capabilitiesの削減とseccomp（BPF）によるsyscallフィルタでコンテナの権限を絞る

const KEEP_CAPS = [_]u8{
    linux.CAP.CHOWN,
    linux.CAP.DAC_OVERRIDE,
    linux.CAP.FOWNER,
    linux.CAP.FSETID,
    linux.CAP.KILL,
    linux.CAP.SETGID,
    linux.CAP.SETUID,
    linux.CAP.SETPCAP,
    linux.CAP.NET_BIND_SERVICE,
    linux.CAP.NET_RAW,
    linux.CAP.SYS_CHROOT,
    linux.CAP.MKNOD,
    linux.CAP.AUDIT_WRITE,
    linux.CAP.SETFCAP,
};

const CAPABILITY_VERSION_3: u32 = 0x20080522;

fn keepMask() u64 {
    var mask: u64 = 0;
    for (KEEP_CAPS) |cap| mask |= @as(u64, 1) << @as(u6, @intCast(cap));
    return mask;
}

pub fn dropToMinimalSet() !void {
    const mask = keepMask();

    var cap: u8 = 0;
    while (cap <= linux.CAP.LAST_CAP) : (cap += 1) {
        if (mask & (@as(u64, 1) << @as(u6, @intCast(cap))) != 0) continue;
        try sys.prctl(@intFromEnum(linux.PR.CAPBSET_DROP), cap, 0, 0, 0);
    }

    var header = linux.cap_user_header_t{ .version = CAPABILITY_VERSION_3, .pid = 0 };
    const data = [2]linux.cap_user_data_t{
        .{ .effective = @truncate(mask), .permitted = @truncate(mask), .inheritable = 0 },
        .{ .effective = @truncate(mask >> 32), .permitted = @truncate(mask >> 32), .inheritable = 0 },
    };
    try sys.setCapabilities(&header, &data[0]);
}

const sock_filter = extern struct {
    code: u16,
    jt: u8,
    jf: u8,
    k: u32,
};

const sock_fprog = extern struct {
    len: u16,
    filter: [*]const sock_filter,
};

const BPF_LD_W_ABS: u16 = 0x00 | 0x00 | 0x20; // BPF_LD | BPF_W | BPF_ABS
const BPF_JMP_JEQ_K: u16 = 0x05 | 0x10 | 0x00; // BPF_JMP | BPF_JEQ | BPF_K
const BPF_RET_K: u16 = 0x06 | 0x00; // BPF_RET | BPF_K
const EPERM: u32 = 1;

fn stmt(code: u16, k: u32) sock_filter {
    return .{ .code = code, .jt = 0, .jf = 0, .k = k };
}

fn jump(code: u16, k: u32, jt: u8, jf: u8) sock_filter {
    return .{ .code = code, .jt = jt, .jf = jf, .k = k };
}

pub fn blockMount() !void {
    const nr_offset: u32 = @offsetOf(linux.SECCOMP.data, "nr");
    const mount_nr: u32 = @intFromEnum(linux.SYS.mount);

    const program = [_]sock_filter{
        stmt(BPF_LD_W_ABS, nr_offset),
        jump(BPF_JMP_JEQ_K, mount_nr, 0, 1),
        stmt(BPF_RET_K, linux.SECCOMP.RET.ERRNO | EPERM),
        stmt(BPF_RET_K, linux.SECCOMP.RET.ALLOW),
    };

    const prog = sock_fprog{ .len = program.len, .filter = &program };

    try sys.prctl(@intFromEnum(linux.PR.SET_NO_NEW_PRIVS), 1, 0, 0, 0);
    try sys.installSeccompFilter(&prog);
}

$ sudo ./zig-out/bin/zigcon run ./rootfs
...
[child] capabilities reduced to Docker-default set
[child] seccomp filter installed (mount blocked)
[child] handing over to /bin/sh

BusyBox v1.30.1 (Ubuntu 1:1.30.1-7ubuntu3.1) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # cat /proc/self/status | grep Cap
CapInh: 0000000000000000
CapPrm: 00000000a80425fb
CapEff: 00000000a80425fb
CapBnd: 00000000a80425fb
CapAmb: 0000000000000000
/ # mount -t proc proc /proc
mount: permission denied (are you root?)
/ # ls /
bin   home  proc  sys
/ # echo hello
hello