bpf: pfc: Add maximum supported kernel version logic

Add support for an application to specify the maximum kernel version it
currently supports.  Any syscalls that have been added to a kernel
version newer than this specified version will return the unknown
action.  The unknown action defaults to returning ENOSYS, but it can be
overridden via the filter attribute SCMP_FLTATR_ACT_ENOSYS.

When the maximum supported kernel version is enabled, libseccomp will
create a filter as follows:
	* Users explicitly declare rules for syscalls.  No changes here
	  from previous behavior
	* The default action provided via seccomp_init() will still be
	  used for all syscalls that existed as of the user-specified
	  supported kernel
	* Any syscalls that did not exist at the time of the
	  user-specified supported kernel will return the unknown
	  action.  By default libseccomp sets this to return ENOSYS, but
	  it can be overridden via the filter attribute
	  SCMP_FLTATR_ACT_ENOSYS.

Below is a rough pseudo-code outline of a typical usage of this feature:
	seccomp_init()
	seccomp_add_rules()

	(optional but recommended) seccomp_attr_set( binary tree )
	seccomp_attr_set( max supported kernel version, e.g. SCMP_KV_6_5 )
	(optional) seccomp_attr_set( default unknown action )

	seccomp_load()
	seccomp_release()

Fixes: #11
Signed-off-by: Tom Hromatka <tom.hromatka@oracle.com>

Author: drakenclimber

src/api.c

@@ -363,10 +363,14 @@ API int seccomp_merge(scmp_filter_ctx ctx_dst, scmp_filter_ctx ctx_src)
 	if (db_col_valid(col_dst) || db_col_valid(col_src))
 		return _rc_filter(-EINVAL);
 
-	/* NOTE: only the default action, NNP, and TSYNC settings must match */
+	/* NOTE: only the default action, NNP, TSYNC, and kernel version
+	 * settings must match */
 	if ((col_dst->attr.act_default != col_src->attr.act_default) ||
 	    (col_dst->attr.nnp_enable != col_src->attr.nnp_enable) ||
-	    (col_dst->attr.tsync_enable != col_src->attr.tsync_enable))
+	    (col_dst->attr.tsync_enable != col_src->attr.tsync_enable) ||
+	    (col_dst->attr.act_enosys != col_src->attr.act_enosys) ||
+	    (col_dst->attr.kvermax != col_src->attr.kvermax))
+
 		return _rc_filter(-EINVAL);
 
 	return _rc_filter(db_col_merge(col_dst, col_src));
@@ -590,6 +594,14 @@ API int seccomp_rule_add_array(scmp_filter_ctx ctx,
 	if (action == col->attr.act_default)
 		return _rc_filter(-EACCES);
 
+	if (col->attr.kvermax != SCMP_KV_UNDEF)
+		/* Currently libseccomp does not support overwriting rules
+		 * that have already been added to the filter.  The maximum
+		 * supported kernel version feature adds a rule for each
+		 * syscall.  Thus we can't support adding any more syscalls
+		 * after that value is set */
+		return _rc_filter(-EINVAL);
+
 	return _rc_filter(db_col_rule_add(col, 0, action,
 					  syscall, arg_cnt, arg_array));
 }

src/arch.c

@@ -477,3 +477,46 @@ int arch_filter_rule_add(struct db_filter *db,
 		free(rule_dup);
 	return rc;
 }
+
+int arch_add_kver_rule(struct db_filter *db, struct db_api_rule_list *rule,
+		       enum scmp_kver supported_kver)
+{
+	struct db_sys_list *s_iter;
+	enum scmp_kver syscall_added_ver;
+	const char *syscall_name;
+	int rc = 0;
+
+	db_list_foreach(s_iter, db->syscalls) {
+		if (rule->syscall == s_iter->num)
+			/* Do not overwrite existing rules */
+			return 0;
+	}
+
+	syscall_name = (db->arch->syscall_resolve_num_raw)(rule->syscall);
+	if (syscall_name == NULL)
+		/* This syscall number is invalid in this architecture */
+		return 0;
+
+	syscall_added_ver = (db->arch->syscall_num_kver)(rule->syscall);
+	if (syscall_added_ver > supported_kver)
+		/* This syscall is newer than the kernel version supported by
+		 * the application.  Don't add it to the rule, and therefore
+		 * it  will be subject to the attr->act_unknown action */
+		return 0;
+
+	rc = arch_syscall_translate(db->arch, &rule->syscall);
+	if (rc < 0)
+		return 0;
+
+	if (db->arch->rule_add == NULL) {
+		/* syscalls < -1 require a db->arch->rule_add() function */
+		if (rule->syscall < -1 && rule->strict)
+			return 0;
+
+		rc = db_rule_add(db, rule);
+	} else {
+		rc = (db->arch->rule_add)(db, rule);
+	}
+
+	return rc;
+}

