// DO NOT USE
// traps and recalls mount/umount syscalls
// gcc -shared -fPIC -o wrapper.so seccomp_trap.c
// LD_PRELOAD=/.../wrapper.so mount ...

#define _GNU_SOURCE

#include <errno.h>
#include <signal.h>
#include <stddef.h>
#include <stdio.h>
#include <string.h>

#include <sys/prctl.h>
#include <sys/syscall.h>

#include <linux/audit.h>
#include <linux/filter.h>
#include <linux/seccomp.h>

#ifndef SYS_SECCOMP
#define SYS_SECCOMP 1 // /usr/include/asm-generic/siginfo.h
#endif

#ifdef __x86_64__
#define MY_ARCH AUDIT_ARCH_X86_64
#else
// x86_64 assembler and register are used here
#error invalid arch
#endif

#ifndef imstupid
#error DO NOT FUCKING USE THIS
#endif


static long syscall6(long n, long a1, long a2, long a3, long a4, long a5, long a6);


static void sighandler(int nr, siginfo_t *info, void *ctxptr)
{
    if (info->si_code != SYS_SECCOMP)
        return;

    if (!ctxptr)
        return;

    ucontext_t *ctx = (ucontext_t *)(ctxptr);

    // see SYSTEM V amd64 ABI

    int syscall_nr = ctx->uc_mcontext.gregs[REG_RAX];
    if (syscall_nr != __NR_mount && syscall_nr != __NR_umount2) // WTF?
        return;

    if (syscall_nr == __NR_mount) {
        char *source = (char*) ctx->uc_mcontext.gregs[REG_RDI];
        char *target = (char*) ctx->uc_mcontext.gregs[REG_RSI];
        char *filesystemtype = (char*) ctx->uc_mcontext.gregs[REG_RDX];
        unsigned long mountflags = ctx->uc_mcontext.gregs[REG_R10];
        void *data = (void*) ctx->uc_mcontext.gregs[REG_R8];

        printf("mount(\"%s\", \"%s\", \"%s\", %ld, %p)\n",
                source, target, filesystemtype, mountflags, data);

        long ret = syscall6(__NR_mount,
                (long)source, (long)target, (long)filesystemtype,
                mountflags, (long)data, 0);

        //result
        ctx->uc_mcontext.gregs[REG_RAX] = ret;
    } else if (syscall_nr == __NR_umount2) {
        char *target = (char*) ctx->uc_mcontext.gregs[REG_RDI];
        int flags = ctx->uc_mcontext.gregs[REG_RSI];

        printf("umount2(\"%s\", %d)\n", target, flags);

        long ret = syscall6(__NR_umount2, (long)target, flags, 0, 0, 0, 0);

        ctx->uc_mcontext.gregs[REG_RAX] = ret;
    }
}


__attribute__((constructor))
static void install_wrapper(void)
{
    printf("hello\n");

    struct sigaction act;
    memset(&act, 0, sizeof(act));
    sigset_t mask;
    sigemptyset(&mask);
    sigaddset(&mask, SIGSYS);

    act.sa_sigaction = &sighandler;
    act.sa_flags = SA_SIGINFO;
    if (sigaction(SIGSYS, &act, NULL)) {
        perror("sigaction");
        return;
    }

    if (sigprocmask(SIG_UNBLOCK, &mask, NULL)) {
        perror("sigprocmask");
        return;
    }

    unsigned long syscall_area_begin = (unsigned long) &syscall6;
    unsigned long syscall_area_end = syscall_area_begin + 4096;

    printf("%lx %lx\n", syscall_area_begin, syscall_area_end);

    struct sock_filter filter[] = {
        BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, arch)),
        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, MY_ARCH, 1, 0),
        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
        BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)),
        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_mount, 2, 0),
        BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_umount2, 1, 0),
        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
        BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, instruction_pointer)),
        BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, syscall_area_begin, 0, 2),
        BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, syscall_area_end, 1, 0),
        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
        BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP),
    };

    struct sock_fprog prog = {
        .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
        .filter = filter,
    };

    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
        perror("no_new_privs fail");
        return;
    }

    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
        perror("bpf fail");
        return;
    }
}


__attribute__((aligned(4096)))
static long syscall6(long n, long a1, long a2, long a3, long a4, long a5, long a6)
{
    //https://git.musl-libc.org/cgit/musl/tree/arch/x86_64/syscall_arch.h
    unsigned long ret;
    register long r10 __asm__("r10") = a4;
    register long r8 __asm__("r8") = a5;
    register long r9 __asm__("r9") = a6;
    __asm__ __volatile__ ("syscall" : "=a"(ret) : "a"(n), "D"(a1), "S"(a2),
                          "d"(a3), "r"(r10), "r"(r8), "r"(r9) : "rcx", "r11", "memory");
    return ret;
}
__asm__(".align 4096");