Syscall security

Maciej Zenczykowski
2003-09-26T14:05:55Z

Hi,

I'm wondering if there is any way to provide per process bitmasks of
available/illegal syscalls. Obviously this should most likely be
inherited through exec/fork.

For example specyfying that pid N should return -ENOSYS on all syscalls
except read/write/exit.

The reason I'm asking is because I want to run totally untrusted
statically linked binary code (automatically compiled from user
submitted untrusted sources) which only needs read/write access to stdio
which means it only requires syscalls read/write/exit + a few more for
memory alloc/free (like brk) + a few more generated before main is called
(execve and uname I believe).

Currently I'm running the code in a chroot'ed environment (to an empty
dir) under a 'nobody' uid/gid with no open fd's except for std in/out/err
with limits for mem, processor usage, open files, processes (to 1), etc.
Obviously this still allows calling code like 'time', 'getuid', etc and
the like.
Modifying the compiler (or removing the headers) won't help since at worst
I can code it in asm in the source or even in a plain byte table.

I have a working (very much a hack) patch which turns of all but 7 (or
so) of the syscalls (via pseudo-bitmaps).

Basically my question is: has this been done before (if so where/when?),
what would be considered 'the right' way to do this, would this be a
feature to include in the main kernel source?

Thanks,

MaZe.