mirror of
https://forgejo.xatacraft.ru/Sunshine/mkxp-sunshine.git
synced 2026-08-20 05:49:55 +00:00
75 lines
3.6 KiB
C++
75 lines
3.6 KiB
C++
// https://github.com/moby/profiles/blob/main/seccomp/default.json
|
|
#include "security.h"
|
|
#include "meow.h"
|
|
#include "debugwriter.h"
|
|
#include <stdio.h>
|
|
#include <SDL3/SDL_system.h>
|
|
// In the future, we plan to add a mod loader, so this component is needed to protect users from mod attacks.
|
|
|
|
#ifdef __linux__
|
|
#include <sys/socket.h>
|
|
#include <seccomp.h>
|
|
//Yes its not best way, anyway better than nothing.
|
|
scmp_filter_ctx ctx;
|
|
int seccomplist[] = {SCMP_SYS(bpf), SCMP_SYS(set_mempolicy), SCMP_SYS(set_mempolicy_home_node), SCMP_SYS(vhangup), SCMP_SYS(settimeofday), SCMP_SYS(stime), SCMP_SYS(clock_settime),
|
|
SCMP_SYS(clock_settime64), SCMP_SYS(iopl), SCMP_SYS(ioperm), SCMP_SYS(ptrace), SCMP_SYS(process_vm_writev), SCMP_SYS(process_vm_readv), SCMP_SYS(process_madvise),
|
|
SCMP_SYS(pidfd_getfd), SCMP_SYS(kcmp), SCMP_SYS(delete_module), SCMP_SYS(init_module), SCMP_SYS(init_module), SCMP_SYS(chroot), SCMP_SYS(reboot), SCMP_SYS(unshare),
|
|
SCMP_SYS(umount2), SCMP_SYS(umount), SCMP_SYS(setns), SCMP_SYS(sethostname), SCMP_SYS(setdomainname), SCMP_SYS(bpf), SCMP_SYS(quotactl_fd), SCMP_SYS(quotactl),
|
|
SCMP_SYS(move_mount), SCMP_SYS(mount_setattr), SCMP_SYS(mount), SCMP_SYS(lsm_set_self_attr), SCMP_SYS(lsm_list_modules), SCMP_SYS(lsm_get_self_attr),
|
|
SCMP_SYS(process_vm_readv), SCMP_SYS(process_vm_writev), SCMP_SYS(ptrace), SCMP_SYS(swapon), SCMP_SYS(swapoff), SCMP_SYS(settimeofday),
|
|
SCMP_SYS(sethostname), SCMP_SYS(umount), SCMP_SYS(umount2), SCMP_SYS(vm86old), SCMP_SYS(vm86), SCMP_SYS(setgroups), SCMP_SYS(setgid), SCMP_SYS(setfsuid),
|
|
SCMP_SYS(setfsgid), SCMP_SYS(setdomainname), SCMP_SYS(setns), SCMP_SYS(setpgid), SCMP_SYS(pciconfig_write)};
|
|
#endif
|
|
|
|
void SecurityManagerInit(){
|
|
Debug() << "[SECURITY] Initializing SecurityEngine";
|
|
#ifdef __linux__
|
|
Debug() << "[SECURITY] initializing SECCOMP filter...";
|
|
ctx = seccomp_init(SCMP_ACT_ALLOW); // Default action: Kill the process
|
|
if(ctx == NULL) {
|
|
WarnMsg("Warning: Failed to load SECCOMP! If you receive this warning, IT IS NOT RECOMMENDED to add any third-party modifications to Sunshine!");
|
|
}else{
|
|
int n = sizeof(seccomplist) / sizeof(seccomplist[0]);
|
|
for(int i = 0; i < n; ++i){
|
|
if(seccomp_rule_add(ctx, SCMP_ACT_KILL, seccomplist[i], 0) < 0) {
|
|
printf("seccomp_rule_add failed for %i", seccomplist[i]);
|
|
}
|
|
}
|
|
|
|
//Extra rules
|
|
//Deny all network connections
|
|
if(seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1, SCMP_CMP(0, SCMP_CMP_EQ, AF_INET))){
|
|
Debug() << "seccomp_rule_add failed for extra rules (socket AF_INET)";
|
|
}
|
|
|
|
if(seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1, SCMP_CMP(0, SCMP_CMP_EQ, AF_INET6))){
|
|
Debug() << "seccomp_rule_add failed for extra rules (socket AF_INET6)";
|
|
}
|
|
|
|
if(seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socketpair), 1, SCMP_CMP(0, SCMP_CMP_NE, AF_UNIX))){
|
|
Debug() << "seccomp_rule_add failed for extra rules (socketpair)";
|
|
}
|
|
if(seccomp_load(ctx) < 0) {
|
|
WarnMsg("Warning: Failed to load SECCOMP! If you receive this warning, IT IS NOT RECOMMENDED to add any third-party modifications to Sunshine!");
|
|
seccomp_release(ctx);
|
|
}
|
|
}
|
|
SDL_Sandbox Sandbox = SDL_GetSandbox();
|
|
securitystate = "sandboxed_SECCOMP";
|
|
if(Sandbox == SDL_SANDBOX_FLATPAK)
|
|
securitystate = "sandboxed_FLATPAK";
|
|
if(Sandbox == SDL_SANDBOX_SNAP)
|
|
securitystate = "sandboxed_SNAP";
|
|
#elif __APPLE__
|
|
if(SDL_GetSandbox() == SDL_SANDBOX_MACOS)
|
|
securitystate = "sandboxed_MacOS";
|
|
#else
|
|
Debug() << "[SECURITY] SecurityManager doesn't support this platform.";
|
|
#endif
|
|
}
|
|
|
|
void SecurityManagerDeInit(){
|
|
#ifdef __linux__
|
|
seccomp_release(ctx);
|
|
#endif
|
|
}
|