elastic / go-seccomp-bpf

Go library for installing a seccomp BPF system call filter.

go-seccomp-bpf

go-seccomp-bpf is a library for Go (golang) for loading a system call filter on Linux 3.17 and later by taking advantage of secure computing mode, also known as seccomp. Seccomp restricts the system calls that a process can invoke.

The kernel exposes a large number of system calls that are not used by most processes. By installing a seccomp filter, you can limit the total kernel surface exposed to a process (principle of least privilege). This minimizes the impact of unknown vulnerabilities that might be found in the process.

The filter is expressed as a Berkeley Packet Filter (BPF) program. The BPF program is generated based on a filter policy created by you.

Requirements

• Requires Linux 3.17 because it uses the seccomp syscall in order to take advantage of the SECCOMP_FILTER_FLAG_TSYNC flag to sync the filter to all threads.

Features

• Pure Go and does not have a libseccomp dependency.
• Filters are customizable and can be written as an allowlist or blocklist.
• Supports system call argument filtering.
• Uses SECCOMP_FILTER_FLAG_TSYNC to sync the filter to all threads created by the Go runtime.
• Invokes prctl(PR_SET_NO_NEW_PRIVS, 1) to set the threads no_new_privs bit which is generally required before loading a seccomp filter.
• seccomp-profiler tool for automatically generating a allowlist policy based on the system calls that a binary uses.

Limitations

• System call tables are only implemented for 386, amd64, arm and arm64. (More system call table generation code should be added to arch/mk_syscalls_linux.go.)

Examples

• GoDoc Package Example
• sandbox example in cmd/sandbox.

Updating syscalls for new Linux releases

This package contains a list of syscall numbers that are generated from the Linux sources. Update the git tag here and then run this command to generate the code.

docker run -it --rm -v `pwd`:/go-seccomp-bpf -w /go-seccomp-bpf/arch golang:1.18 go generate

Projects Using elastic/go-seccomp-bpf

Please open a PR to submit your project.

• elastic/beats

go-seccomp-bpf's Issues

Feature: System Call Argument Filtering

Suppose you want allow clone with specific arguments such as CLONE_NEWUSER. To accomplish this we need to add the ability to generate a BPF filter that can check the arguments.

BPF supports several operators: https://godoc.org/golang.org/x/net/bpf#JumpTest

Profiler for binaries in C++, Python, etc...

Is there a way to quickly generate seccomp rules for programs written in other languages than Go?

Add x32 check to BPF filter

Prevent x32 syscall usage from x86_64 binaries by adding a check for syscalls numbers that are greater than __X32_SYSCALL_BIT to the BPF program.