{"action":"created","comment":{"url":"https://api.github.com/repos/elastic/ml-cpp/pulls/comments/189807902","pull_request_review_id":122055615,"id":189807902,"diff_hunk":"@@ -0,0 +1,113 @@\n+/*\n+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one\n+ * or more contributor license agreements. Licensed under the Elastic License;\n+ * you may not use this file except in compliance with the Elastic License.\n+ */\n+#include \"seccomp/CSystemCallFilter.h\"\n+\n+#include <core/CLogger.h>\n+\n+#include <linux/audit.h>\n+#include <linux/filter.h>\n+#include <sys/prctl.h>\n+#include <sys/syscall.h>\n+\n+\n+namespace ml {\n+namespace seccomp {\n+\n+// The old x32 ABI always has bit 30 set in the sys call numbers.\n+// The x64 architecture should fail these calls\n+unsigned int UPPER_NR_LIMIT = 0x3FFFFFFF;\n+\n+// Offset to the nr field in struct seccomp_data\n+unsigned int SECCOMP_DATA_NR_OFFSET   = 0x00;\n+// Offset to the arch field in struct seccomp_data\n+unsigned int SECCOMP_DATA_ARCH_OFFSET = 0x04;\n+\n+// Copied from seccomp.h\n+// seccomp.h cannot be included as it was added in Linux kernal 3.17","path":"lib/seccomp/CSystemCallFilter_Linux.cc","position":29,"original_position":29,"commit_id":"14696df7f6969ba852f268d4974c790bec469eaf","original_commit_id":"14696df7f6969ba852f268d4974c790bec469eaf","user":{"login":"droberts195","id":7405510,"avatar_url":"https://avatars0.githubusercontent.com/u/7405510?v=4","gravatar_id":"","url":"https://api.github.com/users/droberts195","html_url":"https://github.com/droberts195","followers_url":"https://api.github.com/users/droberts195/followers","following_url":"https://api.github.com/users/droberts195/following{/other_user}","gists_url":"https://api.github.com/users/droberts195/gists{/gist_id}","starred_url":"https://api.github.com/users/droberts195/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/droberts195/subscriptions","organizations_url":"https://api.github.com/users/droberts195/orgs","repos_url":"https://api.github.com/users/droberts195/repos","events_url":"https://api.github.com/users/droberts195/events{/privacy}","received_events_url":"https://api.github.com/users/droberts195/received_events","type":"User","site_admin":false},"body":"typo: kernal -> kernel","created_at":"2018-05-22T08:01:08Z","updated_at":"2018-05-22T09:03:28Z","html_url":"https://github.com/elastic/ml-cpp/pull/98#discussion_r189807902","pull_request_url":"https://api.github.com/repos/elastic/ml-cpp/pulls/98","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/elastic/ml-cpp/pulls/comments/189807902"},"html":{"href":"https://github.com/elastic/ml-cpp/pull/98#discussion_r189807902"},"pull_request":{"href":"https://api.github.com/repos/elastic/ml-cpp/pulls/98"}}},"pull_request":{"url":"https://api.github.com/repos/elastic/ml-cpp/pulls/98","id":189423653,"html_url":"https://github.com/elastic/ml-cpp/pull/98","diff_url":"https://github.com/elastic/ml-cpp/pull/98.diff","patch_url":"https://github.com/elastic/ml-cpp/pull/98.patch","issue_url":"https://api.github.com/repos/elastic/ml-cpp/issues/98","number":98,"state":"open","locked":false,"title":"[ML] Add system call restrictions to the ML processes ","user":{"login":"davidkyle","id":2353640,"avatar_url":"https://avatars1.githubusercontent.com/u/2353640?v=4","gravatar_id":"","url":"https://api.github.com/users/davidkyle","html_url":"https://github.com/davidkyle","followers_url":"https://api.github.com/users/davidkyle/followers","following_url":"https://api.github.com/users/davidkyle/following{/other_user}","gists_url":"https://api.github.com/users/davidkyle/gists{/gist_id}","starred_url":"https://api.github.com/users/davidkyle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidkyle/subscriptions","organizations_url":"https://api.github.com/users/davidkyle/orgs","repos_url":"https://api.github.com/users/davidkyle/repos","events_url":"https://api.github.com/users/davidkyle/events{/privacy}","received_events_url":"https://api.github.com/users/davidkyle/received_events","type":"User","site_admin":false},"body":"The `autodetect`, `autoconfig`, `categorize` and `normalize` programs all require the ability to create a named pipe (mkfifo/CreateNamedPipe) open a connection to a named pipe and read & write to those pipes. All other system calls which are not required such as fork/exec should be restricted using platform specific APIs.