You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

W. J. van der Laan 9e530c6352 Merge bitcoin/bitcoin#20487: Add syscall sandboxing using seccomp-bpf (Linux secure computing mode) ... 4747da3a5b Add syscall sandboxing (seccomp-bpf) (practicalswift) Pull request description: Add experimental syscall sandboxing using seccomp-bpf (Linux secure computing mode). Enable filtering of system calls using seccomp-bpf: allow only explicitly allowlisted (expected) syscalls to be called. The syscall sandboxing implemented in this PR is an experimental feature currently available only under Linux x86-64. To enable the experimental syscall sandbox the `-sandbox=<mode>` option must be passed to `bitcoind`: ``` -sandbox=<mode> Use the experimental syscall sandbox in the specified mode (-sandbox=log-and-abort or -sandbox=abort). Allow only expected syscalls to be used by bitcoind. Note that this is an experimental new feature that may cause bitcoind to exit or crash unexpectedly: use with caution. In the "log-and-abort" mode the invocation of an unexpected syscall results in a debug handler being invoked which will log the incident and terminate the program (without executing the unexpected syscall). In the "abort" mode the invocation of an unexpected syscall results in the entire process being killed immediately by the kernel without executing the unexpected syscall. ``` The allowed syscalls are defined on a per thread basis. I've used this feature since summer 2020 and I find it to be a helpful testing/debugging addition which makes it much easier to reason about the actual capabilities required of each type of thread in Bitcoin Core. --- Quick start guide: ``` $ ./configure $ src/bitcoind -regtest -debug=util -sandbox=log-and-abort … 2021-06-09T12:34:56Z Experimental syscall sandbox enabled (-sandbox=log-and-abort): bitcoind will terminate if an unexpected (not allowlisted) syscall is invoked. … 2021-06-09T12:34:56Z Syscall filter installed for thread "addcon" 2021-06-09T12:34:56Z Syscall filter installed for thread "dnsseed" 2021-06-09T12:34:56Z Syscall filter installed for thread "net" 2021-06-09T12:34:56Z Syscall filter installed for thread "msghand" 2021-06-09T12:34:56Z Syscall filter installed for thread "opencon" 2021-06-09T12:34:56Z Syscall filter installed for thread "init" … # A simulated execve call to show the sandbox in action: 2021-06-09T12:34:56Z ERROR: The syscall "execve" (syscall number 59) is not allowed by the syscall sandbox in thread "msghand". Please report. … Aborted (core dumped) $ ``` --- [About seccomp and seccomp-bpf](https://en.wikipedia.org/wiki/Seccomp): > In computer security, seccomp (short for secure computing mode) is a facility in the Linux kernel. seccomp allows a process to make a one-way transition into a "secure" state where it cannot make any system calls except exit(), sigreturn(), and read() and write() to already-open file descriptors. Should it attempt any other system calls, the kernel will terminate the process with SIGKILL or SIGSYS. In this sense, it does not virtualize the system's resources but isolates the process from them entirely. > > […] > > seccomp-bpf is an extension to seccomp that allows filtering of system calls using a configurable policy implemented using Berkeley Packet Filter rules. It is used by OpenSSH and vsftpd as well as the Google Chrome/Chromium web browsers on Chrome OS and Linux. (In this regard seccomp-bpf achieves similar functionality, but with more flexibility and higher performance, to the older systrace—which seems to be no longer supported for Linux.) ACKs for top commit: laanwj: Code review and lightly tested ACK 4747da3a5b Tree-SHA512: e1c28e323eb4409a46157b7cc0fc29a057ba58d1ee2de268962e2ade28ebd4421b5c2536c64a3af6e9bd3f54016600fec88d016adb49864b63edea51ad838e17		3 years ago
..
00_setup_env.sh	ci: use Ubuntu 20.04 as the default Docker container	3 years ago
00_setup_env_android.sh	ci: Bump Android NDK to r22 which supports std::filesystem	3 years ago
00_setup_env_arm.sh	Merge bitcoin/bitcoin#22930: build: remove glibc back compat	3 years ago
00_setup_env_i686_centos.sh	build: enable external signer by default	3 years ago
00_setup_env_i686_multiprocess.sh	Add syscall sandboxing (seccomp-bpf)	3 years ago
00_setup_env_mac.sh	build: set OSX_MIN_VERSION to 10.15	3 years ago
00_setup_env_mac_host.sh	build: set OSX_MIN_VERSION to 10.15	3 years ago
00_setup_env_native_asan.sh	build: enable external signer by default	3 years ago
00_setup_env_native_fuzz.sh	ci: Fuzz with -ftrivial-auto-var-init=pattern	3 years ago
00_setup_env_native_fuzz_with_msan.sh	ci: Properly pass msan cflags	4 years ago
00_setup_env_native_fuzz_with_valgrind.sh	test: fix file permissions on various scripts	4 years ago
00_setup_env_native_msan.sh	ci: Properly pass msan cflags	4 years ago
00_setup_env_native_nowallet.sh	ci: update minimum compiler requirements for std::filesystem	3 years ago
00_setup_env_native_qt5.sh	ci: update minimum compiler requirements for std::filesystem	3 years ago
00_setup_env_native_tsan.sh	build: enable external signer by default	3 years ago
00_setup_env_native_valgrind.sh	ci: Update valgrind config	3 years ago
00_setup_env_s390x.sh	ci: Update s390x config	3 years ago
00_setup_env_win64.sh	release: remove gitian	3 years ago
04_install.sh	Do not clone qa-assets git repository if not necessary	3 years ago
05_before_script.sh	ci: Build depends only once for Android build	4 years ago
06_script_a.sh	CI: add Android APK build script	4 years ago
06_script_b.sh	…
wrap-qemu.sh	scripted-diff: Bump copyright headers	4 years ago
wrap-valgrind.sh	…
wrap-wine.sh	ci: Re-run wine tests once if they fail	4 years ago