sandbox-seccomp-filter.c revision d059297112922cabb0c674840589be8db821fd9a 
1/*
2 * Copyright (c) 2012 Will Drewry <wad@dataspill.org>
3 *
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 */
16
17/*
18 * Uncomment the SANDBOX_SECCOMP_FILTER_DEBUG macro below to help diagnose
19 * filter breakage during development. *Do not* use this in production,
20 * as it relies on making library calls that are unsafe in signal context.
21 *
22 * Instead, live systems the auditctl(8) may be used to monitor failures.
23 * E.g.
24 *   auditctl -a task,always -F uid=<privsep uid>
25 */
26/* #define SANDBOX_SECCOMP_FILTER_DEBUG 1 */
27
28/* XXX it should be possible to do logging via the log socket safely */
29
30#ifdef SANDBOX_SECCOMP_FILTER_DEBUG
31/* Use the kernel headers in case of an older toolchain. */
32# include <asm/siginfo.h>
33# define __have_siginfo_t 1
34# define __have_sigval_t 1
35# define __have_sigevent_t 1
36#endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
37
38#include "includes.h"
39
40#ifdef SANDBOX_SECCOMP_FILTER
41
42#include <sys/types.h>
43#include <sys/resource.h>
44#include <sys/prctl.h>
45
46#include <linux/audit.h>
47#include <linux/filter.h>
48#include <linux/seccomp.h>
49#include <elf.h>
50
51#include <asm/unistd.h>
52
53#include <errno.h>
54#include <signal.h>
55#include <stdarg.h>
56#include <stddef.h>  /* for offsetof */
57#include <stdio.h>
58#include <stdlib.h>
59#include <string.h>
60#include <unistd.h>
61
62#include "log.h"
63#include "ssh-sandbox.h"
64#include "xmalloc.h"
65
66/* Linux seccomp_filter sandbox */
67#define SECCOMP_FILTER_FAIL SECCOMP_RET_KILL
68
69/* Use a signal handler to emit violations when debugging */
70#ifdef SANDBOX_SECCOMP_FILTER_DEBUG
71# undef SECCOMP_FILTER_FAIL
72# define SECCOMP_FILTER_FAIL SECCOMP_RET_TRAP
73#endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
74
75/* Simple helpers to avoid manual errors (but larger BPF programs). */
76#define SC_DENY(_nr, _errno) \
77	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 1), \
78	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno))
79#define SC_ALLOW(_nr) \
80	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 1), \
81	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
82
83/* Syscall filtering set for preauth. */
84static const struct sock_filter preauth_insns[] = {
85	/* Ensure the syscall arch convention is as expected. */
86	BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
87		offsetof(struct seccomp_data, arch)),
88	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
89	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
90	/* Load the syscall number for checking. */
91	BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
92		offsetof(struct seccomp_data, nr)),
93	SC_DENY(open, EACCES),
94	SC_DENY(stat, EACCES),
95	SC_ALLOW(getpid),
96	SC_ALLOW(gettimeofday),
97	SC_ALLOW(clock_gettime),
98#ifdef __NR_time /* not defined on EABI ARM */
99	SC_ALLOW(time),
100#endif
101	SC_ALLOW(read),
102	SC_ALLOW(write),
103	SC_ALLOW(close),
104#ifdef __NR_shutdown /* not defined on archs that go via socketcall(2) */
105	SC_ALLOW(shutdown),
106#endif
107	SC_ALLOW(brk),
108	SC_ALLOW(poll),
109#ifdef __NR__newselect
110	SC_ALLOW(_newselect),
111#else
112	SC_ALLOW(select),
113#endif
114	SC_ALLOW(madvise),
115#ifdef __NR_mmap2 /* EABI ARM only has mmap2() */
116	SC_ALLOW(mmap2),
117#endif
118#ifdef __NR_mmap
119	SC_ALLOW(mmap),
120#endif
121#ifdef __dietlibc__
122	SC_ALLOW(mremap),
123	SC_ALLOW(exit),
124#endif
125	SC_ALLOW(munmap),
126	SC_ALLOW(exit_group),
127#ifdef __NR_rt_sigprocmask
128	SC_ALLOW(rt_sigprocmask),
129#else
130	SC_ALLOW(sigprocmask),
131#endif
132	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
133};
134
135static const struct sock_fprog preauth_program = {
136	.len = (unsigned short)(sizeof(preauth_insns)/sizeof(preauth_insns[0])),
137	.filter = (struct sock_filter *)preauth_insns,
138};
139
140struct ssh_sandbox {
141	pid_t child_pid;
142};
143
144struct ssh_sandbox *
145ssh_sandbox_init(struct monitor *monitor)
146{
147	struct ssh_sandbox *box;
148
149	/*
150	 * Strictly, we don't need to maintain any state here but we need
151	 * to return non-NULL to satisfy the API.
