From 1a5d0ebbb71cacd6036837198d56d46ca4ed0c1b Mon Sep 17 00:00:00 2001 From: guochao Date: Wed, 1 Nov 2023 16:17:51 +0800 Subject: [PATCH] first commit --- .cargo/config | 3 + .envrc | 1 + .gitignore | 3 + .vscode/launch.json | 49 ++ Cargo.lock | 336 ++++++++++ Cargo.toml | 23 + README.md | 34 ++ build.rs | 5 + flake.lock | 65 ++ flake.nix | 93 +++ rust-toolchain.toml | 3 + src/main.rs | 40 ++ x2t-sandbox-rulegen/Cargo.toml | 16 + x2t-sandbox-rulegen/src/lib.rs | 63 ++ x2t-syscalls.txt | 1045 ++++++++++++++++++++++++++++++++ 15 files changed, 1779 insertions(+) create mode 100644 .cargo/config create mode 100644 .envrc create mode 100644 .gitignore create mode 100644 .vscode/launch.json create mode 100644 Cargo.lock create mode 100644 Cargo.toml create mode 100644 README.md create mode 100644 build.rs create mode 100644 flake.lock create mode 100644 flake.nix create mode 100644 rust-toolchain.toml create mode 100644 src/main.rs create mode 100644 x2t-sandbox-rulegen/Cargo.toml create mode 100644 x2t-sandbox-rulegen/src/lib.rs create mode 100644 x2t-syscalls.txt diff --git a/.cargo/config b/.cargo/config new file mode 100644 index 0000000..5c9b6f3 --- /dev/null +++ b/.cargo/config @@ -0,0 +1,3 @@ +[build] +target = "x86_64-unknown-linux-musl" + diff --git a/.envrc b/.envrc new file mode 100644 index 0000000..8392d15 --- /dev/null +++ b/.envrc @@ -0,0 +1 @@ +use flake \ No newline at end of file diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..75b76a8 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +.direnv +/target +/result diff --git a/.vscode/launch.json b/.vscode/launch.json new file mode 100644 index 0000000..ff6ac83 --- /dev/null +++ b/.vscode/launch.json @@ -0,0 +1,49 @@ +{ + // Use IntelliSense to learn about possible attributes. + // Hover to view descriptions of existing attributes. + // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 + "version": "0.2.0", + "configurations": [ + { + "type": "lldb", + "request": "launch", + "name": "Debug executable 'x2t-sandbox'", + "cargo": { + "args": [ + "build", + "--bin=x2t-sandbox", + "--package=x2t-sandbox", + "--target=x86_64-unknown-linux-gnu" + ], + "filter": { + "name": "x2t-sandbox", + "kind": "bin" + } + }, + "args": [], + "cwd": "${workspaceFolder}", + "env": { + "RUST_LOG": "DEBUG" + } + }, + { + "type": "lldb", + "request": "launch", + "name": "Debug unit tests in executable 'x2t-sandbox'", + "cargo": { + "args": [ + "test", + "--no-run", + "--bin=x2t-sandbox", + "--package=x2t-sandbox" + ], + "filter": { + "name": "x2t-sandbox", + "kind": "bin" + } + }, + "args": [], + "cwd": "${workspaceFolder}" + } + ] +} \ No newline at end of file diff --git a/Cargo.lock b/Cargo.lock new file mode 100644 index 0000000..2e40034 --- /dev/null +++ b/Cargo.lock @@ -0,0 +1,336 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 3 + +[[package]] +name = "aho-corasick" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0" +dependencies = [ + "memchr", +] + +[[package]] +name = "anyhow" +version = "1.0.75" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6" + +[[package]] +name = "bitflags" +version = "1.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" + +[[package]] +name = "bitflags" +version = "2.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07" + +[[package]] +name = "cfg-if" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" + +[[package]] +name = "env_logger" +version = "0.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "85cdab6a89accf66733ad5a1693a4dcced6aeff64602b634530dd73c1f3ee9f0" +dependencies = [ + "humantime", + "is-terminal", + "log", + "regex", + "termcolor", +] + +[[package]] +name = "errno" +version = "0.3.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860" +dependencies = [ + "libc", + "windows-sys", +] + +[[package]] +name = "hermit-abi" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7" + +[[package]] +name = "humantime" +version = "2.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4" + +[[package]] +name = "is-terminal" +version = "0.4.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b" +dependencies = [ + "hermit-abi", + "rustix", + "windows-sys", +] + +[[package]] +name = "libc" +version = "0.2.149" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b" + +[[package]] +name = "libseccomp" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "21c57fd8981a80019807b7b68118618d29a87177c63d704fc96e6ecd003ae5b3" +dependencies = [ + "bitflags 1.3.2", + "libc", + "libseccomp-sys", + "pkg-config", +] + +[[package]] +name = "libseccomp-sys" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9a7cbbd4ad467251987c6e5b47d53b11a5a05add08f2447a9e2d70aef1e0d138" + +[[package]] +name = "linux-raw-sys" +version = "0.4.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f" + +[[package]] +name = "log" +version = "0.4.