\r\n\r\nThe code here is similar to [SystemCallFilter.java](https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/bootstrap/SystemCallFilter.java).\r\n\r\n## LibSeccomp\r\nThis PR adds a new _static_ library `libseccomp` containing a single class `CSystemCallFilter` the library must be linked in the 4 main programs listed above.\r\n\r\n## macOs\r\nmacOs has the most configurable sandboxing functionality the approach here is to blacklist everything by default but allow `read*` and `write*` for open, mkfifo, read and write. This imposes harder limits than the [SystemCallFilter.java](https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/bootstrap/SystemCallFilter.java#L448) which only denies fork and exec.\r\n\r\n## Linux\r\nSeccomp BPF was added to `prctl()` in kernal 3.5, no filters will be installed in older kernals. The dedicated `seccomp()` function was added in kernal 3.17 and provides the same the functionality as `prctl()` but with the [SECCOMP_FILTER_FLAG_TSYNC](http://man7.org/linux/man-pages/man2/seccomp.2.html) option that is not required here if the filters are installed by the main thread before any other threads are spawned.\r\n\r\n[SystemCallFilter.java](https://github.com/elastic/elasticsearch/blob/master/server/src/main/java/org/elasticsearch/bootstrap/SystemCallFilter.java#L391) tries to use `seccomp()` and falls back to `prctl()` \r\n\r\n**TODO** execve, fork and vfork are disallowed should any other system calls be? fexecve? execveat? \r\n\r\n## Windows \r\nThe Windows implementation uses [Job Objects](https://msdn.microsoft.com/en-us/library/windows/desktop/ms684161(v=vs.85).aspx) to prevent the process spawning another. ","created_at":"2018-05-21T16:14:05Z","updated_at":"2018-05-22T09:03:29Z","closed_at":null,"merged_at":null,"merge_commit_sha":"3d0cad1c50e064e058930e33a679879c895e5bd0","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":865918316,"url":"https://api.github.com/repos/elastic/ml-cpp/labels/:ml","name":":ml","color":"009800","default":false},{"id":844905182,"url":"https://api.github.com/repos/elastic/ml-cpp/labels/review","name":"review","color":"0052cc","default":false},{"id":891101315,"url":"https://api.github.com/repos/elastic/ml-cpp/labels/v6.4.0","name":"v6.4.0","color":"e6e6e6","default":false},{"id":844904699,"url":"https://api.github.com/repos/elastic/ml-cpp/labels/v7.0.0","name":"v7.0.0","color":"e6e6e6","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/elastic/ml-cpp/pulls/98/commits","review_comments_url":"https://api.github.com/repos/elastic/ml-cpp/pulls/98/comments","review_comment_url":"https://api.github.com/repos/elastic/ml-cpp/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/ml-cpp/issues/98/comments","statuses_url":"https://api.github.com/repos/elastic/ml-cpp/statuses/14696df7f6969ba852f268d4974c790bec469eaf","head":{"label":"davidkyle:seccomp-lib","ref":"seccomp-lib","sha":"14696df7f6969ba852f268d4974c790bec469eaf","user":{"login":"davidkyle","id":2353640,"avatar_url":"https://avatars1.githubusercontent.com/u/2353640?v=4","gravatar_id":"","url":"https://api.github.com/users/davidkyle","html_url":"https://github.com/davidkyle","followers_url":"https://api.github.com/users/davidkyle/followers","following_url":"https://api.github.com/users/davidkyle/following{/other_user}","gists_url":"https://api.github.com/users/davidkyle/gists{/gist_id}","starred_url":"https://api.github.com/users/davidkyle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidkyle/subscriptions","organizations_url":"https://api.github.com/users/davidkyle/orgs","repos_url":"https://api.github.com/users/davidkyle/repos","events_url":"https://api.github.com/users/davidkyle/events{/privacy}","received_events_url":"https://api.github.com/users/davidkyle/received_events","type":"User","site_admin":false},"repo":{"id":130983924,"name":"ml-cpp","full_name":"davidkyle/ml-cpp","owner