sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions_unittests.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
   6
   7 #include <errno.h>
   8 #include <sched.h>
   9 #include <sys/resource.h>
  10 #include <sys/syscall.h>
  11 #include <sys/types.h>
  12 #include <time.h>
  13 #include <unistd.h>
  14
  15 #include "base/bind.h"
  16 #include "base/synchronization/waitable_event.h"
  17 #include "base/sys_info.h"
  18 #include "base/threading/thread.h"
  19 #include "base/time/time.h"
  20 #include "build/build_config.h"
  21 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
  22 #include "sandbox/linux/bpf_dsl/policy.h"
  23 #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
  24 #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
  25 #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
  26 #include "sandbox/linux/seccomp-bpf/syscall.h"
  27 #include "sandbox/linux/services/syscall_wrappers.h"
  28 #include "sandbox/linux/system_headers/linux_syscalls.h"
  29 #include "sandbox/linux/tests/unit_tests.h"
  30
  31 #if !defined(OS_ANDROID)
  32 #include "third_party/lss/linux_syscall_support.h"  // for MAKE_PROCESS_CPUCLOCK
  33 #endif
  34
  35 namespace sandbox {
  36
  37 namespace {
  38
  39 // NOTE: most of the parameter restrictions are tested in
  40 // baseline_policy_unittest.cc as a more end-to-end test.
  41
  42 using sandbox::bpf_dsl::Allow;
  43 using sandbox::bpf_dsl::ResultExpr;
  44
  45 class RestrictClockIdPolicy : public bpf_dsl::Policy {
  46  public:
  47   RestrictClockIdPolicy() {}
  48   ~RestrictClockIdPolicy() override {}
  49
  50   ResultExpr EvaluateSyscall(int sysno) const override {
  51     switch (sysno) {
  52       case __NR_clock_gettime:
  53       case __NR_clock_getres:
  54         return RestrictClockID();
  55       default:
  56         return Allow();
  57     }
  58   }
  59 };
  60
  61 void CheckClock(clockid_t clockid) {
  62   struct timespec ts;
  63   ts.tv_sec = ts.tv_nsec = -1;
  64   BPF_ASSERT_EQ(0, clock_gettime(clockid, &ts));
  65   BPF_ASSERT_LE(0, ts.tv_sec);
  66   BPF_ASSERT_LE(0, ts.tv_nsec);
  67 }
  68
  69 BPF_TEST_C(ParameterRestrictions,
  70            clock_gettime_allowed,
  71            RestrictClockIdPolicy) {
  72   CheckClock(CLOCK_MONOTONIC);
  73   CheckClock(CLOCK_PROCESS_CPUTIME_ID);
  74   CheckClock(CLOCK_REALTIME);
  75   CheckClock(CLOCK_THREAD_CPUTIME_ID);
  76 }
  77
  78 BPF_DEATH_TEST_C(ParameterRestrictions,
  79                  clock_gettime_crash_monotonic_raw,
  80                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
  81                  RestrictClockIdPolicy) {
  82   struct timespec ts;
  83   clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
  84 }
  85
  86 #if defined(OS_CHROMEOS)
  87
  88 // A custom BPF tester delegate to run IsRunningOnChromeOS() before
  89 // the sandbox is enabled because we cannot run it with non-SFI BPF
  90 // sandbox enabled.
  91 class ClockSystemTesterDelegate : public sandbox::BPFTesterDelegate {
  92  public:
  93   ClockSystemTesterDelegate()
  94       : is_running_on_chromeos_(base::SysInfo::IsRunningOnChromeOS()) {}
  95   ~ClockSystemTesterDelegate() override {}
  96
  97   scoped_ptr<sandbox::bpf_dsl::Policy> GetSandboxBPFPolicy() override {
  98     return scoped_ptr<sandbox::bpf_dsl::Policy>(new RestrictClockIdPolicy());
  99   }
 100   void RunTestFunction() override {
 101     if (is_running_on_chromeos_) {
 102       CheckClock(base::TimeTicks::kClockSystemTrace);
 103     } else {
 104       struct timespec ts;
 105       // kClockSystemTrace is 11, which is CLOCK_THREAD_CPUTIME_ID of
 106       // the init process (pid=1). If kernel supports this feature,
 107       // this may succeed even if this is not running on Chrome OS. We
 108       // just check this clock_gettime call does not crash.
 109       clock_gettime(base::TimeTicks::kClockSystemTrace, &ts);
 110     }
 111   }
 112
 113  private:
 114   const bool is_running_on_chromeos_;
 115   DISALLOW_COPY_AND_ASSIGN(ClockSystemTesterDelegate);
 116 };
 117
 118 BPF_TEST_D(BPFTest, BPFTestWithDelegateClass, ClockSystemTesterDelegate);
 119
 120 #elif defined(OS_LINUX)
 121
 122 BPF_DEATH_TEST_C(ParameterRestrictions,
 123                  clock_gettime_crash_system_trace,
 124                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
 125                  RestrictClockIdPolicy) {
 126   struct timespec ts;
 127   clock_gettime(base::TimeTicks::kClockSystemTrace, &ts);
 128 }
 129
 130 #endif  // defined(OS_CHROMEOS)
 131
 132 #if !defined(OS_ANDROID)
 133 BPF_DEATH_TEST_C(ParameterRestrictions,
 134                  clock_gettime_crash_cpu_clock,
 135                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
 136                  RestrictClockIdPolicy) {
 137   // We can't use clock_getcpuclockid() because it's not implemented in newlib,
 138   // and it might not work inside the sandbox anyway.