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f" + +[[package]] +name = "memchr" +version = "2.6.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167" + +[[package]] +name = "nix" +version = "0.27.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053" +dependencies = [ + "bitflags 2.4.1", + "cfg-if", + "libc", +] + +[[package]] +name = "pkg-config" +version = "0.3.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964" + +[[package]] +name = "proc-macro2" +version = "1.0.69" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "quote" +version = "1.0.33" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae" +dependencies = [ + "proc-macro2", +] + +[[package]] +name = "regex" +version = "1.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343" +dependencies = [ + "aho-corasick", + "memchr", + "regex-automata", + "regex-syntax", +] + +[[package]] +name = "regex-automata" +version = "0.4.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f" +dependencies = [ + "aho-corasick", + "memchr", + "regex-syntax", +] + +[[package]] +name = "regex-syntax" +version = "0.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f" + +[[package]] +name = "rustix" +version = "0.38.21" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b426b0506e5d50a7d8dafcf2e81471400deb602392c7dd110815afb4eaf02a3" +dependencies = [ + "bitflags 2.4.1", + "errno", + "libc", + "linux-raw-sys", + "windows-sys", +] + +[[package]] +name = "termcolor" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6093bad37da69aab9d123a8091e4be0aa4a03e4d601ec641c327398315f62b64" +dependencies = [ + "winapi-util", +] + +[[package]] +name = "unicode-ident" +version = "1.0.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b" + +[[package]] +name = "winapi" +version = "0.3.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419" +dependencies = [ + "winapi-i686-pc-windows-gnu", + "winapi-x86_64-pc-windows-gnu", +] + +[[package]] +name = "winapi-i686-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" + +[[package]] +name = "winapi-util" +version = "0.1.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596" +dependencies = [ + "winapi", +] + +[[package]] +name = "winapi-x86_64-pc-windows-gnu" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f" + +[[package]] +name = "windows-sys" +version = "0.48.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9" +dependencies = [ + "windows-targets", +] + +[[package]] +name = "windows-targets" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c" +dependencies = [ + "windows_aarch64_gnullvm", + "windows_aarch64_msvc", + "windows_i686_gnu", + "windows_i686_msvc", + "windows_x86_64_gnu", + "windows_x86_64_gnullvm", + "windows_x86_64_msvc", +] + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc" + +[[package]] +name = "windows_i686_gnu" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e" + +[[package]] +name = "windows_i686_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.48.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538" + +[[package]] +name = "x2t-sandbox" +version = "0.1.0" +dependencies = [ + "anyhow", + "env_logger", + "libseccomp", + "log", + "nix", + "pkg-config", + "x2t-sandbox-rulegen", +] + +[[package]] +name = "x2t-sandbox-rulegen" +version = "0.1.0" +dependencies = [ + "nix", + "proc-macro2", + "quote", + "regex", +] diff --git a/Cargo.toml b/Cargo.toml new file mode 100644 index 0000000..dca59b5 --- /dev/null +++ b/Cargo.toml @@ -0,0 +1,23 @@ +[package] +name = "x2t-sandbox" +version = "0.1.0" +edition = "2021" + +[workspace] +members = [ + "x2t-sandbox-rulegen" +] + +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] +anyhow = "1.0.75" +env_logger = "0.10.0" +libseccomp = "0.3.0" +log = "0.4.20" +nix = { version = "0.27.1", features = [ "process" ] } +x2t-sandbox-rulegen = { path = "./x2t-sandbox-rulegen" } + +[build-dependencies] +anyhow = "1.0.75" +pkg-config = "0.3.27" diff --git a/README.md b/README.md new file mode 100644 index 0000000..241f8b6 --- /dev/null +++ b/README.md @@ -0,0 +1,34 @@ +# x2t 沙箱 + +为了避免 x2t 解析文档时，被通过内存溢出而执行未信任代码，对 x2t 做一层沙箱，限制 syscall 调用 + +## Quick start + +### Setup + +```bash +curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh +``` + +### Build + +``` +cargo build +``` + +### Run + +``` +cargo run +``` + +## 项目结构 + +- [项目](/) + - [x2t-syscalls.txt](/x2t-syscalls.txt): x2t 用到的 syscall + - [build.rs](/build.rs): 解决少数构建平台无法找到 libseccomp 的问题 + - [x2t-sandbox-rulegen](/x2t-sandbox-rulegen/): 通过 macro 直接从 syscall 列表生成代码，不用内嵌syscall名字文本了，不容易被修改 + - Cargo.toml/Cargo.lock/rust-toolchain.toml: 已经被配置为默认构建静态链接的二进制 + - optional: flake.nix/flake.lock: nix 搭建的、完全统一的统一开发环境，配置为默认构建静态链接的二进制 + - .envrc: 如果不适用nix，注释掉，或者 direnv block 一下不加载就行 + - .gitignore diff --git