152	 */
153	debug3("%s: preparing seccomp filter sandbox", __func__);
154	box = xcalloc(1, sizeof(*box));
155	box->child_pid = 0;
156
157	return box;
158}
159
160#ifdef SANDBOX_SECCOMP_FILTER_DEBUG
161extern struct monitor *pmonitor;
162void mm_log_handler(LogLevel level, const char *msg, void *ctx);
163
164static void
165ssh_sandbox_violation(int signum, siginfo_t *info, void *void_context)
166{
167	char msg[256];
168
169	snprintf(msg, sizeof(msg),
170	    "%s: unexpected system call (arch:0x%x,syscall:%d @ %p)",
171	    __func__, info->si_arch, info->si_syscall, info->si_call_addr);
172	mm_log_handler(SYSLOG_LEVEL_FATAL, msg, pmonitor);
173	_exit(1);
174}
175
176static void
177ssh_sandbox_child_debugging(void)
178{
179	struct sigaction act;
180	sigset_t mask;
181
182	debug3("%s: installing SIGSYS handler", __func__);
183	memset(&act, 0, sizeof(act));
184	sigemptyset(&mask);
185	sigaddset(&mask, SIGSYS);
186
187	act.sa_sigaction = &ssh_sandbox_violation;
188	act.sa_flags = SA_SIGINFO;
189	if (sigaction(SIGSYS, &act, NULL) == -1)
190		fatal("%s: sigaction(SIGSYS): %s", __func__, strerror(errno));
191	if (sigprocmask(SIG_UNBLOCK, &mask, NULL) == -1)
192		fatal("%s: sigprocmask(SIGSYS): %s",
193		      __func__, strerror(errno));
194}
195#endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
196
197void
198ssh_sandbox_child(struct ssh_sandbox *box)
199{
200	struct rlimit rl_zero;
201	int nnp_failed = 0;
202
203	/* Set rlimits for completeness if possible. */
204	rl_zero.rlim_cur = rl_zero.rlim_max = 0;
205	if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
206		fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
207			__func__, strerror(errno));
208	if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
209		fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
210			__func__, strerror(errno));
211	if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
212		fatal("%s: setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",
213			__func__, strerror(errno));
214
215#ifdef SANDBOX_SECCOMP_FILTER_DEBUG
216	ssh_sandbox_child_debugging();
217#endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
218
219	debug3("%s: setting PR_SET_NO_NEW_PRIVS", __func__);
220	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
221		debug("%s: prctl(PR_SET_NO_NEW_PRIVS): %s",
222		      __func__, strerror(errno));
223		nnp_failed = 1;
224	}
225	debug3("%s: attaching seccomp filter program", __func__);
226	if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &preauth_program) == -1)
227		debug("%s: prctl(PR_SET_SECCOMP): %s",
228		      __func__, strerror(errno));
229	else if (nnp_failed)
230		fatal("%s: SECCOMP_MODE_FILTER activated but "
231		    "PR_SET_NO_NEW_PRIVS failed", __func__);
232}
233
234void
235ssh_sandbox_parent_finish(struct ssh_sandbox *box)
236{
237	free(box);
238	debug3("%s: finished", __func__);
239}
240
241void
242ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid)
243{
244	box->child_pid = child_pid;
245}
246
247#endif /* SANDBOX_SECCOMP_FILTER */
248