src/arch.h

@@ -136,4 +136,6 @@ int arch_syscall_rewrite(const struct arch_def *arch, int *syscall);
 int arch_filter_rule_add(struct db_filter *db,
 			 const struct db_api_rule_list *rule);
 
+int arch_add_kver_rule(struct db_filter *db, struct db_api_rule_list *rule,
+		       enum scmp_kver supported_kver);
 #endif

src/db.c

@@ -1381,7 +1381,7 @@ uint32_t db_col_attr_read(const struct db_filter_col *col,
 int db_col_attr_set(struct db_filter_col *col,
 		    enum scmp_filter_attr attr, uint32_t value)
 {
-	int rc = 0;
+	int rc = 0, iter;
 
 	switch (attr) {
 	case SCMP_FLTATR_ACT_DEFAULT:
@@ -1458,6 +1458,11 @@ int db_col_attr_set(struct db_filter_col *col,
 		col->attr.wait_killable_recv = (value ? 1 : 0);
 		break;
 	case SCMP_FLTATR_ACT_ENOSYS:
+		/* SCMP_FLTATR_ACT_ENOSYS must be set prior to setting
+		 * SCMP_FLTATR_CTL_KVERMAX */
+		if (col->attr.kvermax != SCMP_KV_UNDEF)
+			return -EINVAL;
+
 		if (db_col_action_valid(col, value) == 0)
 			col->attr.act_enosys = value;
 		else
@@ -1467,7 +1472,16 @@ int db_col_attr_set(struct db_filter_col *col,
 	case SCMP_FLTATR_CTL_KVERMAX:
 		if (value <= SCMP_KV_UNDEF || value >=__SCMP_KV_MAX)
 			return -EINVAL;
+
 		col->attr.kvermax = value;
+		db_col_precompute_reset(col);
+
+		/* Create a rule for every syscall that existed up to and
+		 * prior to attr.kver.  libseccomp capably handles duplicate
+		 * rules for a syscall, so if the user adds more rules after
+		 * setting this attribute, libseccomp will simply replace
+		 * the rules added by the unknown-syscall logic */
+		rc = db_add_known_syscalls(col);
 		break;
 	default:
 		rc = -EINVAL;
@@ -2720,3 +2734,110 @@ void db_col_precompute_reset(struct db_filter_col *col)
 	gen_bpf_release(col->prgm_bpf);
 	col->prgm_bpf = NULL;
 }
+
+static int get_max_syscall_num(struct db_filter *filter)
+{
+	if (!filter)
+		return -1;
+
+	switch (filter->arch->token) {
+	case SCMP_ARCH_X86:
+		return MAX_SYSCALL_NUM_X86;
+	case SCMP_ARCH_X86_64:
+		return MAX_SYSCALL_NUM_X86_64;
+	case SCMP_ARCH_X32:
+		return MAX_SYSCALL_NUM_X32;
+	case SCMP_ARCH_ARM:
+		return MAX_SYSCALL_NUM_ARM;
+	case SCMP_ARCH_AARCH64:
+		return MAX_SYSCALL_NUM_AARCH64;
+	case SCMP_ARCH_LOONGARCH64:
+		return MAX_SYSCALL_NUM_LOONGARCH64;
+	case SCMP_ARCH_M68K:
+		return MAX_SYSCALL_NUM_M68K;
+	case SCMP_ARCH_MIPS:
+	case SCMP_ARCH_MIPSEL:
+		return MAX_SYSCALL_NUM_MIPS;
+	case SCMP_ARCH_MIPS64:
+	case SCMP_ARCH_MIPSEL64:
+		return MAX_SYSCALL_NUM_MIPS64;
+	case SCMP_ARCH_MIPS64N32:
+	case SCMP_ARCH_MIPSEL64N32:
+		return MAX_SYSCALL_NUM_MIPS64N32;
+	case SCMP_ARCH_PARISC:
+		return MAX_SYSCALL_NUM_PARISC;
+	case SCMP_ARCH_PARISC64:
+		return MAX_SYSCALL_NUM_PARISC64;
+	case SCMP_ARCH_PPC64:
+	case SCMP_ARCH_PPC64LE:
+		return MAX_SYSCALL_NUM_PPC64;
+	case SCMP_ARCH_PPC:
+		return MAX_SYSCALL_NUM_PPC;
+	case SCMP_ARCH_S390X:
+		return MAX_SYSCALL_NUM_S390X;
+	case SCMP_ARCH_S390:
+		return MAX_SYSCALL_NUM_S390;
+	case SCMP_ARCH_RISCV64:
+		return MAX_SYSCALL_NUM_RISCV64;
+	case SCMP_ARCH_SH:
+	case SCMP_ARCH_SHEB:
+		return MAX_SYSCALL_NUM_SH;
+	default:
+		return -1;
+	}
+}
+
+int db_add_known_syscalls(struct db_filter_col *col)
+{
+	struct db_api_rule_list *rule = NULL;
+	ssize_t chain_size;
+	struct db_api_arg *chain = NULL;
+	int rc, iter, syscall_num, max_syscall_num;
+
+	chain_size = sizeof(*chain) * ARG_COUNT_MAX;
+	chain = zmalloc(chain_size);
+	if (chain == NULL)
+		return -ENOMEM;
+
+	/* create a checkpoint */
+	rc = db_col_transaction_start(col, false);
+	if (rc != 0)
+		goto add_failure;
+
+	for (iter = 0; iter < col->filter_cnt; iter++) {
+		max_syscall_num = get_max_syscall_num(col->filters[iter]);
+		if (max_syscall_num < 0)
+			goto add_failure;
+
+		for (syscall_num = 0; syscall_num < max_syscall_num; syscall_num++) {
+			rule = _db_rule_new(1, col->attr.act_default,
+					    syscall_num, chain);
+			if (rule == NULL) {
+				rc = -ENOMEM;
+				goto add_failure;
+			}
+
+			rc = arch_add_kver_rule(col->filters[iter], rule,
+						col->attr.kvermax);
+			if (rc != 0)
+				goto add_failure;
+
+			free(rule);
+			rule = NULL;
+		}
+	}
+
+add_failure:
+	/* commit the transaction or abort */
+	if (rc == 0)
+		db_col_transaction_commit(col, false);
+	else
+		db_col_transaction_abort(col, false);
+
+	if (rule != NULL)
+		free(rule);
+	if (chain != NULL)
+		free(chain);
+
+	return 0;
+}