a/build.rs b/build.rs new file mode 100644 index 0000000..ee782ac --- /dev/null +++ b/build.rs @@ -0,0 +1,5 @@ +fn main() -> anyhow::Result<()> { + pkg_config::probe_library("libseccomp")?; + + Ok(()) +} diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..1ceafdd --- /dev/null +++ b/flake.lock @@ -0,0 +1,65 @@ +{ + "nodes": { + "fenix": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "rust-analyzer-src": "rust-analyzer-src" + }, + "locked": { + "lastModified": 1698733307, + "narHash": "sha256-1DngQANpymPDqFpdeb5CjE7g4+J6E169MqD9KEHOltY=", + "owner": "nix-community", + "repo": "fenix", + "rev": "3755012ba41d5d7f27d6d3d37a82cf30605dcab6", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "fenix", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1698611440, + "narHash": "sha256-jPjHjrerhYDy3q9+s5EAsuhyhuknNfowY6yt6pjn9pc=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "0cbe9f69c234a7700596e943bfae7ef27a31b735", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-unstable", + "type": "indirect" + } + }, + "root": { + "inputs": { + "fenix": "fenix", + "nixpkgs": "nixpkgs" + } + }, + "rust-analyzer-src": { + "flake": false, + "locked": { + "lastModified": 1698691756, + "narHash": "sha256-O250hhxQJhDyGKvVMjrdjuCB90Lz3VgIR5WxQAoCeeM=", + "owner": "rust-lang", + "repo": "rust-analyzer", + "rev": "a2e2881676b52f6d8bd4e4b38cd169e57790013f", + "type": "github" + }, + "original": { + "owner": "rust-lang", + "ref": "nightly", + "repo": "rust-analyzer", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..ad9a57e --- /dev/null +++ b/flake.nix @@ -0,0 +1,93 @@ +{ + inputs = { + fenix = { + url = "github:nix-community/fenix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + nixpkgs.url = "nixpkgs/nixos-unstable"; + }; + outputs = { nixpkgs, fenix, ... }: + let + systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ]; + foreachSystem = nixpkgs.lib.genAttrs systems; + + buildTools = pkgs: with pkgs; [ + pkg-config + # TODO: cargo-lipo + ]; + developmentTools = pkgs: with pkgs; [ + # bpf-linker + # cargo-espflash + cargo-expand + # cargo-generate + # cargo-make + # cargo-mobile2 + # cargo-tauri + # cargo-watch + # TODO: cargo-xcode + # TODO: create-tauri-app + # cargo-espflash + # TODO: kopium + # TODO: ldproxy + # TODO: paperclip + # sea-orm-cli + # perseus-cli + # trunk + # wasm-bindgen-cli + ]; + libraries = pkgs: with pkgs; [ + libseccomp + ]; + + buildRustPlatform = pkgs: with fenix.packages."${pkgs.stdenv.system}"; let toolchain = combine [ complete.toolchain targets."x86_64-unknown-linux-musl".latest.rust-std ]; in pkgs.makeRustPlatform { + cargo = toolchain; + rustc = toolchain; + }; + + buildWithPackages = pkgs: pkgsStatic: (buildRustPlatform pkgsStatic).buildRustPackage rec { + pname = "hello"; + version = "1.0.0"; + + nativeBuildInputs = buildTools pkgs; + buildInputs = libraries pkgsStatic; + + src = ./.; + + cargoLock = { + lockFile = ./Cargo.lock; + }; + + meta = with nixpkgs.lib; { + description = "rust project scaffold"; + homepage = "https://git.jeffthecoder.xyz/public/os-flakes"; + license = licenses.unlicense; + maintainers = [ ]; + }; + } + ; + in + rec { + packages = foreachSystem (system: + let + pkgs = import nixpkgs { inherit system; }; + in + rec { + hello = buildWithPackages pkgs pkgs.pkgsStatic; + + default = hello; + }); + devShells = foreachSystem + (system: + let + pkgs = import nixpkgs { inherit system; }; + in + with pkgs; rec { + default = packages."${system}".default.overrideAttrs (prevAttrs: { + nativeBuildInputs = prevAttrs.nativeBuildInputs ++ (with fenix.packages."${system}".combine; with fenix.packages."${system}"; with pkgs; [ + complete.rust-analyzer + complete.rust-src + ]) ++ (developmentTools pkgs); + }); + }); + }; +} diff --git a/rust-toolchain.toml b/rust-toolchain.toml new file mode 100644 index 0000000..16e9862 --- /dev/null +++ b/rust-toolchain.toml @@ -0,0 +1,3 @@ +[toolchain] +channel = "stable" +targets = ["x86_64-unknown-linux-gnu", "x86_64-unknown-linux-musl"] diff --git a/src/main.rs b/src/main.rs new file mode 100644 index 0000000..3e0f22c --- /dev/null +++ b/src/main.rs @@ -0,0 +1,40 @@ +use std::{ffi::CString, ptr::null}; + +use libseccomp::*; +use nix::libc::EPERM; + +fn main() -> anyhow::Result<()> { + env_logger::init(); + + log::info!("restrict myself by set_no_new_privs..."); + nix::sys::prctl::set_no_new_privs()?; + + log::info!("create filter context..."); + + let mut filter = ScmpFilterContext::new_filter(ScmpAction::Errno(EPERM))?; + + log::info!("add architecture to filter context..."); + filter.add_arch(ScmpArch::X8664)?; + + x2t_sandbox_rulegen::generate! { + log::info!("accepting {}", syscall_name); + }; + + log::info!("load filter into kernel..."); + if let Err(err) = filter.load() { + log::error!