/* Get/set process seccomp mode */
    #define PR_GET_SECCOMP      21
    #define PR_GET_SECCOMP     22

/*
 * If no_new_privs is set, then operations that grant new privileges (i.e.
 * execve) will either fail or not grant them.  This affects suid/sgid,
 * file capabilities, and LSMs.
 *
 * Operations that merely manipulate or drop existing privileges (setresuid,
 * capset, etc.) will still work.  Drop those privileges if you want them gone.
 *
 * Changing LSM security domain is considered a new privilege.  So, for example,
 * asking selinux for a specific new context (e.g. with runcon) will result
 * in execve returning -EPERM.
 *
 * See Documentation/userspace-api/no_new_privs.rst for more details.
 */
#define PR_SET_NO_NEW_PRIVS    38
#define PR_GET_NO_NEW_PRIVS    39

struct sock_fprog {
    unsigned short        len;    /* 指令个数 */
    struct sock_filter *filter; /*指向包含struct sock_filter的结构体数组指针*/
}

struct sock_filter {            /* Filter block */
    __u16 code;                 /* Actual filter code,bpf指令码 */
    __u8  jt;                   /* Jump true */
    __u8  jf;                   /* Jump false */
    __u32 k;                    /* Generic multiuse field */
};
//seccomp-data结构体记录当前正在进行bpf规则检查的系统调用信息
struct seccomp_data{
    int nr;//系统调用号
    __u32 arch;//调用架构
    __u64 instruction_pointer;//CPU指令指针
    __u64 argv[6];//寄存器的值，x86下是ebx，exc,edx,edi,ebp;x64下是rdi,rsi,rdx,r10,r8,r9
}

#include <sys/prctl.h>

int prctl(int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5);

#define _GNU_SOURCE
#include <sys/prctl.h>
#include <stdio.h>

int main() {
    const char* process_name = "MyProcess";

    if (prctl(PR_SET_NAME, (unsigned long) process_name) == -1) {
        perror("prctl");
        return 1;
    }

    // 获取进程名称
    char name[16];
    if (prctl(PR_GET_NAME, (unsigned long) name) == -1) {
        perror("prctl");
        return 1;
    }

    printf("Process name: %s\n", name);

    return 0;
}

#include<stdio.h>
#include<fcntl.h>
#include<unistd.h>
#include<stddef.h>
#include<linux/seccomp.h>
#include<linux/filter.h>
#include<sys/prctl.h>    
#include<linux/bpf.h>             //off和imm都是有符号类型，编码信息定义在内核头文件linux/bpf.h
#include<sys/types.h>

int main()
{
        struct sock_filter filter[]={
                BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 0),   // 从第0个字节开始，传送4个字节
                BPF_JUMP(BPF_JMP|BPF_JEQ, 59, 1, 0), // 比较是否为59（execve 的系统调用号），是就跳过下一行，如果不是，就执行下一行，第三个参数表示执行正确的指令跳转，第四个参数表示执行错误的指令跳转
                BPF_JUMP(BPF_JMP|BPF_JGE, 0, 1, 0),
        //      BPF_STMP(BPF_RET+BPF_K,SECCOMP_RET_KILL),
        //        杀死一个进程
        //        BPF_STMP(BPF_RET+BPF_K,SECCOMP_RET_TRACE),
        //        父进程追踪子进程，具体没太搞清楚
                 BPF_STMT(BPF_RET+BPF_K,SECCOMP_RET_ERRNO),
        //        异常处理
                BPF_STMT(BPF_RET+BPF_K,SECCOMP_RET_ALLOW),
        //        这里表示系统调用如果正常，允许系统调用
        };
        struct sock_fprog prog={
                .len=sizeof(filter)/sizeof(sock_filter[0]),
                .filter=filter,
        };
        prctl(PR_SET_NO_NEW_PRIVS,1,0,0,0);
        prctl(PR_SET_SECCOMP,SECCOMP_MODE_FILTER,&prog);//第一个参数是进行什么设置，第二个参数是设置的过滤模式，第三个参数是设置的过滤规则
        puts("123");
        return 0;
}

#ifndef     BPF_STMT
#define    BPF_STMT(code,k){(unsigned short)(code),0,0,k}
#endif
#ifndef     BPF_JUMP
#define    BPF_JUMP(code,k,jt,jf){(unsigned short)(code),jt,jf,k}
#endif

#include <errno.h>
#include <linux/audit.h>
#include <linux/bpf.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/unistd.h>
#include <stddef.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <unistd.h>

static int install_filter(int nr, int arch, int error) {
  struct sock_filter filter[] = {
      BPF_STMT(BPF_LD + BPF_W + BPF_ABS, (offsetof(struct seccomp_data, arch))),
      BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch, 0, 3),
      BPF_STMT(BPF_LD + BPF_W + BPF_ABS, (offsetof(struct seccomp_data, nr))),
      BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, nr, 0, 1),
      BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ERRNO | (error & SECCOMP_RET_DATA)),
      BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),
  };
  struct sock_fprog prog = {
      .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])),
      .filter = filter,
  };
  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
    perror("prctl(NO_NEW_PRIVS)");
    return 1;
  }
  if (prctl(PR_SET_SECCOMP, 2, &prog)) {
    perror("prctl(PR_SET_SECCOMP)");
    return 1;
  }
  return 0;
}

int main() {
  printf("hey there!\n");

  install_filter(__NR_write, AUDIT_ARCH_X86_64, EPERM);

  printf("something's gonna happen!!\n");
  printf("it will not definitely print this here\n");
  return 0;
}

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  mmap((void *)0x123000, 0x1000uLL, 6, 34, -1, 0LL);
  sub_400949();
  sub_400906();
  sub_400A16();
  return 0LL;
}

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  mmap((void *)0x123000, 0x1000uLL, 6, 34, -1, 0LL);
  seccomp();
  init_0();
  vuln();
  return 0LL;
}

__int64 seccomp()
{
  __int64 v1; // [rsp+8h] [rbp-8h]

  v1 = seccomp_init(0LL);
  seccomp_rule_add(v1, 2147418112LL, 0LL, 0LL);
  seccomp_rule_add(v1, 2147418112LL, 1LL, 0LL);
  seccomp_rule_add(v1, 2147418112LL, 2LL, 0LL);
  seccomp_rule_add(v1, 2147418112LL, 60LL, 0LL);
  return seccomp_load(v1);
}

int sub_400A16()
{
  char buf[32]; // [rsp+0h] [rbp-20h] BYREF

  puts("Easy shellcode, have fun!");
  read(0, buf, 0x38uLL);
  return puts("Baddd! Focu5 me! Baddd! Baddd!");
}