1// Copyright 2014 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
6
7#include <errno.h>
8#include <sched.h>
9#include <sys/resource.h>
10#include <sys/syscall.h>
11#include <sys/types.h>
12#include <time.h>
13#include <unistd.h>
14
15#include "base/bind.h"
16#include "base/synchronization/waitable_event.h"
17#include "base/sys_info.h"
18#include "base/threading/thread.h"
19#include "base/time/time.h"
20#include "build/build_config.h"
21#include "sandbox/linux/bpf_dsl/bpf_dsl.h"
22#include "sandbox/linux/bpf_dsl/policy.h"
23#include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
24#include "sandbox/linux/seccomp-bpf/bpf_tests.h"
25#include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
26#include "sandbox/linux/seccomp-bpf/syscall.h"
27#include "sandbox/linux/services/syscall_wrappers.h"
28#include "sandbox/linux/system_headers/linux_syscalls.h"
29#include "sandbox/linux/system_headers/linux_time.h"
30#include "sandbox/linux/tests/unit_tests.h"
31
32#if !defined(OS_ANDROID)
33#include "third_party/lss/linux_syscall_support.h"  // for MAKE_PROCESS_CPUCLOCK
34#endif
35
36namespace sandbox {
37
38namespace {
39
40// NOTE: most of the parameter restrictions are tested in
41// baseline_policy_unittest.cc as a more end-to-end test.
42
43using sandbox::bpf_dsl::Allow;
44using sandbox::bpf_dsl::ResultExpr;
45
46class RestrictClockIdPolicy : public bpf_dsl::Policy {
47 public:
48  RestrictClockIdPolicy() {}
49  ~RestrictClockIdPolicy() override {}
50
51  ResultExpr EvaluateSyscall(int sysno) const override {
52    switch (sysno) {
53      case __NR_clock_gettime:
54      case __NR_clock_getres:
55        return RestrictClockID();
56      default:
57        return Allow();
58    }
59  }
60};
61
62void CheckClock(clockid_t clockid) {
63  struct timespec ts;
64  ts.tv_sec = -1;
65  ts.tv_nsec = -1;
66  BPF_ASSERT_EQ(0, clock_getres(clockid, &ts));
67  BPF_ASSERT_EQ(0, ts.tv_sec);
68  BPF_ASSERT_LE(0, ts.tv_nsec);
69  ts.tv_sec = -1;
70  ts.tv_nsec = -1;
71  BPF_ASSERT_EQ(0, clock_gettime(clockid, &ts));
72  BPF_ASSERT_LE(0, ts.tv_sec);
73  BPF_ASSERT_LE(0, ts.tv_nsec);
74}
75
76BPF_TEST_C(ParameterRestrictions,
77           clock_gettime_allowed,
78           RestrictClockIdPolicy) {
79  CheckClock(CLOCK_MONOTONIC);
80  CheckClock(CLOCK_MONOTONIC_COARSE);
81  CheckClock(CLOCK_PROCESS_CPUTIME_ID);
82  CheckClock(CLOCK_REALTIME);
83  CheckClock(CLOCK_REALTIME_COARSE);
84  CheckClock(CLOCK_THREAD_CPUTIME_ID);
85}
86
87BPF_DEATH_TEST_C(ParameterRestrictions,
88                 clock_gettime_crash_monotonic_raw,
89                 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
90                 RestrictClockIdPolicy) {
91  struct timespec ts;
92  clock_gettime(CLOCK_MONOTONIC_RAW, &ts);
93}
94
95#if !defined(OS_ANDROID)
96BPF_DEATH_TEST_C(ParameterRestrictions,
97                 clock_gettime_crash_cpu_clock,
98                 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
99                 RestrictClockIdPolicy) {
100  // We can't use clock_getcpuclockid() because it's not implemented in newlib,
101  // and it might not work inside the sandbox anyway.