("failed to load filter into kernel: {err}"); + return Err(err.into()); + } + + let args: Vec<_> = std::env::args().map(|s| CString::new(s).unwrap()).collect(); + let command = std::env::args().next().unwrap(); + let command = CString::new(command).unwrap(); + let env: Vec = Vec::new(); + + log::info!("executing {:?}", args); + if let Err(err) = nix::unistd::execve(&command, args.as_slice(), env.as_slice()) { + panic!("failed to execve for {err}"); + } + + panic!("unreachable"); +} diff --git a/x2t-sandbox-rulegen/Cargo.toml b/x2t-sandbox-rulegen/Cargo.toml new file mode 100644 index 0000000..a4ad185 --- /dev/null +++ b/x2t-sandbox-rulegen/Cargo.toml @@ -0,0 +1,16 @@ +[package] +name = "x2t-sandbox-rulegen" +version = "0.1.0" +edition = "2021" + +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[lib] +proc-macro = true + +[dependencies] +proc-macro2 = "1" +quote = "1" +nix = "0.27.1" +regex = "1.10.2" + diff --git a/x2t-sandbox-rulegen/src/lib.rs b/x2t-sandbox-rulegen/src/lib.rs new file mode 100644 index 0000000..bf25a7f --- /dev/null +++ b/x2t-sandbox-rulegen/src/lib.rs @@ -0,0 +1,63 @@ +use std::{collections::HashSet, str::FromStr}; + +use proc_macro::*; +use quote::{quote, format_ident, TokenStreamExt}; + +#[proc_macro] +pub fn generate(input: TokenStream) -> TokenStream { + let wd = std::path::PathBuf::from_str(&std::env::var("CARGO_MANIFEST_DIR").unwrap()).unwrap(); + + let syscall_filepath = + wd.join(std::env::var("X2T_SYSCALLS_FILE").unwrap_or("x2t-syscalls.txt".to_string())); + + if let Some(syscalls) = option_env!("X2T_SYSCALLS") { + generate_from(input.clone(), syscalls.to_lowercase(), ":").into() + } else if let Ok(syscalls) = std::fs::read_to_string(&syscall_filepath) { + generate_from(input.clone(), syscalls, "\n").into() + } else { + panic!("either specify a X2T_SYSCALLS environment variable with values seperated by colon or write the allowed syscalls line by line into {}", syscall_filepath.to_string_lossy()); + } +} + +fn generate_from(input: proc_macro::TokenStream, buf: String, sep: &str) -> proc_macro2::TokenStream { + // TODO: improve generate rules to restrict arguments + let mut tokens = Vec::new(); + let mut syscalls = HashSet::new(); + + let raw_syscall_pattern = regex::Regex::new("^\\s*([a-z_][a-z0-9_]*)").unwrap(); + let strace_pattern = regex::Regex::new("^\\d+ ([a-z_][a-z0-9_]*)").unwrap(); + for s in buf.split(sep) { + // s can be a + // - a name matched by [[:space:]]*(?P[a-z_][a-z0-9_]*) + // - strace line matched by [[:digit:]] (?P[a-z_][a-z0-9_]*) + for pattern in [&raw_syscall_pattern, &strace_pattern] { + if let Some(capture) = pattern.captures(s) { + let (_, [syscall_name]) = capture.extract(); + syscalls.insert(syscall_name.to_string()); + break; + } + } + } + let mut syscalls: Vec = syscalls.iter().map(|s| s.to_owned()).collect(); + syscalls.sort(); + + let hook: proc_macro2::TokenStream = input.into(); + + for syscall_name in syscalls { + let libc_name = format_ident!("SYS_{}", syscall_name); + tokens.push( + quote! { + { + let syscall_nr = nix::libc::#libc_name; + let syscall_name = #syscall_name; + filter.add_rule_conditional(ScmpAction::Allow, syscall_nr as i32, &[])?; + #hook + } + } + ); + } + + quote! { + #(#tokens);* + } +} diff --git a/x2t-syscalls.txt b/x2t-syscalls.txt new file mode 100644 index 0000000..4906012 --- /dev/null +++ b/x2t-syscalls.txt @@ -0,0 +1,1045 @@ +# this file contains x2t syscalls, two formats can be used for each line: +# - simple syscall name +execve +# - strace line like this +28527 execve("/home/parallels/work/nutstore-editors/extraResources/linux_arm64/x2t", ["/home/parallels/work/nutstore-ed"..., "/home/parallels/.config/yiyang-s"...], 0xfffffe0c0dd0 /* 4 vars */) = 0 +28527 brk(NULL) = 0xaaaac09dc000 +28527 readlinkat(AT_FDCWD, "/proc/self/exe", "/home/parallels/work/nutstore-ed"..., 4096) = 68 +28527 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffff9155a000 +28527 faccessat(AT_FDCWD, "/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/tls/aarch64/atomics/libgraphics.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/tls/aarch64/atomics", 0xfffff826dbe0, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/tls/aarch64/libgraphics.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/tls/aarch64", 0xfffff826dbe0, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/tls/atomics/libgraphics.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/tls/atomics", 0xfffff826dbe0, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/tls/libgraphics.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/tls", 0xfffff826dbe0, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/aarch64/atomics/libgraphics.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/aarch64/atomics", 0xfffff826dbe0, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/aarch64/libgraphics.