":{"login":"davidkyle","id":2353640,"avatar_url":"https://avatars1.githubusercontent.com/u/2353640?v=4","gravatar_id":"","url":"https://api.github.com/users/davidkyle","html_url":"https://github.com/davidkyle","followers_url":"https://api.github.com/users/davidkyle/followers","following_url":"https://api.github.com/users/davidkyle/following{/other_user}","gists_url":"https://api.github.com/users/davidkyle/gists{/gist_id}","starred_url":"https://api.github.com/users/davidkyle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidkyle/subscriptions","organizations_url":"https://api.github.com/users/davidkyle/orgs","repos_url":"https://api.github.com/users/davidkyle/repos","events_url":"https://api.github.com/users/davidkyle/events{/privacy}","received_events_url":"https://api.github.com/users/davidkyle/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/davidkyle/ml-cpp","description":"Machine learning C++ code","fork":true,"url":"https://api.github.com/repos/davidkyle/ml-cpp","forks_url":"https://api.github.com/repos/davidkyle/ml-cpp/forks","keys_url":"https://api.github.com/repos/davidkyle/ml-cpp/keys{/key_id}","collaborators_url":"https://api.github.com/repos/davidkyle/ml-cpp/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/davidkyle/ml-cpp/teams","hooks_url":"https://api.github.com/repos/davidkyle/ml-cpp/hooks","issue_events_url":"https://api.github.com/repos/davidkyle/ml-cpp/issues/events{/number}","events_url":"https://api.github.com/repos/davidkyle/ml-cpp/events","assignees_url":"https://api.github.com/repos/davidkyle/ml-cpp/assignees{/user}","branches_url":"https://api.github.com/repos/davidkyle/ml-cpp/branches{/branch}","tags_url":"https://api.github.com/repos/davidkyle/ml-cpp/tags","blobs_url":"https://api.github.com/repos/davidkyle/ml-cpp/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/davidkyle/ml-cpp/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/davidkyle/ml-cpp/git/refs{/sha}","trees_url":"https://api.github.com/repos/davidkyle/ml-cpp/git/trees{/sha}","statuses_url":"https://api.github.com/repos/davidkyle/ml-cpp/statuses/{sha}","languages_url":"https://api.github.com/repos/davidkyle/ml-cpp/languages","stargazers_url":"https://api.github.com/repos/davidkyle/ml-cpp/stargazers","contributors_url":"https://api.github.com/repos/davidkyle/ml-cpp/contributors","subscribers_url":"https://api.github.com/repos/davidkyle/ml-cpp/subscribers","subscription_url":"https://api.github.com/repos/davidkyle/ml-cpp/subscription","commits_url":"https://api.github.com/repos/davidkyle/ml-cpp/commits{/sha}","git_commits_url":"https://api.github.com/repos/davidkyle/ml-cpp/git/commits{/sha}","comments_url":"https://api.github.com/repos/davidkyle/ml-cpp/comments{/number}","issue_comment_url":"https://api.github.com/repos/davidkyle/ml-cpp/issues/comments{/number}","contents_url":"https://api.github.com/repos/davidkyle/ml-cpp/contents/{+path}","compare_url":"https://api.github.com/repos/davidkyle/ml-cpp/compare/{base}...{head}","merges_url":"https://api.github.com/repos/davidkyle/ml-cpp/merges","archive_url":"https://api.github.com/repos/davidkyle/ml-cpp/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/davidkyle/ml-cpp/downloads","issues_url":"https://api.github.com/repos/davidkyle/ml-cpp/issues{/number}","pulls_url":"https://api.github.com/repos/davidkyle/ml-cpp/pulls{/number}","milestones_url":"https://api.github.com/repos/davidkyle/ml-cpp/milestones{/number}","notifications_url":"https://api.github.com/repos/davidkyle/ml-cpp/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/davidkyle/ml-cpp/labels{/name}","releases_url":"https://api.github.com/repos/davidkyle/ml-cpp/releases{/id}","deployments_url":"https://api.github.com/repos/davidkyle/ml-cpp/deployments","created_at":"2018-04-25T09:37:02Z","updated_at":"2018-04-25T09:37:08Z","pushed_at":"2018-05-21T15:20:17Z","git_url":"git://github.com/davidkyle/ml-cpp.git","ssh_url":"git@github.com:davidkyle/ml-cpp.git","clone_url":"https://github.com/davidkyle/ml-cpp.git","svn_url":"https://github.com/davidkyle/ml-cpp","homepage":"","size":8396,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":null,"url":null},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"elastic:master","ref":"master","sha":"18ebdd67f7ba2b7f861607e248d79e1cca8c7891","user":{"login":"elastic","id":6764390,"avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":122193808,"name":"ml-cpp","full_name":"elastic/ml-cpp","owner":{"login":"elastic","id":6764390,"avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/elastic/ml-cpp","description":"Machine