Seccomp filter for whitelisting syscalls

main.go

@@ -45,15 +45,16 @@
 	"syscall"
 	"time"
 	"unsafe"
 
 	"github.com/hlandau/dexlogconfig"
 	"github.com/hlandau/xlog"
 	"github.com/oraoto/go-pidfd"
 	"github.com/robertmin1/heteronculous-horklump/httpproxy"
 	"github.com/robertmin1/socks5/v4"
 	"github.com/u-root/u-root/pkg/strace"
 	"golang.org/x/sys/unix"
 	"gopkg.in/hlandau/easyconfig.v1"
+	seccomp "github.com/elastic/go-seccomp-bpf"
 )
 
 var (
@@ -70,18 +71,18 @@
 var exitAddr sync.Map
 
 // Config is a struct to store the program's configuration values.
 type Config struct { //nolint
 	Program           string   `usage:"Program Name"`
 	SocksTCP          string   `default:"127.0.0.1:9050"`
 	Args              []string `usage:"Program Arguments"`
 	KillProg          bool     `default:"false" usage:"Kill the Program in case of a Proxy Leak (bool)"`
 	LogLeaks          bool     `default:"false" usage:"Allow Proxy Leaks but Log any that Occur (bool)"`
 	EnvVar            bool     `default:"true" usage:"Use the Environment Vars TOR_SOCKS_HOST and TOR_SOCKS_PORT (bool)"`
 	Redirect          string   `default:"socks5" usage:"Incase of leak redirect to the desired proxy(socks5,http,trans)"`
 	Proxyuser         string   `default:"" usage:"Proxy username in case of proxy redirection"`
 	Proxypass         string   `default:"" usage:"Proxy password in case of proxy redirection"`
 	OneCircuit        bool     `default:"false" usage:"Disable random SOCKS behavior"`
 	WhitelistLoopback bool     `default:"false" usage:"Whitelist outgoing IP connections to loopback addresses (e.g. 127.0.0.1)"` //nolint:lll
 }
 
 // FullAddress is the network address and port
@@ -103,7 +104,7 @@
 	Port uint16
 }
 
 func main() {
 	// Create a Config and initialize it with default values.
 	cfg := Config{}
 	config := easyconfig.Configurator{
@@ -137,8 +138,14 @@
 		cfg.Proxypass = password
 	}
 
+	err := applySeccompFilter()
+	if err != nil {
+		fmt.Printf("Error applying seccomp filter: %v\n", err)
+		return
+	}
+
 	// Start the program with tracing and handle the CONNECT system call events.
 	if err := strace.Trace(program, func(t strace.Task, record *strace.TraceRecord) error {
 		if record.Event == strace.SyscallEnter && record.Syscall.Sysno == unix.SYS_CONNECT {
 			if err := HandleConnect(t, record, program, cfg); err != nil {
 				return err
@@ -218,7 +225,7 @@
 			}
 
 			return nil
 			// TODO: handle invalid flag
 			// Incase trans proxy will require a different implementation a switch will be used.
 		}
 
@@ -233,7 +240,7 @@
 
 // eventName returns an event name. There should never be an event name
 // we do not known and, if we encounter one, we panic.
 func eventName(r *strace.TraceRecord) (string, error) { //nolint
 	// form up a reasonable name for a system call.
 	// If there is no name, then it will be Exxxx or Xxxxx, where x
 	// is the system call number as %04x.
@@ -254,16 +261,16 @@
 	case strace.SyscallExit:
 		return sysName, nil
 	case strace.SignalExit:
 		return fmt.Sprintf("SignalExit"), nil
 	case strace.Exit:
 		return fmt.Sprintf("Exit"), nil
 	case strace.SignalStop:
 		return fmt.Sprintf("SignalStop"), nil
 	case strace.NewChild:
 		return fmt.Sprintf("NewChild"), nil
 	}
 
 	return "", fmt.Errorf("unknown event %#x from record %v", r.Event, r)
 }
 
 // ParseAddress reads an sockaddr struct from the given address and converts it
@@ -347,7 +354,7 @@
 		//			out.NIC = NICID(a.Scope_id)
 		//}
 
 		if out.Addr == strings.Repeat(nullByte, 16) {
 			out.Addr = ""
 		}
 
@@ -462,7 +469,7 @@
 	case parsedhost.To4()[0] == UDPProtolNum:
 		log.Error("Support for UDP will be implemented")
 	default:
 		return errors.New("invalid ip address")
 	}
 
 	// Poking our proxy IP/Port to the address containing the original address
@@ -475,7 +482,7 @@
 	return nil
 }
 
 func Socksify(args strace.SyscallArguments, record *strace.TraceRecord, t strace.Task, cfg Config) error {
 	username, password := cfg.Proxyuser, cfg.Proxypass
 
 	if !cfg.OneCircuit {
@@ -491,7 +498,7 @@
 
 	addr, _ := exitAddr.LoadAndDelete(record.PID)
 	IPPort := fmt.Sprintf("%v", addr)
 	fd := record.Syscall.Args[0].Uint()
 
 	p, err := pidfd.Open(record.PID, 0)
 	if err != nil {
@@ -512,9 +519,9 @@
 
 	switch cfg.Redirect {
 	case "socks5":
 		cl, err := socks5.NewClient(IPPort, username, password, 10, 10)
 		if err != nil {
 			return err
 		}
 