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/aarch64", 0xfffff826dbe0, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/atomics/libgraphics.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/atomics", 0xfffff826dbe0, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libgraphics.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\200\313\4\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=7081040, ...}) = 0 +28527 mmap(NULL, 6345096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff90f20000 +28527 mprotect(0xffff914d4000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff914e3000, 233472, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x5b3000) = 0xffff914e3000 +28527 mmap(0xffff9151c000, 70024, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff9151c000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libkernel.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\0\7\t\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=3307440, ...}) = 0 +28527 mmap(NULL, 2764632, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff90c7d000 +28527 mprotect(0xffff90efc000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff90f0c000, 73728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x27f000) = 0xffff90f0c000 +28527 mmap(0xffff90f1e000, 8024, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff90f1e000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libUnicodeConverter.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\300$\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=59144, ...}) = 0 +28527 mmap(NULL, 111768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff90c61000 +28527 mprotect(0xffff90c6c000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff90c7b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0xa000) = 0xffff90c7b000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libkernel_network.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\0207\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=49960, ...}) = 0 +28527 mmap(NULL, 98808, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff90c48000 +28527 mprotect(0xffff90c4f000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff90c5f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x7000) = 0xffff90c5f000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libFb2File.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0`M\1\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=755408, ...}) = 0 +28527 mmap(NULL, 733344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff90b94000 +28527 mprotect(0xffff90c33000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff90c42000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x9e000) = 0xffff90c42000 +28527 mmap(0xffff90c46000, 4256, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff90c46000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libPdfWriter.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\340L\20\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=4343752, ...}) = 0 +28527 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffff91558000 +28527 mmap(NULL, 3538000, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff90834000 +28527 mprotect(0xffff90b4f000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff90b5f000, 196608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x31b000) = 0xffff90b5f000 +28527 mmap(0xffff90b8f000, 19536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff90b8f000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libPdfReader.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\300\n\6\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=3847424, ...}) = 0 +28527 mmap(NULL, 3507272, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff904db000 +28527 mprotect(0xffff907d7000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff907e6000, 311296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x2fb000) = 0xffff907e6000 +28527 mmap(0xffff90832000, 5192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff90832000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libHtmlFile2.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\240I\1\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=1216112, ...}) = 0 +28527 mmap(NULL, 1160864, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff903bf000 +28527 mprotect(0xffff904c5000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff904d5000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x106000) = 0xffff904d5000 +28527 mmap(0xffff904d9000, 5792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff904d9000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libEpubFile.