sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h"
   6
   7 #include <errno.h>
   8 #include <sys/mman.h>
   9 #include <sys/socket.h>
  10 #include <sys/syscall.h>
  11 #include <sys/types.h>
  12 #include <unistd.h>
  13
  14 #include "base/logging.h"
  15 #include "build/build_config.h"
  16 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
  17 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
  18 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
  19 #include "sandbox/linux/seccomp-bpf-helpers/syscall_sets.h"
  20 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
  21 #include "sandbox/linux/services/linux_syscalls.h"
  22 #include "sandbox/linux/services/syscall_wrappers.h"
  23
  24 // Changing this implementation will have an effect on *all* policies.
  25 // Currently this means: Renderer/Worker, GPU, Flash and NaCl.
  26
  27 using sandbox::bpf_dsl::Allow;
  28 using sandbox::bpf_dsl::Arg;
  29 using sandbox::bpf_dsl::Error;
  30 using sandbox::bpf_dsl::If;
  31 using sandbox::bpf_dsl::ResultExpr;
  32
  33 namespace sandbox {
  34
  35 namespace {
  36
  37 bool IsBaselinePolicyAllowed(int sysno) {
  38   return SyscallSets::IsAllowedAddressSpaceAccess(sysno) ||
  39          SyscallSets::IsAllowedBasicScheduler(sysno) ||
  40          SyscallSets::IsAllowedEpoll(sysno) ||
  41          SyscallSets::IsAllowedFileSystemAccessViaFd(sysno) ||
  42          SyscallSets::IsAllowedFutex(sysno) ||
  43          SyscallSets::IsAllowedGeneralIo(sysno) ||
  44          SyscallSets::IsAllowedGetOrModifySocket(sysno) ||
  45          SyscallSets::IsAllowedGettime(sysno) ||
  46          SyscallSets::IsAllowedProcessStartOrDeath(sysno) ||
  47          SyscallSets::IsAllowedSignalHandling(sysno) ||
  48          SyscallSets::IsGetSimpleId(sysno) ||
  49          SyscallSets::IsKernelInternalApi(sysno) ||
  50 #if defined(__arm__)
  51          SyscallSets::IsArmPrivate(sysno) ||
  52 #endif
  53 #if defined(__mips__)
  54          SyscallSets::IsMipsPrivate(sysno) ||
  55 #endif
  56          SyscallSets::IsAllowedOperationOnFd(sysno);
  57 }
  58
  59 // System calls that will trigger the crashing SIGSYS handler.
  60 bool IsBaselinePolicyWatched(int sysno) {
  61   return SyscallSets::IsAdminOperation(sysno) ||
  62          SyscallSets::IsAdvancedScheduler(sysno) ||
  63          SyscallSets::IsAdvancedTimer(sysno) ||
  64          SyscallSets::IsAsyncIo(sysno) ||
  65          SyscallSets::IsDebug(sysno) ||
  66          SyscallSets::IsEventFd(sysno) ||
  67          SyscallSets::IsExtendedAttributes(sysno) ||
  68          SyscallSets::IsFaNotify(sysno) ||
  69          SyscallSets::IsFsControl(sysno) ||
  70          SyscallSets::IsGlobalFSViewChange(sysno) ||
  71          SyscallSets::IsGlobalProcessEnvironment(sysno) ||
  72          SyscallSets::IsGlobalSystemStatus(sysno) ||
  73          SyscallSets::IsInotify(sysno) ||
  74          SyscallSets::IsKernelModule(sysno) ||
  75          SyscallSets::IsKeyManagement(sysno) ||
  76          SyscallSets::IsKill(sysno) ||
  77          SyscallSets::IsMessageQueue(sysno) ||
  78          SyscallSets::IsMisc(sysno) ||
  79 #if defined(__x86_64__)
  80          SyscallSets::IsNetworkSocketInformation(sysno) ||
  81 #endif
  82          SyscallSets::IsNuma(sysno) ||
  83          SyscallSets::IsPrctl(sysno) ||
  84          SyscallSets::IsProcessGroupOrSession(sysno) ||
  85 #if defined(__i386__) || defined(__mips__)
  86          SyscallSets::IsSocketCall(sysno) ||
  87 #endif
  88 #if defined(__arm__)
  89          SyscallSets::IsArmPciConfig(sysno) ||
  90 #endif
  91 #if defined(__mips__)
  92          SyscallSets::IsMipsMisc(sysno) ||
  93 #endif
  94          SyscallSets::IsTimer(sysno);
  95 }
  96
  97 // |fs_denied_errno| is the errno return for denied filesystem access.
  98 ResultExpr EvaluateSyscallImpl(int fs_denied_errno,
  99                                pid_t current_pid,
 100                                int sysno) {
 101 #if defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER) || \
 102     defined(MEMORY_SANITIZER)
 103   // TCGETS is required by the sanitizers on failure.
 104   if (sysno == __NR_ioctl) {
 105     return RestrictIoctl();
 106   }
 107
 108   if (sysno == __NR_sched_getaffinity) {
 109     return Allow();
 110   }
 111
 112   if (sysno == __NR_sigaltstack) {
 113     // Required for better stack overflow detection in ASan. Disallowed in
 114     // non-ASan builds.
