filters: don't allow to create new executable mappings

PiperOrigin-RevId: 426244201

pkg/seccomp/seccomp.go

@@ -41,11 +41,14 @@ const (
 // used because it only kills the offending thread and often keeps the sentry
 // hanging.
 //
+// denyRules describes forbidden syscalls. rules describes allowed syscalls.
+// denyRules is executed before rules.
+//
 // Be aware that RET_TRAP sends SIGSYS to the process and it may be ignored,
 // making it possible for the process to continue running after a violation.
 // However, it will leave a SECCOMP audit event trail behind. In any case, the
 // syscall is still blocked from executing.
-func Install(rules SyscallRules) error {
+func Install(rules SyscallRules, denyRules SyscallRules) error {
 	defaultAction, err := defaultAction()
 	if err != nil {
 		return err
@@ -57,6 +60,10 @@ func Install(rules SyscallRules) error {
 	log.Infof("Installing seccomp filters for %d syscalls (action=%v)", len(rules), defaultAction)
 
 	instrs, err := BuildProgram([]RuleSet{
+		{
+			Rules:  denyRules,
+			Action: defaultAction,
+		},
 		{
 			Rules:  rules,
 			Action: linux.SECCOMP_RET_ALLOW,

pkg/seccomp/seccomp_rules.go

@@ -14,7 +14,11 @@
 
 package seccomp
 
-import "fmt"
+import (
+	"fmt"
+
+	"golang.org/x/sys/unix"
+)
 
 // The offsets are based on the following struct in include/linux/seccomp.h.
 // struct seccomp_data {
@@ -188,3 +192,22 @@ func (sr SyscallRules) Merge(rules SyscallRules) {
 		}
 	}
 }
+
+// DenyNewExecMappings is a set of rules that denies creating new executable
+// mappings and converting existing ones.
+var DenyNewExecMappings = SyscallRules{
+	unix.SYS_MMAP: []Rule{
+		{
+			MatchAny{},
+			MatchAny{},
+			MaskedEqual(unix.PROT_EXEC, unix.PROT_EXEC),
+		},
+	},
+	unix.SYS_MPROTECT: []Rule{
+		{
+			MatchAny{},
+			MatchAny{},
+			MaskedEqual(unix.PROT_EXEC, unix.PROT_EXEC),
+		},
+	},
+}

pkg/seccomp/seccomp_test_victim.go

@@ -105,7 +105,7 @@ func main() {
 		}
 	}
 
-	if err := seccomp.Install(syscalls); err != nil {
+	if err := seccomp.Install(syscalls, nil); err != nil {
 		fmt.Printf("Failed to install seccomp: %v", err)
 		os.Exit(1)
 	}

pkg/sentry/platform/kvm/machine.go

@@ -744,7 +744,7 @@ func seccompMmapRules(m *machine) {
 						{
 							seccomp.MatchAny{},
 							seccomp.MatchAny{},
-							seccomp.MatchAny{},
+							seccomp.MaskedEqual(unix.PROT_EXEC, 0),
 							/* MAP_DENYWRITE is ignored and used only for filtering. */
 							seccomp.MaskedEqual(unix.MAP_DENYWRITE, 0),
 						},

runsc/boot/filter/filter.go

@@ -51,7 +51,7 @@ func Install(opt Options) error {
 
 	s.Merge(opt.Platform.SyscallFilters())
 
-	return seccomp.Install(s)
+	return seccomp.Install(s, seccomp.DenyNewExecMappings)
 }
 
 // Report writes a warning message to the log.

runsc/fsgofer/filter/filter.go

@@ -27,7 +27,7 @@ func Install() error {
 	// when not enabled.
 	allowedSyscalls.Merge(instrumentationFilters())
 
-	return seccomp.Install(allowedSyscalls)
+	return seccomp.Install(allowedSyscalls, seccomp.DenyNewExecMappings)
 }
 
 // InstallUDSFilters extends the allowed syscalls to include those necessary for