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\240\270\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=237080, ...}) = 0 +28527 mmap(NULL, 251680, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff90381000 +28527 mprotect(0xffff903ae000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff903bd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x2c000) = 0xffff903bd000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libXpsFile.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0 \352\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=378056, ...}) = 0 +28527 mmap(NULL, 367064, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff90327000 +28527 mprotect(0xffff9036f000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff9037f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x48000) = 0xffff9037f000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libDjVuFile.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0PQ\1\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=1519128, ...}) = 0 +28527 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffff91556000 +28527 mmap(NULL, 1365648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff901d9000 +28527 mprotect(0xffff9030c000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff9031c000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x133000) = 0xffff9031c000 +28527 mmap(0xffff90322000, 18064, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff90322000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libHtmlRenderer.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\360\336\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=279872, ...}) = 0 +28527 mmap(NULL, 289344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff90192000 +28527 mprotect(0xffff901c7000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff901d6000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x34000) = 0xffff901d6000 +28527 mmap(0xffff901d8000, 2624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff901d8000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libdoctrenderer.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\200\333R\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=29107528, ...}) = 0 +28527 mmap(NULL, 22454616, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8ec27000 +28527 mprotect(0xffff900d0000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff900e0000, 610304, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x14a9000) = 0xffff900e0000 +28527 mmap(0xffff90175000, 115032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff90175000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libDocxRenderer.so", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\260\320\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0775, st_size=285816, ...}) = 0 +28527 mmap(NULL, 297472, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8ebde000 +28527 mprotect(0xffff8ec14000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff8ec24000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x36000) = 0xffff8ec24000 +28527 mmap(0xffff8ec26000, 2560, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff8ec26000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/tls/aarch64/atomics/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/tls/aarch64/atomics", 0xfffff826da20, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/tls/aarch64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/tls/aarch64", 0xfffff826da20, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/tls/atomics/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/tls/atomics", 0xfffff826da20, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/tls/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/tls", 0xfffff826da20, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/aarch64/atomics/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/aarch64/atomics", 0xfffff826da20, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/aarch64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/aarch64", 0xfffff826da20, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/atomics/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/atomics", 0xfffff826da20, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 newfstatat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/system", 0xfffff826da20, 0) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 11 +28527 fstat(11, {st_mode=S_IFREG|0644, st_size=87446, ...}) = 0 +28527 mmap(NULL, 87446, PROT_READ, MAP_PRIVATE, 11, 0) = 0xffff8ebc8000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/lib/aarch64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0Ha\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0755, st_size=164304, ...