102  const pid_t kInitPID = 1;
103  const clockid_t kInitCPUClockID =
104      MAKE_PROCESS_CPUCLOCK(kInitPID, CPUCLOCK_SCHED);
105
106  struct timespec ts;
107  clock_gettime(kInitCPUClockID, &ts);
108}
109#endif  // !defined(OS_ANDROID)
110
111class RestrictSchedPolicy : public bpf_dsl::Policy {
112 public:
113  RestrictSchedPolicy() {}
114  ~RestrictSchedPolicy() override {}
115
116  ResultExpr EvaluateSyscall(int sysno) const override {
117    switch (sysno) {
118      case __NR_sched_getparam:
119        return RestrictSchedTarget(getpid(), sysno);
120      default:
121        return Allow();
122    }
123  }
124};
125
126void CheckSchedGetParam(pid_t pid, struct sched_param* param) {
127  BPF_ASSERT_EQ(0, sched_getparam(pid, param));
128}
129
130void SchedGetParamThread(base::WaitableEvent* thread_run) {
131  const pid_t pid = getpid();
132  const pid_t tid = sys_gettid();
133  BPF_ASSERT_NE(pid, tid);
134
135  struct sched_param current_pid_param;
136  CheckSchedGetParam(pid, &current_pid_param);
137
138  struct sched_param zero_param;
139  CheckSchedGetParam(0, &zero_param);
140
141  struct sched_param tid_param;
142  CheckSchedGetParam(tid, &tid_param);
143
144  BPF_ASSERT_EQ(zero_param.sched_priority, tid_param.sched_priority);
145
146  // Verify that the SIGSYS handler sets errno properly.
147  errno = 0;
148  BPF_ASSERT_EQ(-1, sched_getparam(tid, NULL));
149  BPF_ASSERT_EQ(EINVAL, errno);
150
151  thread_run->Signal();
152}
153
154BPF_TEST_C(ParameterRestrictions,
155           sched_getparam_allowed,
156           RestrictSchedPolicy) {
157  base::WaitableEvent thread_run(true, false);
158  // Run the actual test in a new thread so that the current pid and tid are
159  // different.
160  base::Thread getparam_thread("sched_getparam_thread");
161  BPF_ASSERT(getparam_thread.Start());
162  getparam_thread.message_loop()->PostTask(
163      FROM_HERE, base::Bind(&SchedGetParamThread, &thread_run));
164  BPF_ASSERT(thread_run.TimedWait(base::TimeDelta::FromMilliseconds(5000)));
165  getparam_thread.Stop();
166}
167
168BPF_DEATH_TEST_C(ParameterRestrictions,
169                 sched_getparam_crash_non_zero,
170                 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
171                 RestrictSchedPolicy) {
172  const pid_t kInitPID = 1;
173  struct sched_param param;
174  sched_getparam(kInitPID, &param);
175}
176
177class RestrictPrlimit64Policy : public bpf_dsl::Policy {
178 public:
179  RestrictPrlimit64Policy() {}
180  ~RestrictPrlimit64Policy() override {}
181
182  ResultExpr EvaluateSyscall(int sysno) const override {
183    switch (sysno) {
184      case __NR_prlimit64:
185        return RestrictPrlimit64(getpid());
186      default:
187        return Allow();
188    }
189  }
190};
191
192BPF_TEST_C(ParameterRestrictions, prlimit64_allowed, RestrictPrlimit64Policy) {
193  BPF_ASSERT_EQ(0, sys_prlimit64(0, RLIMIT_AS, NULL, NULL));
194  BPF_ASSERT_EQ(0, sys_prlimit64(getpid(), RLIMIT_AS, NULL, NULL));
195}
196
197BPF_DEATH_TEST_C(ParameterRestrictions,
198                 prlimit64_crash_not_self,
199                 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
200                 RestrictPrlimit64Policy) {
201  const pid_t kInitPID = 1;
202  BPF_ASSERT_NE(kInitPID, getpid());
203  sys_prlimit64(kInitPID, RLIMIT_AS, NULL, NULL);
204}
205
206class RestrictGetrusagePolicy : public bpf_dsl::Policy {
207 public:
208  RestrictGetrusagePolicy() {}
209  ~RestrictGetrusagePolicy() override {}
210
211  ResultExpr EvaluateSyscall(int sysno) const override {
212    switch (sysno) {
213      case __NR_getrusage:
214        return RestrictGetrusage();
215      default:
216        return Allow();
217    }
218  }
219};
220
221BPF_TEST_C(ParameterRestrictions, getrusage_allowed, RestrictGetrusagePolicy) {
222  struct rusage usage;
223  BPF_ASSERT_EQ(0, getrusage(RUSAGE_SELF, &usage));
224}
225
226BPF_DEATH_TEST_C(ParameterRestrictions,
227                 getrusage_crash_not_self,
228                 DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
229                 RestrictGetrusagePolicy) {
230  struct rusage usage;
231  getrusage(RUSAGE_CHILDREN, &usage);
232}
233
234}  // namespace
235
236}  // namespace sandbox
237