Seccomp security profiles
Published: 2023-03-20 07:23:14

This blog post tries to exemplate how to run our code in a "Restricted-service operating mode" using libseccomp library

**The Linux Kernel and Syscalls?**

The kernel performs many jobs but we are going be focussing 
on system calls

**Linux Syscalls:**

**Strace:**

- Strace is used to record all the system calls made by the 
particular request

- Then we can use this information to debug or diagnose the problem

**_Examples:_**

- 
The output on the screen after running the **strace** command was simply system calls made to run the **ls** command


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tf8epymi9qspkd9ecwv6.gif)

**Save the Trace execution to a file using option -O**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r7rf7rw24r08gmd33pvb.gif)

The output would be dumped into **trace.log** file

**_Take look at the first line in the trace.log file_**

execve("/usr/bin/ls", ["ls", "test/"], [/* 40 vars */]) = 0

- 
 execve, is the name of a system call being executed.

- 
The text within the parentheses is the arguments provided to the system call.

- 
0 is a value returned by the execve system call.

**Sorting the Result by Columns using option -c:**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iiz78wzhbly40ymdzt7k.gif)

**Obtaining Timing Information using option -t:**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lorik31yncy54j7cdxny.gif)


**Attaching strace to Running Process using option -p:**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2lfi6h6nnd47qdh9db1c.gif)

 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fj950y45xeyfepsuco24.gif)

**Seccomp** 

seccomp (short for secure computing mode) is a computer security facility in the Linux kernel. seccomp allows a process to make a one-way transition into a "secure" state where it cannot make any system calls except exit() , sigreturn() , read() and write() to already-open file descriptors.

**libseccomp**

The libseccomp library provides an easy to use, platform independent, interface to the Linux Kernel's syscall filtering mechanism.

**Installing the libseccomp Library:**

- 
**_Step 1_**: Grab the latest release from the release page at libseccomp repository

- 
**_Step 2:_** If you are building the libseccomp library from an official release tarball, you should follow the familiar three step process used by most autotools based applications:


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tgmnvom7t8yn8ayde5mo.gif)

- 
**_Step 3_**: Install python3-devel using your package manager of choice to fulfil the dependencies needed


**Example Code for Python bindings for the libseccomp library:**

```
def setup_seccomp(log_only):
    f = SyscallFilter(ALLOW)
    # always log, even when returning an error
    f.set_attr(Attr.CTL_LOG, 1)
    action = LOG if log_only else ERRNO(errno.EACCES)
    # stop executions
    f.add_rule(action, "execve")
    f.add_rule(action, "execveat")
    f.add_rule(action, "vfork")
    f.add_rule(action, "fork")
    f.load()
    print(f'Seccomp enabled...')
```

**_Filter action values:_**

    KILL_PROCESS - kill the process
    KILL         - kill the thread
    LOG          - allow the syscall to be executed after the action has been logged
    ALLOW        - allow the syscall to execute
    TRAP         - a SIGSYS signal will be thrown
    NOTIFY       - a notification event will be sent via the notification API
    ERRNO(x)     - syscall will return (x)
    TRACE(x)     - if the process is being traced, (x) will be returned to the tracing process via PTRACE_EVENT_SECCOMP and the PTRACE_GETEVENTMSG option

Here is my repo which attempts to seccomp a simple python program.

https://github.com/manjularajamani/pyseccomp-playground/tree/main/seccompd-progs