}) = 0 +28527 mmap(NULL, 197624, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8eb97000 +28527 mprotect(0xffff8ebb3000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff8ebc2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x1b000) = 0xffff8ebc2000 +28527 mmap(0xffff8ebc4000, 13304, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff8ebc4000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libm.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libm.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/lib/aarch64-linux-gnu/libm.so.6", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\360\272\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0644, st_size=633832, ...}) = 0 +28527 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffff91554000 +28527 mmap(NULL, 696440, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8eaec000 +28527 mprotect(0xffff8eb85000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff8eb95000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x99000) = 0xffff8eb95000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/lib/aarch64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0`\17\2\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0755, st_size=1450832, ...}) = 0 +28527 mmap(NULL, 1519552, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8e979000 +28527 mprotect(0xffff8ead4000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff8eae3000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x15a000) = 0xffff8eae3000 +28527 mmap(0xffff8eae9000, 12224, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff8eae9000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libstdc++.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libstdc++.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/lib/aarch64-linux-gnu/libstdc++.so.6", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\340\247\t\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0644, st_size=1907992, ...}) = 0 +28527 mmap(NULL, 1984176, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8e794000 +28527 mprotect(0xffff8e959000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff8e968000, 57344, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x1c4000) = 0xffff8e968000 +28527 mmap(0xffff8e976000, 9904, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff8e976000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/lib/aarch64-linux-gnu/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\320)\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0644, st_size=80200, ...}) = 0 +28527 mmap(NULL, 144472, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8e770000 +28527 mprotect(0xffff8e783000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff8e792000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x12000) = 0xffff8e792000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libicuuc.so.58", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0@\344\5\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0755, st_size=2072624, ...}) = 0 +28527 mmap(NULL, 1830016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8e5b1000 +28527 mprotect(0xffff8e74c000, 65536, PROT_NONE) = 0 +28527 mmap(0xffff8e75c000, 77824, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x19b000) = 0xffff8e75c000 +28527 mmap(0xffff8e76f000, 3200, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffff8e76f000 +28527 close(11) = 0 +28527 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffff91552000 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libicudata.so.58", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0.\2\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0755, st_size=26215704, ...}) = 0 +28527 mmap(NULL, 26279936, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8cca1000 +28527 mprotect(0xffff8e5a1000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff8e5b0000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x18ff000) = 0xffff8e5b0000 +28527 close(11) = 0 +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libdl.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libdl.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/home/parallels/work/nutstore-editors/extraResources/linux_arm64/libdl.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) +28527 openat(AT_FDCWD, "/lib/aarch64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 11 +28527 read(11, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0P\17\0\0\0\0\0\0"..., 832) = 832 +28527 fstat(11, {st_mode=S_IFREG|0644, st_size=14560, ...