 		_, err = cl.Dial("tcp", IPPort, conn)
@@ -525,12 +532,12 @@
 	case "http":
 		cl, err := httpproxy.NewClient(cfg.SocksTCP, username, password)
 		if err != nil {
 			return err
 		}
 
 		_, err = cl.Dial("tcp", IPPort, conn)
 		if err != nil {
 			return err
 		}
 	}
 
@@ -541,7 +548,7 @@
 	// Create or open the log file in append mode
 	logFile, err := os.OpenFile("stack_trace.log", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) //nolint
 	if err != nil {
 		return err
 	}
 
 	defer logFile.Close()
@@ -552,7 +559,7 @@
 
 	commBytes, err := os.ReadFile(commPath)
 	if err != nil {
 		return err
 	}
 	// Split the contents by null byte to separate command and arguments
 	cmdline := strings.Split(string(commBytes), "\x00")
@@ -566,7 +573,7 @@
 	go_log.Printf("Program and Arguments:%v\n", cmdline)
 
 	// Get the stack trace
 	stack := make([]byte, 8192)
 	length := runtime.Stack(stack, true)
 
 	// Write the stack trace to the log file
@@ -589,16 +596,16 @@
 }
 
 func GenerateRandomCredentials() (string, error) {
 	bytes := make([]byte, 48)
 	if _, err := rand.Read(bytes); err != nil {
 		return "", err
 	}
 
 	return hex.EncodeToString(bytes), nil
 }
 
 func initializeAuthData() {
 	for i := 0; i < 10; i++ {
 		username, _ := GenerateRandomCredentials()
 		password, _ := GenerateRandomCredentials()
 		authData = append(authData, struct {
@@ -607,3 +614,60 @@
 		}{username, password})
 	}
 }
+
+func applySeccompFilter() error{
+	// Create a filter.
+	filter := seccomp.Filter{
+		NoNewPrivs: true,
+		Flag:       seccomp.FilterFlagTSync,
+		Policy: seccomp.Policy{
+			DefaultAction: seccomp.ActionErrno,
+			Syscalls: []seccomp.SyscallGroup{
+				{
+					Action: seccomp.ActionAllow,
+					// Torsocks syscall whitelist https://gitlab.torproject.org/tpo/core/torsocks/-/blob/main/src/lib/syscall.c?ref_type=heads#L486
+					Names: []string{
+						"socket",            // Create an endpoint for communication (network socket)
+						"connect",           // Initiate a connection on a socket
+						"close",             // Close a file descriptor, socket, or resource
+						"mmap",              // Map files or devices into memory
+						"munmap",            // Unmap previously mapped memory
+						"accept",            // Accept a connection on a socket
+						"getpeername",       // Retrieve the address of the peer connected to a socket
+						"listen",            // Listen for connections on a socket
+						"recvmsg",           // Receive messages from a socket
+						"gettid",            // Get the thread ID of the calling thread
+						"getrandom",         // Generate random numbers from the kernel's entropy pool
+						"futex",             // Fast user-space locking (for thread synchronization)
+						"accept4",           // Accept a connection on a socket with flags (non-blocking, etc.)
+						"epoll_create1",     // Create an epoll instance (used for scalable I/O event notification)
+						"epoll_wait",        // Wait for I/O events on an epoll instance
+						"epoll_pwait",       // Similar to epoll_wait but allows signal mask modification
+						"epoll_ctl",         // Control interface for epoll, used to add/remove/watch file descriptors
+						"eventfd2",          // Create a file descriptor for event notifications
+						"inotify_init1",     // Initialize inotify (used to monitor filesystem changes)
+						"inotify_add_watch", // Add a watch for filesystem events (e.g., file changes)
+						"inotify_rm_watch",  // Remove a watch from inotify
+						"sched_getaffinity", // Get the CPU affinity mask for a thread (which CPUs the thread can run on)
+						"seccomp",           // Load or manipulate a seccomp filter (for syscall restriction)
+						"gettimeofday",      // Get the current time
+						"clock_gettime",     // Retrieve the time of the specified clock (e.g., system uptime)
+						"fork",              // Create a new process by duplicating the calling process
+						"memfd_create",      // Create an anonymous file in memory (used for file-backed memory regions)
+						"getdents",          // Read directory entries from a file descriptor
+						"getdents64",        // Read directory entries (64-bit version, used on 64-bit systems)
+					},
+				},
+			},
+		},
+	}
+
+	// Load it. This will set no_new_privs before loading.
+	if err := seccomp.LoadFilter(filter); err != nil {
+		fmt.Println("failed to load filter: ", err)
+		return err
+	}
+	fmt.Println("Seccomp filter applied successfully")
+
+	return nil
+}