ChrootChecker.cpp revision 695fb502825a53ccd178ec1c85c77929d88acb71
17dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch//===- Chrootchecker.cpp -------- Basic security checks ----------*- C++ -*-==// 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// The LLVM Compiler Infrastructure 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 5d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// This file is distributed under the University of Illinois Open Source 6d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles)// License. See LICENSE.TXT for details. 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 8eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch//===----------------------------------------------------------------------===// 95821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// This file defines chroot checker, which checks improper use of chroot. 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 12eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch//===----------------------------------------------------------------------===// 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 14cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)#include "ClangSACheckers.h" 1558537e28ecd584eab876aee8be7156509866d23aTorne (Richard Coles)#include "clang/StaticAnalyzer/Core/CheckerManager.h" 16cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 17b2df76ea8fec9e32f6f3718986dba0d95315b29cTorne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerVisitor.h" 18c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h" 195f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/GRStateTrait.h" 20c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 217dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch#include "llvm/ADT/ImmutableMap.h" 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)using namespace clang; 237d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)using namespace ento; 2458537e28ecd584eab876aee8be7156509866d23aTorne (Richard Coles) 257d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)namespace { 267d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles) 27f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles)// enum value that represent the jail state 28f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles)enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED }; 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 304e180b6a0b4720a9b8e9e959a882386f690f08ffTorne (Richard Coles)bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; } 315d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)//bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; } 32a02191e04bc25c4935f804f2c080ae28663d096dBen Murdoch 33cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// This checker checks improper use of chroot. 342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// The state transition: 352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED 36f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles)// | | 37cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// ROOT_CHANGED<--chdir(..)-- JAIL_ENTERED<--chdir(..)-- 38f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles)// | | 39f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles)// bug<--foo()-- JAIL_ENTERED<--foo()-- 40f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles)class ChrootChecker : public CheckerVisitor<ChrootChecker> { 417dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch IdentifierInfo *II_chroot, *II_chdir; 42cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) // This bug refers to possibly break out of a chroot() jail. 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) BuiltinBug *BT_BreakJail; 44424c4d7b64af9d0d8fd9624f381f469654d5e3d2Torne (Richard Coles) 45cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)public: 46424c4d7b64af9d0d8fd9624f381f469654d5e3d2Torne (Richard Coles) ChrootChecker() : II_chroot(0), II_chdir(0), BT_BreakJail(0) {} 47424c4d7b64af9d0d8fd9624f381f469654d5e3d2Torne (Richard Coles) 485f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) static void *getTag() { 495f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) static int x; 505f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return &x; 515f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) } 52424c4d7b64af9d0d8fd9624f381f469654d5e3d2Torne (Richard Coles) 53cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) virtual bool evalCallExpr(CheckerContext &C, const CallExpr *CE); 54424c4d7b64af9d0d8fd9624f381f469654d5e3d2Torne (Richard Coles) virtual void PreVisitCallExpr(CheckerContext &C, const CallExpr *CE); 555d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 565d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)private: 577dbb3d5cf0c15f500944d211057644d6a2f37371Ben Murdoch void Chroot(CheckerContext &C, const CallExpr *CE); 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) void Chdir(CheckerContext &C, const CallExpr *CE); 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 60868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 61868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)} // end anonymous namespace 62868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 63868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)static void RegisterChrootChecker(ExprEngine &Eng) { 64868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) Eng.registerCheck(new ChrootChecker()); 655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 6668043e1e95eeb07d5cae7aca370b26518b0867d6Torne (Richard Coles) 6768043e1e95eeb07d5cae7aca370b26518b0867d6Torne (Richard Coles)void ento::registerChrootChecker(CheckerManager &mgr) { 6868043e1e95eeb07d5cae7aca370b26518b0867d6Torne (Richard Coles) mgr.addCheckerRegisterFunction(RegisterChrootChecker); 6968043e1e95eeb07d5cae7aca370b26518b0867d6Torne (Richard Coles)} 701320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci 711320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tuccibool ChrootChecker::evalCallExpr(CheckerContext &C, const CallExpr *CE) { 72cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) const GRState *state = C.getState(); 73b2df76ea8fec9e32f6f3718986dba0d95315b29cTorne (Richard Coles) const Expr *Callee = CE->getCallee(); 7490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) SVal L = state->getSVal(Callee); 751320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci const FunctionDecl *FD = L.getAsFunctionDecl(); 761320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci if (!FD) 771320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci return false; 7890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 7990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) ASTContext &Ctx = C.getASTContext(); 8090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) if (!II_chroot) 8190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) II_chroot = &Ctx.Idents.get("chroot"); 8290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) if (!II_chdir) 8390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) II_chdir = &Ctx.Idents.get("chdir"); 