learning C++ code","fork":false,"url":"https://api.github.com/repos/elastic/ml-cpp","forks_url":"https://api.github.com/repos/elastic/ml-cpp/forks","keys_url":"https://api.github.com/repos/elastic/ml-cpp/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/ml-cpp/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/ml-cpp/teams","hooks_url":"https://api.github.com/repos/elastic/ml-cpp/hooks","issue_events_url":"https://api.github.com/repos/elastic/ml-cpp/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/ml-cpp/events","assignees_url":"https://api.github.com/repos/elastic/ml-cpp/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/ml-cpp/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/ml-cpp/tags","blobs_url":"https://api.github.com/repos/elastic/ml-cpp/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/ml-cpp/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/ml-cpp/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/ml-cpp/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/ml-cpp/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/ml-cpp/languages","stargazers_url":"https://api.github.com/repos/elastic/ml-cpp/stargazers","contributors_url":"https://api.github.com/repos/elastic/ml-cpp/contributors","subscribers_url":"https://api.github.com/repos/elastic/ml-cpp/subscribers","subscription_url":"https://api.github.com/repos/elastic/ml-cpp/subscription","commits_url":"https://api.github.com/repos/elastic/ml-cpp/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/ml-cpp/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/ml-cpp/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/ml-cpp/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/ml-cpp/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/ml-cpp/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/ml-cpp/merges","archive_url":"https://api.github.com/repos/elastic/ml-cpp/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/ml-cpp/downloads","issues_url":"https://api.github.com/repos/elastic/ml-cpp/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/ml-cpp/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/ml-cpp/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/ml-cpp/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/ml-cpp/labels{/name}","releases_url":"https://api.github.com/repos/elastic/ml-cpp/releases{/id}","deployments_url":"https://api.github.com/repos/elastic/ml-cpp/deployments","created_at":"2018-02-20T12:13:16Z","updated_at":"2018-05-21T23:21:41Z","pushed_at":"2018-05-21T16:14:06Z","git_url":"git://github.com/elastic/ml-cpp.git","ssh_url":"git@github.com:elastic/ml-cpp.git","clone_url":"https://github.com/elastic/ml-cpp.git","svn_url":"https://github.com/elastic/ml-cpp","homepage":"","size":8311,"stargazers_count":8,"watchers_count":8,"language":"C++","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":8,"mirror_url":null,"archived":false,"open_issues_count":11,"license":{"key":"other","name":"Other","spdx_id":null,"url":null},"forks":8,"open_issues":11,"watchers":8,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/ml-cpp/pulls/98"},"html":{"href":"https://github.com/elastic/ml-cpp/pull/98"},"issue":{"href":"https://api.github.com/repos/elastic/ml-cpp/issues/98"},"comments":{"href":"https://api.github.com/repos/elastic/ml-cpp/issues/98/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/ml-cpp/pulls/98/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/ml-cpp/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/ml-cpp/pulls/98/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/ml-cpp/statuses/14696df7f6969ba852f268d4974c790bec469eaf"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"droberts195"}}