ChrootChecker.cpp revision ec8605f1d7ec846dbf51047bfd5c56d32d1ff91c
1//===- Chrootchecker.cpp -------- Basic security checks ----------*- C++ -*-==// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines chroot checker, which checks improper use of chroot. 11// 12//===----------------------------------------------------------------------===// 13 14#include "ClangSACheckers.h" 15#include "clang/StaticAnalyzer/Core/Checker.h" 16#include "clang/StaticAnalyzer/Core/CheckerManager.h" 17#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 18#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 19#include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h" 20#include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h" 21#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 22#include "llvm/ADT/ImmutableMap.h" 23using namespace clang; 24using namespace ento; 25 26namespace { 27 28// enum value that represent the jail state 29enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED }; 30 31bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; } 32//bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; } 33 34// This checker checks improper use of chroot. 35// The state transition: 36// NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED 37// | | 38// ROOT_CHANGED<--chdir(..)-- JAIL_ENTERED<--chdir(..)-- 39// | | 40// bug<--foo()-- JAIL_ENTERED<--foo()-- 41class ChrootChecker : public Checker<eval::Call, check::PreStmt<CallExpr> > { 42 mutable IdentifierInfo *II_chroot, *II_chdir; 43 // This bug refers to possibly break out of a chroot() jail. 44 mutable llvm::OwningPtr<BuiltinBug> BT_BreakJail; 45 46public: 47 ChrootChecker() : II_chroot(0), II_chdir(0) {} 48 49 static void *getTag() { 50 static int x; 51 return &x; 52 } 53 54 bool evalCall(const CallExpr *CE, CheckerContext &C) const; 55 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const; 56 57private: 58 void Chroot(CheckerContext &C, const CallExpr *CE) const; 59 void Chdir(CheckerContext &C, const CallExpr *CE) const; 60}; 61 62} // end anonymous namespace 63 64bool ChrootChecker::evalCall(const CallExpr *CE, CheckerContext &C) const { 65 const GRState *state = C.getState(); 66 const Expr *Callee = CE->getCallee(); 67 SVal L = state->getSVal(Callee); 68 const FunctionDecl *FD = L.getAsFunctionDecl(); 69 if (!FD) 70 return false; 71 72 ASTContext &Ctx = C.getASTContext(); 73 if (!II_chroot) 74 II_chroot = &Ctx.Idents.get("chroot"); 75 if (!II_chdir) 76 II_chdir = &Ctx.Idents.get("chdir"); 77 78 if (FD->getIdentifier() == II_chroot) { 79 Chroot(C, CE); 80 return true; 81 } 82 if (FD->getIdentifier() == II_chdir) { 83 Chdir(C, CE); 84 return true; 85 } 86 87 return false; 88} 89 90void ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) const { 91 const GRState *state = C.getState(); 92 GRStateManager &Mgr = state->getStateManager(); 93 94 // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in 95 // the GDM. 96 state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED); 97 C.addTransition(state); 98} 99 100void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) const { 101 const GRState *state = C.getState(); 102 GRStateManager &Mgr = state->getStateManager(); 103 104 // If there are no jail state in the GDM, just return. 105 const void* k = state->FindGDM(ChrootChecker::getTag()); 106 if (!k) 107 return; 108 109 // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED. 110 const Expr *ArgExpr = CE->getArg(0); 111 SVal ArgVal = state->getSVal(ArgExpr); 112 113 if (const MemRegion *R = ArgVal.getAsRegion()) { 114 R = R->StripCasts(); 115 if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) { 116 const StringLiteral* Str = StrRegion->getStringLiteral(); 117 if (Str->getString() == "/") 118 state = Mgr.addGDM(state, ChrootChecker::getTag(), 119 (void*) JAIL_ENTERED); 120 } 121 } 122 123 C.addTransition(state); 124} 125 126// Check the jail state before any function call except chroot and chdir(). 127void ChrootChecker::checkPreStmt(const CallExpr *CE, CheckerContext &C) const { 128 const GRState *state = C.getState(); 129 const Expr *Callee = CE->getCallee(); 130 SVal L = state->getSVal(Callee); 131 const FunctionDecl *FD = L.getAsFunctionDecl(); 132 if (!FD) 133 return; 134 135 ASTContext &Ctx = C.getASTContext(); 136 if (!II_chroot) 137 II_chroot = &Ctx.Idents.get("chroot"); 138 if (!II_chdir) 139 II_chdir = &Ctx.Idents.get("chdir"); 140 141 // Ingnore chroot and chdir. 142 if (FD->getIdentifier() == II_chroot || FD->getIdentifier() == II_chdir) 143 return; 144 145 // If jail state is ROOT_CHANGED, generate BugReport. 146 void* const* k = state->FindGDM(ChrootChecker::getTag()); 147 if (k) 148 if (isRootChanged((intptr_t) *k)) 149 if (ExplodedNode *N = C.generateNode()) { 150 if (!BT_BreakJail) 151 BT_BreakJail.reset(new BuiltinBug("Break out of jail", 152 "No call of chdir(\"/\") immediately " 153 "after chroot")); 154 BugReport *R = new BugReport(*BT_BreakJail, 155 BT_BreakJail->getDescription(), N); 156 C.EmitReport(R); 157 } 158 159 return; 160} 161 162void ento::registerChrootChecker(CheckerManager &mgr) { 163 mgr.registerChecker<ChrootChecker>(); 164} 165