8490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 8590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) if (FD->getIdentifier() == II_chroot) { 8690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) Chroot(C, CE); 8790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) return true; 8868043e1e95eeb07d5cae7aca370b26518b0867d6Torne (Richard Coles) } 8968043e1e95eeb07d5cae7aca370b26518b0867d6Torne (Richard Coles) if (FD->getIdentifier() == II_chdir) { 9090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) Chdir(C, CE); 9190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) return true; 9290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) } 93c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 945f1c94371a64b3196d4be9466099bb892df9b88eTorne (Richard Coles) return false; 9590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)} 9690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 970529e5d033099cbfc42635f6f6183833b09dff6eBen Murdochvoid ChrootChecker::Chroot(CheckerContext &C, const CallExpr *CE) { 985d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const GRState *state = C.getState(); 99116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch GRStateManager &Mgr = state->getStateManager(); 100116680a4aac90f2aa7413d9095a592090648e557Ben Murdoch 1012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in 1022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // the GDM. 103a02191e04bc25c4935f804f2c080ae28663d096dBen Murdoch state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED); 1045d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) C.addTransition(state); 1052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1065821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 107868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)void ChrootChecker::Chdir(CheckerContext &C, const CallExpr *CE) { 108868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) const GRState *state = C.getState(); 109868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) GRStateManager &Mgr = state->getStateManager(); 110f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles) 111868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) // If there are no jail state in the GDM, just return. 11268043e1e95eeb07d5cae7aca370b26518b0867d6Torne (Richard Coles) const void* k = state->FindGDM(ChrootChecker::getTag()); 113d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) if (!k) 114a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles) return; 1155d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 116868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED. 117868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) const Expr *ArgExpr = CE->getArg(0); 1181320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci SVal ArgVal = state->getSVal(ArgExpr); 1191320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci 1205d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (const MemRegion *R = ArgVal.getAsRegion()) { 121cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) R = R->StripCasts(); 122cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) { 123cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) const StringLiteral* Str = StrRegion->getStringLiteral(); 124cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) if (Str->getString() == "/") 125cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) state = Mgr.addGDM(state, ChrootChecker::getTag(), 126cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) (void*) JAIL_ENTERED); 127cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) } 128cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) } 129cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) 130cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) C.addTransition(state); 13190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)} 132868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) 133868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)// Check the jail state before any function call except chroot and chdir(). 134868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles)void ChrootChecker::PreVisitCallExpr(CheckerContext &C, const CallExpr *CE) { 135868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) const GRState *state = C.getState(); 136868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) const Expr *Callee = CE->getCallee(); 137868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) SVal L = state->getSVal(Callee); 138d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) const FunctionDecl *FD = L.getAsFunctionDecl(); 139d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) if (!FD) 140d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) return; 141d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) 142d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) ASTContext &Ctx = C.getASTContext(); 143d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) if (!II_chroot) 144d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) II_chroot = &Ctx.Idents.get("chroot"); 145cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) if (!II_chdir) 146eb525c5499e34cc9c4b825d6d9e75bb07cc06aceBen Murdoch II_chdir = &Ctx.Idents.get("chdir"); 147cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) 148cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) // Ingnore chroot and chdir. 1497d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles) if (FD->getIdentifier() == II_chroot || FD->getIdentifier() == II_chdir) 150868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) return; 151a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 152a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) // If jail state is ROOT_CHANGED, generate BugReport. 153f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles) void* const* k = state->FindGDM(ChrootChecker::getTag()); 15458537e28ecd584eab876aee8be7156509866d23aTorne (Richard Coles) if (k) 15558537e28ecd584eab876aee8be7156509866d23aTorne (Richard Coles) if (isRootChanged((intptr_t) *k)) 1564e180b6a0b4720a9b8e9e959a882386f690f08ffTorne (Richard Coles) if (ExplodedNode *N = C.generateNode()) { 15758537e28ecd584eab876aee8be7156509866d23aTorne (Richard Coles) if (!BT_BreakJail) 158a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) BT_BreakJail = new BuiltinBug("Break out of jail", 159a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) "No call of chdir(\"/\") immediately " 160a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) "after chroot"); 161a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) BugReport *R = new BugReport(*BT_BreakJail, 162a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) BT_BreakJail->getDescription(), N); 163a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) C.EmitReport(R); 164a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 1651320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci 1661320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci return; 1671320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci} 1681320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci