deraadt@openbsd.org | c61b42f | 2015-10-02 01:39:26 +0000 | [diff] [blame] | 1 | /* $OpenBSD: sandbox-systrace.c,v 1.18 2015/10/02 01:39:26 deraadt Exp $ */ |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 2 | /* |
| 3 | * Copyright (c) 2011 Damien Miller <djm@mindrot.org> |
| 4 | * |
| 5 | * Permission to use, copy, modify, and distribute this software for any |
| 6 | * purpose with or without fee is hereby granted, provided that the above |
| 7 | * copyright notice and this permission notice appear in all copies. |
| 8 | * |
| 9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
| 12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
| 14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
| 15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| 16 | */ |
| 17 | |
Damien Miller | 0dc7451 | 2015-10-05 18:33:05 -0700 | [diff] [blame^] | 18 | #include "includes.h" |
| 19 | |
| 20 | #ifdef SANDBOX_SYSTRACE |
| 21 | |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 22 | #include <sys/types.h> |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 23 | #include <sys/ioctl.h> |
| 24 | #include <sys/syscall.h> |
| 25 | #include <sys/socket.h> |
Darren Tucker | 3b4b2d3 | 2012-07-02 18:54:31 +1000 | [diff] [blame] | 26 | #include <sys/wait.h> |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 27 | |
| 28 | #include <dev/systrace.h> |
| 29 | |
| 30 | #include <errno.h> |
| 31 | #include <fcntl.h> |
| 32 | #include <limits.h> |
Darren Tucker | 3b4b2d3 | 2012-07-02 18:54:31 +1000 | [diff] [blame] | 33 | #include <signal.h> |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 34 | #include <stdarg.h> |
| 35 | #include <stdio.h> |
| 36 | #include <stdlib.h> |
| 37 | #include <string.h> |
| 38 | #include <unistd.h> |
deraadt@openbsd.org | 087266e | 2015-01-20 23:14:00 +0000 | [diff] [blame] | 39 | #include <limits.h> |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 40 | |
| 41 | #include "atomicio.h" |
| 42 | #include "log.h" |
Damien Miller | dcbd41e | 2011-06-23 19:45:51 +1000 | [diff] [blame] | 43 | #include "ssh-sandbox.h" |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 44 | #include "xmalloc.h" |
| 45 | |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 46 | struct sandbox_policy { |
| 47 | int syscall; |
| 48 | int action; |
| 49 | }; |
| 50 | |
| 51 | /* Permitted syscalls in preauth. Unlisted syscalls get SYSTR_POLICY_KILL */ |
| 52 | static const struct sandbox_policy preauth_policy[] = { |
deraadt@openbsd.org | 7cc44ef | 2015-05-18 15:06:05 +0000 | [diff] [blame] | 53 | { SYS_exit, SYSTR_POLICY_PERMIT }, |
deraadt@openbsd.org | c61b42f | 2015-10-02 01:39:26 +0000 | [diff] [blame] | 54 | #ifdef SYS_kbind |
| 55 | { SYS_kbind, SYSTR_POLICY_PERMIT }, |
| 56 | #endif |
| 57 | |
| 58 | { SYS_getpid, SYSTR_POLICY_PERMIT }, |
| 59 | { SYS_getpgid, SYSTR_POLICY_PERMIT }, |
| 60 | { SYS_clock_gettime, SYSTR_POLICY_PERMIT }, |
| 61 | { SYS_gettimeofday, SYSTR_POLICY_PERMIT }, |
| 62 | { SYS_sigprocmask, SYSTR_POLICY_PERMIT }, |
| 63 | |
Damien Miller | 84a8916 | 2014-07-02 12:47:48 +1000 | [diff] [blame] | 64 | #ifdef SYS_getentropy |
| 65 | /* OpenBSD 5.6 and newer use getentropy(2) to seed arc4random(3). */ |
| 66 | { SYS_getentropy, SYSTR_POLICY_PERMIT }, |
| 67 | #else |
| 68 | /* Previous releases used sysctl(3)'s kern.arnd variable. */ |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 69 | { SYS___sysctl, SYSTR_POLICY_PERMIT }, |
Damien Miller | 84a8916 | 2014-07-02 12:47:48 +1000 | [diff] [blame] | 70 | #endif |
deraadt@openbsd.org | c61b42f | 2015-10-02 01:39:26 +0000 | [diff] [blame] | 71 | { SYS_sendsyslog, SYSTR_POLICY_PERMIT }, |
| 72 | |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 73 | { SYS_madvise, SYSTR_POLICY_PERMIT }, |
| 74 | { SYS_mmap, SYSTR_POLICY_PERMIT }, |
| 75 | { SYS_mprotect, SYSTR_POLICY_PERMIT }, |
Damien Miller | 560de92 | 2012-06-30 08:33:53 +1000 | [diff] [blame] | 76 | { SYS_mquery, SYSTR_POLICY_PERMIT }, |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 77 | { SYS_munmap, SYSTR_POLICY_PERMIT }, |