src/db.h

@@ -232,4 +232,5 @@ void db_col_precompute_reset(struct db_filter_col *col);
 
 int db_rule_add(struct db_filter *db, const struct db_api_rule_list *rule);
 
+int db_add_known_syscalls(struct db_filter_col *col);
 #endif

src/gen_bpf.c

@@ -2019,7 +2019,10 @@ static int _gen_bpf_build_bpf(struct bpf_state *state,
 	state->bad_arch_hsh = b_badarch->hash;
 
 	/* generate the default action */
-	b_default = _gen_bpf_action(state, NULL, state->attr->act_default);
+	if (state->attr->kvermax != SCMP_KV_UNDEF)
+		b_default = _gen_bpf_action(state, NULL, state->attr->act_enosys);
+	else
+		b_default = _gen_bpf_action(state, NULL, state->attr->act_default);
 	if (b_default == NULL)
 		return -ENOMEM;
 	rc = _hsh_add(state, &b_default, 0);

src/gen_pfc.c

@@ -458,7 +458,11 @@ static int _gen_pfc_arch(const struct db_filter_col *col,
 	_indent(fds, 1);
 	fprintf(fds, "# default action\n");
 	_indent(fds, 1);
-	_pfc_action(fds, col->attr.act_default);
+
+	if (col->attr.kvermax != SCMP_KV_UNDEF)
+		_pfc_action(fds, col->attr.act_enosys);
+	else
+		_pfc_action(fds, col->attr.act_default);
 
 arch_return:
 	while (p_head != NULL) {