Upgrade to Pro — share decks privately, control downloads, hide ads and more …

A Go Programmer's Guide to Syscalls

A Go Programmer's Guide to Syscalls

From Gophercon 2017

Including: how Linux syscalls work, a simple implementation of strace in 60 lines of Go, and a demonstration of seccomp syscall filtering. Find the code at http://github.com/lizrice/strace-from-scratch, and watch the video from GopherCon here: https://youtu.be/01w7viEZzXQ

Liz Rice

July 13, 2017
Tweet

More Decks by Liz Rice

Other Decks in Technology

Transcript

  1. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.

    A Go programmer’s guide to syscalls Liz Rice @LizRice | @AquaSecTeam
  2. 2 ▪ What are syscalls? ▪ How syscalls work ▪

    Fun with ptrace ▪ Syscalls and security Syscalls @lizrice
  3. 3

  4. 4 What do you need syscalls for? ▪ Files ▪

    Devices ▪ Processes ▪ Communications ▪ Time & date See them with strace @lizrice
  5. 6 Golang syscall package ▪ OS-specific files ▪ e.g. https://golang.org/src/syscall/syscall_linux.go

    ▪ Autogenerated files ▪ e.g. https://golang.org/src/syscall/zsyscall_linux_386.go @lizrice
  6. 10 Making a syscall ▪ Set registers up with syscall

    ID (%rax on x86) & parameters ▪ Trap - transition to kernel - run syscall code ▪ Result returned in %rax (x86) x86 64 table from blog.rchapman.org @lizrice
  7. 12 Syscalls as a portability layer ▪ Implement syscalls interface

    = emulate Linux ▪ Just one syscall function - can implement a subset ▪ Bash shell on Windows @lizrice
  8. 14 ptrace The ptrace() system call provides a means by

    which one process (the "tracer") may observe and control the execution of another process (the "tracee"), and examine and change the tracee's memory and registers. It is primarily used to implement breakpoint debugging and system call tracing. @lizrice
  9. 18 ▪ PTRACE_SYSCALL Restart the stopped tracee ... but arrange

    for the tracee to be stopped at the next entry to or exit from a system call From the tracer's perspective, the tracee will appear to have been stopped by receipt of a SIGTRAP. Catching system calls with ptrace @lizrice
  10. 19 Two stops for PTRACE_SYSCALL ▪ The tracee enters syscall-enter-stop

    just prior to entering any system call … the tracee enters syscall-exit-stop when the system call is finished ▪ Syscall-enter-stop and syscall-exit-stop are indistinguishable from each other by the tracer. ▪ The tracer needs to keep track of the sequence of ptrace-stops @lizrice
  11. 21 Security profiles & microservices ▪ Microservice only performs small

    set of functions ▪ “Least privilege” @lizrice
  12. 22 Security profiles & microservices ▪ Seccomp restricts permitted syscalls

    $ docker run \ --security-opt seccomp=/path/sc_profile.json hello-world @lizrice
  13. 25 Syscalls ▪ Your interface into the kernel ▪ even

    if you’re not using them directly ▪ Portability ▪ running Linux on different hardware ▪ emulation ▪ Strace and ptrace ▪ see / manipulate syscalls ▪ Security ▪ limiting which syscalls are permitted @lizrice
  14. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.

    code will be at github.com/lizrice/strace-from-scratc h @LizRice | @AquaSecTeam