1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
[
{
"match": [ /* qemu-pr-helper and similar */
{ "connect": { "addr": { "family": "unix", "path": "/var/run/pr-helper.sock" }, "fd": { "tag": "orig_fd" } } }
],
"call": [
{ "socket": { "family": "unix", "type": "stream", "flags": 0, "protocol": 0 }, "ret": "new_fd" },
{ "connect": { "fd": { "tag": { "get": "new_fd" } }, "addr": { "family": "unix", "path": "/var/run/pr-helper.sock" } }, "ret": "y" }
],
"fd": { "src": { "tag": "new_fd" }, "new": { "tag": "orig_fd" }, "close_on_exec": false },
"return": { "tag": "y" }
},
{
"match": [ /* qemu creates a tap interface */
{ "ioctl": { "path": "/dev/net/tun", "request": "TUNSETIFF", "ifr": { "name": "tap0", "flags": "IFF_TUN" } } }
],
"limit": { "scope": "process", "count": 1 },
"call": { "ioctl": { "request": "TUNSETIFF", "path": "/dev/net/tun", "ifr": { "name": "tap0", "flags": "IFF_TUN", "ret": "x" } } },
"return": { "tag": "x" }
},
{
"match": [ /* CVE-2022-0185-style */
{ "unshare": { "flags": { "has": { "newuser": true, "newnet": false } } } }
],
"block": { }
},
{
"match": [ /* passt */
{ "unshare": { "flags": { "has": [ "ipc", "mount", "uts", "pid" ] } } }
],
"block": { }
},
{
"match": [ /* Giuseppe's example */
{ "mknodat": { "path": { "tag": "path" }, "mode": "c", "major": 1, "minor": { "value": { "in": [ 3, 5, 7, 8, 9 ] }, "tag": "minor" } } }
],
"call": {
"mknod": { "path": { "tag": { "get": "path" } }, "mode": "c", "major": 1, "minor": { "tag": { "get": "minor" } } },
"ret": "x",
"context": { "user": "init", "mnt": "caller" }
},
"return": { "tag": "x" }
}
]
/*
* FLAGS
*
* "field": { "some": [ "ipc", "mount", "uts" ] }
* flags & set
* !!(flags & (ipc | mount | ns))
* OP_BITWISE field AND set
* OP_CMP result EQ 0 -> next match
*
* "field": { "all": [ "ipc", "mount", "uts" ] }
* flags & set == set
* flags & (ipc | mount | ns) == (ipc | mount | ns)
* OP_BITWISE field AND set
* OP_CMP result NE set -> next match
*
* "field": { "none": [ "ipc", "mount", "uts" ] }
* !(flags & set)
* OP_BITWISE field AND set
* OP_CMP result NE 0 -> next match
*
* "field": { [ "ipc", "mount", "uts" ] }
* flags == set
* flags == (ipc | mount | ns)
*
* "field": "ipc"
* flags == ipc
*
* MASK
* value = (target value & known values)
*
* NUMBERS
* "arg": { "in": [ 0, 1 ] }
* arg == 0 || arg == 1
*/
|