 139   const pid_t kInitPID = 1;
 140   const clockid_t kInitCPUClockID =
 141       MAKE_PROCESS_CPUCLOCK(kInitPID, CPUCLOCK_SCHED);
 142
 143   struct timespec ts;
 144   clock_gettime(kInitCPUClockID, &ts);
 145 }
 146 #endif  // !defined(OS_ANDROID)
 147
 148 class RestrictSchedPolicy : public bpf_dsl::Policy {
 149  public:
 150   RestrictSchedPolicy() {}
 151   ~RestrictSchedPolicy() override {}
 152
 153   ResultExpr EvaluateSyscall(int sysno) const override {
 154     switch (sysno) {
 155       case __NR_sched_getparam:
 156         return RestrictSchedTarget(getpid(), sysno);
 157       default:
 158         return Allow();
 159     }
 160   }
 161 };
 162
 163 void CheckSchedGetParam(pid_t pid, struct sched_param* param) {
 164   BPF_ASSERT_EQ(0, sched_getparam(pid, param));
 165 }
 166
 167 void SchedGetParamThread(base::WaitableEvent* thread_run) {
 168   const pid_t pid = getpid();
 169   const pid_t tid = sys_gettid();
 170   BPF_ASSERT_NE(pid, tid);
 171
 172   struct sched_param current_pid_param;
 173   CheckSchedGetParam(pid, &current_pid_param);
 174
 175   struct sched_param zero_param;
 176   CheckSchedGetParam(0, &zero_param);
 177
 178   struct sched_param tid_param;
 179   CheckSchedGetParam(tid, &tid_param);
 180
 181   BPF_ASSERT_EQ(zero_param.sched_priority, tid_param.sched_priority);
 182
 183   // Verify that the SIGSYS handler sets errno properly.
 184   errno = 0;
 185   BPF_ASSERT_EQ(-1, sched_getparam(tid, NULL));
 186   BPF_ASSERT_EQ(EINVAL, errno);
 187
 188   thread_run->Signal();
 189 }
 190
 191 BPF_TEST_C(ParameterRestrictions,
 192            sched_getparam_allowed,
 193            RestrictSchedPolicy) {
 194   base::WaitableEvent thread_run(true, false);
 195   // Run the actual test in a new thread so that the current pid and tid are
 196   // different.
 197   base::Thread getparam_thread("sched_getparam_thread");
 198   BPF_ASSERT(getparam_thread.Start());
 199   getparam_thread.message_loop()->PostTask(
 200       FROM_HERE, base::Bind(&SchedGetParamThread, &thread_run));
 201   BPF_ASSERT(thread_run.TimedWait(base::TimeDelta::FromMilliseconds(5000)));
 202   getparam_thread.Stop();
 203 }
 204
 205 BPF_DEATH_TEST_C(ParameterRestrictions,
 206                  sched_getparam_crash_non_zero,
 207                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
 208                  RestrictSchedPolicy) {
 209   const pid_t kInitPID = 1;
 210   struct sched_param param;
 211   sched_getparam(kInitPID, &param);
 212 }
 213
 214 class RestrictPrlimit64Policy : public bpf_dsl::Policy {
 215  public:
 216   RestrictPrlimit64Policy() {}
 217   ~RestrictPrlimit64Policy() override {}
 218
 219   ResultExpr EvaluateSyscall(int sysno) const override {
 220     switch (sysno) {
 221       case __NR_prlimit64:
 222         return RestrictPrlimit64(getpid());
 223       default:
 224         return Allow();
 225     }
 226   }
 227 };
 228
 229 BPF_TEST_C(ParameterRestrictions, prlimit64_allowed, RestrictPrlimit64Policy) {
 230   BPF_ASSERT_EQ(0, sys_prlimit64(0, RLIMIT_AS, NULL, NULL));
 231   BPF_ASSERT_EQ(0, sys_prlimit64(getpid(), RLIMIT_AS, NULL, NULL));
 232 }
 233
 234 BPF_DEATH_TEST_C(ParameterRestrictions,
 235                  prlimit64_crash_not_self,
 236                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
 237                  RestrictPrlimit64Policy) {
 238   const pid_t kInitPID = 1;
 239   BPF_ASSERT_NE(kInitPID, getpid());
 240   sys_prlimit64(kInitPID, RLIMIT_AS, NULL, NULL);
 241 }
 242
 243 class RestrictGetrusagePolicy : public bpf_dsl::Policy {
 244  public:
 245   RestrictGetrusagePolicy() {}
 246   ~RestrictGetrusagePolicy() override {}
 247
 248   ResultExpr EvaluateSyscall(int sysno) const override {
 249     switch (sysno) {
 250       case __NR_getrusage:
 251         return RestrictGetrusage();
 252       default:
 253         return Allow();
 254     }
 255   }
 256 };
 257
 258 BPF_TEST_C(ParameterRestrictions, getrusage_allowed, RestrictGetrusagePolicy) {
 259   struct rusage usage;
 260   BPF_ASSERT_EQ(0, getrusage(RUSAGE_SELF, &usage));
 261 }
 262
 263 BPF_DEATH_TEST_C(ParameterRestrictions,
 264                  getrusage_crash_not_self,
 265                  DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
 266                  RestrictGetrusagePolicy) {
 267   struct rusage usage;
 268   getrusage(RUSAGE_CHILDREN, &usage);
 269 }
 270
 271 }  // namespace
 272
 273 }  // namespace sandbox