deraadt@openbsd.org | c61b42f | 2015-10-02 01:39:26 +0000 | [diff] [blame] | 78 | |
deraadt@openbsd.org | 7cc44ef | 2015-05-18 15:06:05 +0000 | [diff] [blame] | 79 | { SYS_poll, SYSTR_POLICY_PERMIT }, |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 80 | { SYS_select, SYSTR_POLICY_PERMIT }, |
deraadt@openbsd.org | c61b42f | 2015-10-02 01:39:26 +0000 | [diff] [blame] | 81 | { SYS_read, SYSTR_POLICY_PERMIT }, |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 82 | { SYS_write, SYSTR_POLICY_PERMIT }, |
deraadt@openbsd.org | c61b42f | 2015-10-02 01:39:26 +0000 | [diff] [blame] | 83 | { SYS_shutdown, SYSTR_POLICY_PERMIT }, |
| 84 | { SYS_close, SYSTR_POLICY_PERMIT }, |
| 85 | |
| 86 | { SYS_open, SYSTR_POLICY_NEVER }, |
| 87 | |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 88 | { -1, -1 } |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 89 | }; |
| 90 | |
| 91 | struct ssh_sandbox { |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 92 | int systrace_fd; |
| 93 | pid_t child_pid; |
Darren Tucker | 3b4b2d3 | 2012-07-02 18:54:31 +1000 | [diff] [blame] | 94 | void (*osigchld)(int); |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 95 | }; |
| 96 | |
| 97 | struct ssh_sandbox * |
Damien Miller | 0dc7451 | 2015-10-05 18:33:05 -0700 | [diff] [blame^] | 98 | ssh_sandbox_init(struct monitor *monitor) |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 99 | { |
| 100 | struct ssh_sandbox *box; |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 101 | |
| 102 | debug3("%s: preparing systrace sandbox", __func__); |
| 103 | box = xcalloc(1, sizeof(*box)); |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 104 | box->systrace_fd = -1; |
| 105 | box->child_pid = 0; |
Darren Tucker | 3b4b2d3 | 2012-07-02 18:54:31 +1000 | [diff] [blame] | 106 | box->osigchld = signal(SIGCHLD, SIG_IGN); |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 107 | |
| 108 | return box; |
| 109 | } |
| 110 | |
| 111 | void |
| 112 | ssh_sandbox_child(struct ssh_sandbox *box) |
| 113 | { |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 114 | debug3("%s: ready", __func__); |
Darren Tucker | 3b4b2d3 | 2012-07-02 18:54:31 +1000 | [diff] [blame] | 115 | signal(SIGCHLD, box->osigchld); |
| 116 | if (kill(getpid(), SIGSTOP) != 0) |
| 117 | fatal("%s: kill(%d, SIGSTOP)", __func__, getpid()); |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 118 | debug3("%s: started", __func__); |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 119 | } |
| 120 | |
| 121 | static void |
| 122 | ssh_sandbox_parent(struct ssh_sandbox *box, pid_t child_pid, |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 123 | const struct sandbox_policy *allowed_syscalls) |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 124 | { |
Darren Tucker | 3b4b2d3 | 2012-07-02 18:54:31 +1000 | [diff] [blame] | 125 | int dev_systrace, i, j, found, status; |
| 126 | pid_t pid; |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 127 | struct systrace_policy policy; |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 128 | |
Darren Tucker | 3b4b2d3 | 2012-07-02 18:54:31 +1000 | [diff] [blame] | 129 | /* Wait for the child to send itself a SIGSTOP */ |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 130 | debug3("%s: wait for child %ld", __func__, (long)child_pid); |
Darren Tucker | 3b4b2d3 | 2012-07-02 18:54:31 +1000 | [diff] [blame] | 131 | do { |
| 132 | pid = waitpid(child_pid, &status, WUNTRACED); |
| 133 | } while (pid == -1 && errno == EINTR); |
| 134 | signal(SIGCHLD, box->osigchld); |
| 135 | if (!WIFSTOPPED(status)) { |
| 136 | if (WIFSIGNALED(status)) |
| 137 | fatal("%s: child terminated with signal %d", |
| 138 | __func__, WTERMSIG(status)); |
| 139 | if (WIFEXITED(status)) |
| 140 | fatal("%s: child exited with status %d", |
| 141 | __func__, WEXITSTATUS(status)); |
| 142 | fatal("%s: child not stopped", __func__); |
| 143 | } |
