components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h"
   6
   7 #include "build/build_config.h"
   8
   9 #if defined(USE_SECCOMP_BPF)
  10
  11 #include <errno.h>
  12 #include <signal.h>
  13 #include <sys/ptrace.h>
  14 #include <sys/types.h>
  15 #include <unistd.h>
  16
  17 #include "base/basictypes.h"
  18 #include "base/callback.h"
  19 #include "base/command_line.h"
  20 #include "base/compiler_specific.h"
  21 #include "base/logging.h"
  22
  23 #include "components/nacl/common/nacl_switches.h"
  24 #include "content/public/common/sandbox_init.h"
  25 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
  26 #include "sandbox/linux/bpf_dsl/policy.h"
  27 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
  28 #include "sandbox/linux/services/linux_syscalls.h"
  29
  30 #endif  // defined(USE_SECCOMP_BPF)
  31
  32 namespace nacl {
  33
  34 #if defined(USE_SECCOMP_BPF)
  35
  36 namespace {
  37
  38 using sandbox::bpf_dsl::Allow;
  39 using sandbox::bpf_dsl::Error;
  40 using sandbox::bpf_dsl::ResultExpr;
  41
  42 class NaClBPFSandboxPolicy : public sandbox::bpf_dsl::Policy {
  43  public:
  44   NaClBPFSandboxPolicy()
  45       : baseline_policy_(content::GetBPFSandboxBaselinePolicy()),
  46         policy_pid_(syscall(__NR_getpid)) {
  47     const base::CommandLine* command_line =
  48         base::CommandLine::ForCurrentProcess();
  49     // nacl_process_host.cc doesn't always enable the debug stub when
  50     // kEnableNaClDebug is passed, but it's OK to enable the extra syscalls
  51     // whenever kEnableNaClDebug is passed.
  52     enable_nacl_debug_ = command_line->HasSwitch(switches::kEnableNaClDebug);
  53   }
  54   ~NaClBPFSandboxPolicy() override {}
  55
  56   ResultExpr EvaluateSyscall(int system_call_number) const override;
  57   ResultExpr InvalidSyscall() const override {
  58     return baseline_policy_->InvalidSyscall();
  59   }
  60
  61  private:
  62   scoped_ptr<sandbox::bpf_dsl::Policy> baseline_policy_;
  63   bool enable_nacl_debug_;
  64   const pid_t policy_pid_;
  65
  66   DISALLOW_COPY_AND_ASSIGN(NaClBPFSandboxPolicy);
  67 };
  68
  69 ResultExpr NaClBPFSandboxPolicy::EvaluateSyscall(int sysno) const {
  70   DCHECK(baseline_policy_);
  71
  72   // EvaluateSyscall must be called from the same process that instantiated the
  73   // NaClBPFSandboxPolicy.
  74   DCHECK_EQ(policy_pid_, syscall(__NR_getpid));
  75
  76   // NaCl's GDB debug stub uses the following socket system calls. We only
  77   // allow them when --enable-nacl-debug is specified.
  78   if (enable_nacl_debug_) {
  79     switch (sysno) {
  80     // trusted/service_runtime/linux/thread_suspension.c needs sigwait(). Thread
  81     // suspension is currently only used in the debug stub.
  82       case __NR_rt_sigtimedwait:
  83         return Allow();
  84 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
  85       // transport_common.cc needs this.
  86       case __NR_accept:
  87       case __NR_setsockopt:
  88         return Allow();
  89 #elif defined(__i386__)
  90       case __NR_socketcall:
  91         return Allow();
  92 #endif
  93       default:
  94         break;
  95     }
  96   }
  97
  98   switch (sysno) {
  99 #if defined(__i386__) || defined(__mips__)
 100     // Needed on i386 to set-up the custom segments.
 101     case __NR_modify_ldt:
 102 #endif
 103     // NaClAddrSpaceBeforeAlloc needs prlimit64.
 104     case __NR_prlimit64:
 105     // NaCl uses custom signal stacks.
 106     case __NR_sigaltstack:
 107     // Below is fairly similar to the policy for a Chromium renderer.
 108 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
 109     case __NR_getrlimit:
 110 #endif
 111 #if defined(__i386__) || defined(__arm__)
 112     case __NR_ugetrlimit:
 113 #endif
 114     // NaCl runtime exposes clock_getres to untrusted code.
 115     case __NR_clock_getres:
 116     // NaCl runtime uses flock to simulate POSIX behavior for pwrite.
 117     case __NR_flock:
 118     case __NR_pread64:
 119     case __NR_pwrite64:
 120     case __NR_sched_get_priority_max:
 121     case __NR_sched_get_priority_min:
 122     case __NR_sysinfo:
 123     // __NR_times needed as clock() is called by CommandBufferHelper, which is
 124     // used by NaCl applications that use Pepper's 3D interfaces.
 125     // See crbug.com/264856 for details.
 126     case __NR_times:
 127     case __NR_uname:
 128       return Allow();
 129     case __NR_ioctl:
 130     case __NR_ptrace:
 131       return Error(EPERM);
 132     case __NR_sched_getaffinity:
 133     case __NR_sched_getparam:
 134     case __NR_sched_getscheduler:
 135     case __NR_sched_setscheduler:
 136       return sandbox::RestrictSchedTarget(policy_pid_, sysno);
 137     default:
 138       return baseline_policy_->EvaluateSyscall(sysno);
 139   }
 140   NOTREACHED();
 141   // GCC wants this.
 142   return Error(EPERM);
 143 }
 144
 145 void RunSandboxSanityChecks() {
 146   errno = 0;
 147   // Make a ptrace request with an invalid PID.
 148   long ptrace_ret = ptrace(PTRACE_PEEKUSER, -1 /* pid */, NULL, NULL);
 149   CHECK_EQ(-1, ptrace_ret);
 150   // Without the sandbox on, this ptrace call would ESRCH instead.
 151   CHECK_EQ(EPERM, errno);
 152 }
 153
 154 }  // namespace
 155
 156 #else
 157
 158 #error "Seccomp-bpf disabled on supported architecture!"
 159
 160 #endif  // defined(USE_SECCOMP_BPF)
 161
 162 bool InitializeBPFSandbox() {
 163 #if defined(USE_SECCOMP_BPF)
 164   bool sandbox_is_initialized = content::InitializeSandbox(
 165       scoped_ptr<sandbox::bpf_dsl::Policy>(new NaClBPFSandboxPolicy));
 166   if (sandbox_is_initialized) {
 167     RunSandboxSanityChecks();
 168     return true;
 169   }
 170 #endif  // defined(USE_SECCOMP_BPF)
 171   return false;
 172 }
 173
 174 }  // namespace nacl