}) = 0 +28527 mmap(NULL, 78080, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 11, 0) = 0xffff8cc8d000 +28527 mprotect(0xffff8cc90000, 61440, PROT_NONE) = 0 +28527 mmap(0xffff8cc9f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 11, 0x2000) = 0xffff8cc9f000 +28527 close(11) = 0 +28527 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffff91550000 +28527 mprotect(0xffff8eae3000, 16384, PROT_READ) = 0 +28527 mprotect(0xffff8cc9f000, 4096, PROT_READ) = 0 +28527 mprotect(0xffff8e5b0000, 4096, PROT_READ) = 0 +28527 mprotect(0xffff8ebc2000, 4096, PROT_READ) = 0 +28527 mprotect(0xffff8eb95000, 4096, PROT_READ) = 0 +28527 mprotect(0xffff8e792000, 4096, PROT_READ) = 0 +28527 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffff8cc8b000 +28527 mprotect(0xffff8e968000, 45056, PROT_READ) = 0 +28527 mprotect(0xffff8e75c000, 73728, PROT_READ) = 0 +28527 mprotect(0xffff90f0c000, 61440, PROT_READ) = 0 +28527 mprotect(0xffff90c7b000, 4096, PROT_READ) = 0 +28527 mprotect(0xffff914e3000, 159744, PROT_READ) = 0 +28527 mprotect(0xffff8ec24000, 4096, PROT_READ) = 0 +28527 mprotect(0xffff90c5f000, 4096, PROT_READ) = 0 +28527 mprotect(0xffff900e0000, 434176, PROT_READ) = 0 +28527 mprotect(0xffff901d6000, 4096, PROT_READ) = 0 +28527 mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffff8cc88000 +28527 mprotect(0xffff90b5f000, 184320, PROT_READ) = 0 +28527 mprotect(0xffff9031c000, 16384, PROT_READ) = 0 +28527 mprotect(0xffff9037f000, 4096, PROT_READ) = 0 +28527 mprotect(0xffff904d5000, 12288, PROT_READ) = 0 +28527 mprotect(0xffff903bd000, 4096, PROT_READ) = 0 +28527 mprotect(0xffff907e6000, 106496, PROT_READ) = 0 +28527 mprotect(0xffff90c42000, 12288, PROT_READ) = 0 +28527 mprotect(0xaaaaae0b9000, 2633728, PROT_READ) = 0 +28527 mprotect(0xffff9155f000, 4096, PROT_READ) = 0 +28527 munmap(0xffff8ebc8000, 87446) = 0 +28527 set_tid_address(0xffff91550d60) = 28527 +28527 set_robust_list(0xffff91550d70, 24) = 0 +28527 rt_sigaction(SIGRTMIN, {sa_handler=0xffff8eb9cbd0, sa_mask=[], sa_flags=SA_SIGINFO}, NULL, 8) = 0 +28527 rt_sigaction(SIGRT_1, {sa_handler=0xffff8eb9cc90, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0 +28527 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 +28527 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 +28527 brk(NULL) = 0xaaaac09dc000 +28527 brk(0xaaaac09fd000) = 0xaaaac09fd000 +28527 brk(0xaaaac0a20000) = 0xaaaac0a20000 +28527 futex(0xffff90f1e260, FUTEX_WAKE_PRIVATE, 2147483647) = 0 +28527 futex(0xffff90f1e264, FUTEX_WAKE_PRIVATE, 2147483647) = 0 +28527 brk(0xaaaac0a41000) = 0xaaaac0a41000 +28527 brk(0xaaaac0a62000) = 0xaaaac0a62000 +28527 brk(0xaaaac0a83000) = 0xaaaac0a83000 +28527 brk(0xaaaac0aa4000) = 0xaaaac0aa4000 +28527 brk(0xaaaac0ac5000) = 0xaaaac0ac5000 +28527 brk(0xaaaac0ae6000) = 0xaaaac0ae6000 +28527 brk(0xaaaac0b07000) = 0xaaaac0b07000 +28527 brk(0xaaaac0b28000) = 0xaaaac0b28000 +28527 brk(0xaaaac0b49000) = 0xaaaac0b49000 +28527 brk(0xaaaac0b6a000) = 0xaaaac0b6a000 +28527 brk(0xaaaac0b8b000) = 0xaaaac0b8b000 +28527 brk(0xaaaac0bac000) = 0xaaaac0bac000 +28527 brk(0xaaaac0bcd000) = 0xaaaac0bcd000 +28527 brk(0xaaaac0bee000) = 0xaaaac0bee000 +28527 brk(0xaaaac0c0f000) = 0xaaaac0c0f000 +28527 brk(0xaaaac0c30000) = 0xaaaac0c30000 +28527 brk(0xaaaac0c51000) = 0xaaaac0c51000 +28527 brk(0xaaaac0c72000) = 0xaaaac0c72000 +28527 brk(0xaaaac0c93000) = 0xaaaac0c93000 +28527 brk(0xaaaac0cb5000) = 0xaaaac0cb5000 +28527 brk(0xaaaac0cd6000) = 0xaaaac0cd6000 +28527 brk(0xaaaac0cf7000) = 0xaaaac0cf7000 +28527 brk(0xaaaac0d18000) = 0xaaaac0d18000 +28527 brk(0xaaaac0d39000) = 0xaaaac0d39000 +28527 brk(0xaaaac0d5a000) = 0xaaaac0d5a000 +28527 brk(0xaaaac0d7b000) = 0xaaaac0d7b000 +28527 brk(0xaaaac0d9c000) = 0xaaaac0d9c000 +28527 brk(0xaaaac0dbd000) = 0xaaaac0dbd000 +28527 brk(0xaaaac0dde000) = 0xaaaac0dde000 +28527 brk(0xaaaac0dff000) = 0xaaaac0dff000 +28527 brk(0xaaaac0e20000) = 0xaaaac0e20000 +28527 brk(0xaaaac0e42000) = 0xaaaac0e42000 +28527 brk(0xaaaac0e63000) = 0xaaaac0e63000 +28527 brk(0xaaaac0e84000) = 0xaaaac0e84000 +28527 brk(0xaaaac0ea5000) = 0xaaaac0ea5000 +28527 brk(0xaaaac0ec8000) = 0xaaaac0ec8000 +28527 brk(0xaaaac0ee9000) = 0xaaaac0ee9000 +28527 brk(0xaaaac0f0a000) = 0xaaaac0f0a000 +28527 brk(0xaaaac0f2b000) = 0xaaaac0f2b000 +28527 brk(0xaaaac0f4c000) = 0xaaaac0f4c000 +28527 brk(0xaaaac0f6d000) = 0xaaaac0f6d000 +28527 prlimit64(0, RLIMIT_DATA, {rlim_cur=4194304*1024, rlim_max=4194304*1024}, NULL) = 0 +28527 newfstatat(AT_FDCWD, "/home/parallels/.config/yiyang-suite/onlyoffice/recovery/DE_B5E1/params_from.xml", {st_mode=S_IFREG|0664, st_size=461, ...}, 0) = 0 +28527 openat(AT_FDCWD, "/home/parallels/.config/yiyang-suite/onlyoffice/recovery/DE_B5E1/params_from.xml", O_RDONLY) = 11 +28527 fstat(11, {st_mode=S_IFREG|0664, st_size=461, ...}) = 0 +28527 fstat(11, {st_mode=S_IFREG|0664, st_size=461, ...}) = 0 +28527 lseek(11, 0, SEEK_SET) = 0 +28527 read(11, ""..., 4096) = 4096 +28527 write(14, "\"/><"..., 4096) = 4096 +28527 write(14, "l=\"1\"/>"..., 4096) = 4096 +28527 write(14, "StylePr>"..., 4096) = 4096 +28527 write(14, "Ansi=\"Arial\"/>