| 144 | debug3("%s: child %ld stopped", __func__, (long)child_pid); |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 145 | box->child_pid = child_pid; |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 146 | |
| 147 | /* Set up systracing of child */ |
| 148 | if ((dev_systrace = open("/dev/systrace", O_RDONLY)) == -1) |
| 149 | fatal("%s: open(\"/dev/systrace\"): %s", __func__, |
| 150 | strerror(errno)); |
| 151 | if (ioctl(dev_systrace, STRIOCCLONE, &box->systrace_fd) == -1) |
| 152 | fatal("%s: ioctl(STRIOCCLONE, %d): %s", __func__, |
| 153 | dev_systrace, strerror(errno)); |
| 154 | close(dev_systrace); |
| 155 | debug3("%s: systrace attach, fd=%d", __func__, box->systrace_fd); |
| 156 | if (ioctl(box->systrace_fd, STRIOCATTACH, &child_pid) == -1) |
| 157 | fatal("%s: ioctl(%d, STRIOCATTACH, %d): %s", __func__, |
| 158 | box->systrace_fd, child_pid, strerror(errno)); |
| 159 | |
| 160 | /* Allocate and assign policy */ |
Damien Miller | 1d2c456 | 2014-02-04 11:18:20 +1100 | [diff] [blame] | 161 | memset(&policy, 0, sizeof(policy)); |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 162 | policy.strp_op = SYSTR_POLICY_NEW; |
| 163 | policy.strp_maxents = SYS_MAXSYSCALL; |
| 164 | if (ioctl(box->systrace_fd, STRIOCPOLICY, &policy) == -1) |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 165 | fatal("%s: ioctl(%d, STRIOCPOLICY (new)): %s", __func__, |
| 166 | box->systrace_fd, strerror(errno)); |
| 167 | |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 168 | policy.strp_op = SYSTR_POLICY_ASSIGN; |
| 169 | policy.strp_pid = box->child_pid; |
| 170 | if (ioctl(box->systrace_fd, STRIOCPOLICY, &policy) == -1) |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 171 | fatal("%s: ioctl(%d, STRIOCPOLICY (assign)): %s", |
| 172 | __func__, box->systrace_fd, strerror(errno)); |
| 173 | |
| 174 | /* Set per-syscall policy */ |
| 175 | for (i = 0; i < SYS_MAXSYSCALL; i++) { |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 176 | found = 0; |
| 177 | for (j = 0; allowed_syscalls[j].syscall != -1; j++) { |
| 178 | if (allowed_syscalls[j].syscall == i) { |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 179 | found = 1; |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 180 | break; |
| 181 | } |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 182 | } |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 183 | policy.strp_op = SYSTR_POLICY_MODIFY; |
| 184 | policy.strp_code = i; |
| 185 | policy.strp_policy = found ? |
| 186 | allowed_syscalls[j].action : SYSTR_POLICY_KILL; |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 187 | if (found) |
| 188 | debug3("%s: policy: enable syscall %d", __func__, i); |
Damien Miller | 35e4819 | 2011-08-06 06:16:23 +1000 | [diff] [blame] | 189 | if (ioctl(box->systrace_fd, STRIOCPOLICY, &policy) == -1) |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 190 | fatal("%s: ioctl(%d, STRIOCPOLICY (modify)): %s", |
| 191 | __func__, box->systrace_fd, strerror(errno)); |
| 192 | } |
| 193 | |
| 194 | /* Signal the child to start running */ |
| 195 | debug3("%s: start child %ld", __func__, (long)child_pid); |
Darren Tucker | 3b4b2d3 | 2012-07-02 18:54:31 +1000 | [diff] [blame] | 196 | if (kill(box->child_pid, SIGCONT) != 0) |
| 197 | fatal("%s: kill(%d, SIGCONT)", __func__, box->child_pid); |
Damien Miller | 69ff1df | 2011-06-23 08:30:03 +1000 | [diff] [blame] | 198 | } |
| 199 | |
| 200 | void |
| 201 | ssh_sandbox_parent_finish(struct ssh_sandbox *box) |
| 202 | { |
| 203 | /* Closing this before the child exits will terminate it */ |
| 204 | close(box->systrace_fd); |
| 205 | |
| 206 | free(box); |
| 207 | debug3("%s: finished", __func__); |
| 208 | } |
| 209 | |
| 210 | void |
| 211 | ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid) |
| 212 | { |
| 213 | ssh_sandbox_parent(box, child_pid, preauth_policy); |
| 214 | } |
Damien Miller | 0dc7451 | 2015-10-05 18:33:05 -0700 | [diff] [blame^] | 215 | |
| 216 | #endif /* SANDBOX_SYSTRACE */ |