCMP_SYS(personality),
        SCMP_SYS(sysfs),
        SCMP_SYS(getpriority),
        SCMP_SYS(setpriority),
        SCMP_SYS(sched_setparam),
        SCMP_SYS(sched_setscheduler),
        SCMP_SYS(sched_setaffinity),
        SCMP_SYS(vhangup),
        SCMP_SYS(sethostname),
        SCMP_SYS(setdomainname),
        SCMP_SYS(quotactl),
        SCMP_SYS(readahead),
        SCMP_SYS(lookup_dcookie),
        SCMP_SYS(add_key),
        SCMP_SYS(request_key),
        SCMP_SYS(keyctl),
        SCMP_SYS(inotify_init),
        SCMP_SYS(inotify_init1),
        SCMP_SYS(inotify_add_watch),
        SCMP_SYS(inotify_rm_watch),
        SCMP_SYS(splice),
        SCMP_SYS(tee),
        SCMP_SYS(vmsplice),
        SCMP_SYS(signalfd),
        SCMP_SYS(eventfd),
        SCMP_SYS(timerfd_settime),
#ifdef __NR_timer_settime64
        SCMP_SYS(timer_settime64),
#endif
#ifdef __NR_timerfd_settime64
        SCMP_SYS(timerfd_settime64),
#endif
        SCMP_SYS(timerfd_gettime),
        SCMP_SYS(signalfd4),
        SCMP_SYS(eventfd2),
        SCMP_SYS(fanotify_init),
        SCMP_SYS(fanotify_mark),
        SCMP_SYS(mknod),
        SCMP_SYS(mknodat),
        SCMP_SYS(acct),
        SCMP_SYS(prlimit64),
        SCMP_SYS(setrlimit),
#ifdef __NR_bpf
        SCMP_SYS(bpf),
#endif
#ifdef __NR_copy_filerange
        SCMP_SYS(copy_filerange),
#endif
        /* xattrs */
        SCMP_SYS(setxattr),
        SCMP_SYS(lsetxattr),
        SCMP_SYS(fsetxattr),
        SCMP_SYS(getxattr),
        SCMP_SYS(lgetxattr),
        SCMP_SYS(fgetxattr),
        SCMP_SYS(listxattr),
        SCMP_SYS(llistxattr),
        SCMP_SYS(flistxattr),
        SCMP_SYS(removexattr),
        SCMP_SYS(lremovexattr),
        SCMP_SYS(fremovexattr),
        /* processs forking */
        SCMP_SYS(execve),
        /* io */
        SCMP_SYS(iopl),
        SCMP_SYS(ioperm),
        SCMP_SYS(io_setup),
        SCMP_SYS(io_destroy),
        SCMP_SYS(io_getevents),
        SCMP_SYS(io_submit),
        SCMP_SYS(io_cancel),
        SCMP_SYS(ioprio_set),
        SCMP_SYS(ioprio_get),
        /* not implemented, removed */
        SCMP_SYS(create_module),
        SCMP_SYS(get_kernel_syms),
        SCMP_SYS(query_module),
        SCMP_SYS(uselib),
        SCMP_SYS(nfsservctl),
        SCMP_SYS(getpmsg),
        SCMP_SYS(putpmsg),
        SCMP_SYS(afs_syscall),
        SCMP_SYS(tuxcall),
        SCMP_SYS(security),
        SCMP_SYS(set_thread_area),
        SCMP_SYS(get_thread_area),
        SCMP_SYS(epoll_ctl_old),
        SCMP_SYS(epoll_wait_old),
        SCMP_SYS(vserver),
        /* privileged */
        SCMP_SYS(setuid),
        SCMP_SYS(setgid),
        SCMP_SYS(setpgid),
        SCMP_SYS(setsid),
        SCMP_SYS(setreuid),
        SCMP_SYS(setregid),
        SCMP_SYS(setgroups),
        SCMP_SYS(setresuid),
        SCMP_SYS(setresgid),
        SCMP_SYS(setfsuid),
        SCMP_SYS(setfsgid)
    };
    /* CUSE TPM needs to clone or fork */
    int blacklist_noncuse[] = {
        SCMP_SYS(clone),
        SCMP_SYS(fork),
        SCMP_SYS(vfork),
        SCMP_SYS(prctl),
#ifdef __NR_clone3
        SCMP_SYS(clone3),
#endif
        /* misc */
        SCMP_SYS(sched_setattr), /* caller: g_thread_pool_new() glib v2.68 */
    };
    scmp_filter_ctx ctx;
    int ret;

    if (action == SWTPM_SECCOMP_ACTION_NONE)
        return 0;

    ctx = seccomp_init(SCMP_ACT_ALLOW);
    if (!ctx) {
        logprintf(STDERR_FILENO, "seccomp_init failed\n");
        return -1;
    }

    if ((ret = create_seccomp_profile_add_rules(ctx, blacklist,
                                                ARRAY_LEN(blacklist),
                                                action)) < 0)
        goto error_seccomp_rule_add;

    if (!cusetpm &&
        (ret = create_seccomp_profile_add_rules(ctx, blacklist_noncuse,
                                                ARRAY_LEN(blacklist_noncuse),
                                                action)) < 0)
        goto error_seccomp_rule_add;

    if ((ret = seccomp_load(ctx)) < 0)
        logprintf(STDERR_FILENO, "seccomp_load failed with errno %d: %s\n",
                  -ret, strerror(-ret));

error_seccomp_rule_add:
    seccomp_release(ctx);

    return ret;
}
#endif