[mirrors/Programs.git] / c / seccomp.c

/*
 * seccomp.c (Harvie 2o14)
 *
 * This demonstrates how to use SECCOMP_MODE_STRICT to sandbox code on Linux.
 * You need kernel compiled with CONFIG_SECCOMP=y.
 * This prohibits everything except read(2), write(2), _exit(2), and sigreturn(2).
 * Trying to use other syscalls will result in SIGKILL.
 * If you need to enable more syscalls you can use SECCOMP_MODE_FILTER instead.
 * See man 2 prctl for more...
 *
 */

#include <string.h>
#include <sys/prctl.h>
#include <linux/seccomp.h>
#include <sys/syscall.h>

#define DISPLAY(msg) (syscall( SYS_write, 2, msg, strlen(msg) ))

int main() {
	system("echo before");

	if(prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT) == 0)
		DISPLAY("SECCOMP Enabled!\n"); else DISPLAY("SECCOMP Fail!\n");
	//fflush(NULL);

	system("echo after");
}
Commit	Line	Data
e9d5f91f TM	1	/*
e9d5f91f TM	2	* seccomp.c (Harvie 2o14)
06d21dc9 TM	3	*
06d21dc9 TM	4	* This demonstrates how to use SECCOMP_MODE_STRICT to sandbox code on Linux.
e9d5f91f TM	5	* You need kernel compiled with CONFIG_SECCOMP=y.
	6	* This prohibits everything except read(2), write(2), _exit(2), and sigreturn(2).
	7	* Trying to use other syscalls will result in SIGKILL.
	8	* If you need to enable more syscalls you can use SECCOMP_MODE_FILTER instead.
	9	* See man 2 prctl for more...
	10	*
06d21dc9 TM	11	*/
	12
	13	#include <string.h>
	14	#include <sys/prctl.h>
	15	#include <linux/seccomp.h>
	16	#include <sys/syscall.h>
	17
	18	#define DISPLAY(msg) (syscall( SYS_write, 2, msg, strlen(msg) ))
	19
	20	int main() {
	21	system("echo before");
	22
	23	if(prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT) == 0)
	24	DISPLAY("SECCOMP Enabled!\n"); else DISPLAY("SECCOMP Fail!\n");
	25	//fflush(NULL);
	26
	27	system("echo after");
	28	}