 115     return Allow();
 116   }
 117 #endif  // defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER) ||
 118         // defined(MEMORY_SANITIZER)
 119
 120   if (IsBaselinePolicyAllowed(sysno)) {
 121     return Allow();
 122   }
 123
 124 #if defined(OS_ANDROID)
 125   // Needed for thread creation.
 126   if (sysno == __NR_sigaltstack)
 127     return Allow();
 128 #endif
 129
 130   if (sysno == __NR_clock_gettime) {
 131     return RestrictClockID();
 132   }
 133
 134   if (sysno == __NR_clone) {
 135     return RestrictCloneToThreadsAndEPERMFork();
 136   }
 137
 138   if (sysno == __NR_fcntl)
 139     return RestrictFcntlCommands();
 140
 141 #if defined(__i386__) || defined(__arm__) || defined(__mips__)
 142   if (sysno == __NR_fcntl64)
 143     return RestrictFcntlCommands();
 144 #endif
 145
 146 #if !defined(__aarch64__)
 147   // fork() is never used as a system call (clone() is used instead), but we
 148   // have seen it in fallback code on Android.
 149   if (sysno == __NR_fork) {
 150     return Error(EPERM);
 151   }
 152 #endif
 153
 154   if (sysno == __NR_futex)
 155     return RestrictFutex();
 156
 157   if (sysno == __NR_set_robust_list)
 158     return Error(EPERM);
 159
 160   if (sysno == __NR_getpriority || sysno ==__NR_setpriority)
 161     return RestrictGetSetpriority(current_pid);
 162
 163   if (sysno == __NR_madvise) {
 164     // Only allow MADV_DONTNEED (aka MADV_FREE).
 165     const Arg<int> advice(2);
 166     return If(advice == MADV_DONTNEED, Allow()).Else(Error(EPERM));
 167   }
 168
 169 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \
 170     defined(__aarch64__)
 171   if (sysno == __NR_mmap)
 172     return RestrictMmapFlags();
 173 #endif
 174
 175 #if defined(__i386__) || defined(__arm__) || defined(__mips__)
 176   if (sysno == __NR_mmap2)
 177     return RestrictMmapFlags();
 178 #endif
 179
 180   if (sysno == __NR_mprotect)
 181     return RestrictMprotectFlags();
 182
 183   if (sysno == __NR_prctl)
 184     return RestrictPrctl();
 185
 186 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__) || \
 187     defined(__aarch64__)
 188   if (sysno == __NR_socketpair) {
 189     // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen.
 190     COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different);
 191     const Arg<int> domain(0);
 192     return If(domain == AF_UNIX, Allow()).Else(CrashSIGSYS());
 193   }
 194 #endif
 195
 196   if (SyscallSets::IsKill(sysno)) {
 197     return RestrictKillTarget(current_pid, sysno);
 198   }
 199
 200   if (SyscallSets::IsFileSystem(sysno) ||
 201       SyscallSets::IsCurrentDirectory(sysno)) {
 202     return Error(fs_denied_errno);
 203   }
 204
 205   if (SyscallSets::IsSeccomp(sysno))
 206     return Error(EPERM);
 207
 208   if (SyscallSets::IsAnySystemV(sysno)) {
 209     return Error(EPERM);
 210   }
 211
 212   if (SyscallSets::IsUmask(sysno) ||
 213       SyscallSets::IsDeniedFileSystemAccessViaFd(sysno) ||
 214       SyscallSets::IsDeniedGetOrModifySocket(sysno) ||
 215       SyscallSets::IsProcessPrivilegeChange(sysno)) {
 216     return Error(EPERM);
 217   }
 218
 219 #if defined(__i386__) || defined(__mips__)
 220   if (SyscallSets::IsSocketCall(sysno))
 221     return RestrictSocketcallCommand();
 222 #endif
 223
 224   if (IsBaselinePolicyWatched(sysno)) {
 225     // Previously unseen syscalls. TODO(jln): some of these should
 226     // be denied gracefully right away.
 227     return CrashSIGSYS();
 228   }
 229
 230   // In any other case crash the program with our SIGSYS handler.
 231   return CrashSIGSYS();
 232 }
 233
 234 }  // namespace.
 235
 236 // Unfortunately C++03 doesn't allow delegated constructors.
 237 // Call other constructor when C++11 lands.
 238 BaselinePolicy::BaselinePolicy() : BaselinePolicy(EPERM) {}
 239
 240 BaselinePolicy::BaselinePolicy(int fs_denied_errno)
 241     : fs_denied_errno_(fs_denied_errno), policy_pid_(sys_getpid()) {
 242 }
 243
 244 BaselinePolicy::~BaselinePolicy() {
 245   // Make sure that this policy is created, used and destroyed by a single
 246   // process.
 247   DCHECK_EQ(sys_getpid(), policy_pid_);
 248 }
 249
 250 ResultExpr BaselinePolicy::EvaluateSyscall(int sysno) const {
 251   // Sanity check that we're only called with valid syscall numbers.
 252   DCHECK(SandboxBPF::IsValidSyscallNumber(sysno));
 253   // Make sure that this policy is used in the creating process.
 254   if (1 == sysno) {
 255     DCHECK_EQ(sys_getpid(), policy_pid_);
 256   }
 257   return EvaluateSyscallImpl(fs_denied_errno_, policy_pid_, sysno);
 258 }
 259
 260 ResultExpr BaselinePolicy::InvalidSyscall() const {
 261   return CrashSIGSYS();
 262 }
 263
 264 }  // namespace sandbox.