1// Copyright 2014 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "sandbox/linux/bpf_dsl/bpf_dsl.h"
6
7#include <errno.h>
8#include <fcntl.h>
9#include <netinet/in.h>
10#include <stdint.h>
11#include <sys/socket.h>
12#include <sys/syscall.h>
13#include <sys/utsname.h>
14#include <unistd.h>
15
16#include <map>
17#include <utility>
18
19#include "base/files/scoped_file.h"
20#include "base/macros.h"
21#include "build/build_config.h"
22#include "sandbox/linux/bpf_dsl/bpf_dsl_impl.h"
23#include "sandbox/linux/bpf_dsl/codegen.h"
24#include "sandbox/linux/bpf_dsl/dump_bpf.h"
25#include "sandbox/linux/bpf_dsl/golden/golden_files.h"
26#include "sandbox/linux/bpf_dsl/policy.h"
27#include "sandbox/linux/bpf_dsl/policy_compiler.h"
28#include "sandbox/linux/bpf_dsl/seccomp_macros.h"
29#include "sandbox/linux/bpf_dsl/test_trap_registry.h"
30#include "sandbox/linux/bpf_dsl/verifier.h"
31#include "sandbox/linux/system_headers/linux_filter.h"
32#include "testing/gtest/include/gtest/gtest.h"
33
34#define CASES SANDBOX_BPF_DSL_CASES
35
36namespace sandbox {
37namespace bpf_dsl {
38namespace {
39
40// Helper function to construct fake arch_seccomp_data objects.
41struct arch_seccomp_data FakeSyscall(int nr,
42                                     uintptr_t p0 = 0,
43                                     uintptr_t p1 = 0,
44                                     uintptr_t p2 = 0,
45                                     uintptr_t p3 = 0,
46                                     uintptr_t p4 = 0,
47                                     uintptr_t p5 = 0) {
48  // Made up program counter for syscall address.
49  const uint64_t kFakePC = 0x543210;
50
51  struct arch_seccomp_data data = {
52      nr,
53      SECCOMP_ARCH,
54      kFakePC,
55      {
56       p0, p1, p2, p3, p4, p5,
57      },
58  };
59
60  return data;
61}
62
63class PolicyEmulator {
64 public:
65  PolicyEmulator(const golden::Golden& golden, const Policy& policy)
66      : program_() {
67    TestTrapRegistry traps;
68    program_ = PolicyCompiler(&policy, &traps).Compile();
69
70    // TODO(mdempsky): Generalize to more arches.
71    const char* expected = nullptr;
72#if defined(ARCH_CPU_X86)
73    expected = golden.i386_dump;
74#elif defined(ARCH_CPU_X86_64)
75    expected = golden.x86_64_dump;
76#endif
77
78    if (expected != nullptr) {
79      const std::string actual = DumpBPF::StringPrintProgram(program_);
80      EXPECT_EQ(expected, actual);
81    } else {
82      LOG(WARNING) << "Missing golden file data entry";
83    }
84  }
85
86  ~PolicyEmulator() {}
87
88  void ExpectAllow(const struct arch_seccomp_data& data) const {
89    EXPECT_EQ(SECCOMP_RET_ALLOW, Emulate(data));
90  }
91
92  void ExpectErrno(uint16_t err, const struct arch_seccomp_data& data) const {
93    EXPECT_EQ(SECCOMP_RET_ERRNO | err, Emulate(data));
94  }
95
96  void ExpectKill(const struct arch_seccomp_data& data) const {
97    EXPECT_EQ(SECCOMP_RET_KILL, Emulate(data));
98  }
99
100 private:
101  uint32_t Emulate(const struct arch_seccomp_data& data) const {
102    const char* err = nullptr;
103    uint32_t res = Verifier::EvaluateBPF(program_, data, &err);
104    if (err) {
105      ADD_FAILURE() << err;
106      return 0;
107    }
108    return res;
109  }
110
111  CodeGen::Program program_;
112
113  DISALLOW_COPY_AND_ASSIGN(PolicyEmulator);
114};
115
116class BasicPolicy : public Policy {
117 public:
118  BasicPolicy() {}
119  ~BasicPolicy() override {}
120  ResultExpr EvaluateSyscall(int sysno) const override {
121    if (sysno == __NR_getpgid) {
122      const Arg<pid_t> pid(0);
123      return If(pid == 0, Error(EPERM)).Else(Error(EINVAL));
124    }
125    if (sysno == __NR_setuid) {
126      const Arg<uid_t> uid(0);
127      return If(uid != 42, Kill()).Else(Allow());
128    }
129    return Allow();
130  }
131
132 private:
133  DISALLOW_COPY_AND_ASSIGN(BasicPolicy);
134};
135
136TEST(BPFDSL, Basic) {
137  PolicyEmulator emulator(golden::kBasicPolicy, BasicPolicy());
138
139  emulator.ExpectErrno(EPERM, FakeSyscall(__NR_getpgid, 0));
140  emulator.ExpectErrno(EINVAL, FakeSyscall(__NR_getpgid, 1));
141
142  emulator.ExpectAllow(FakeSyscall(__NR_setuid, 42));
143  emulator.ExpectKill(FakeSyscall(__NR_setuid, 43));
144}
145
146/* On IA-32, socketpair() is implemented via socketcall(). :-( */
147#if !defined(ARCH_CPU_X86)
148class BooleanLogicPolicy : public Policy {
149 public:
150  BooleanLogicPolicy() {}
151  ~BooleanLogicPolicy() override {}
152  ResultExpr EvaluateSyscall(int sysno) const override {
153    if (sysno == __NR_socketpair) {
154      const Arg<int> domain(0), type(1), protocol(2);
155      return If(AllOf(domain == AF_UNIX,
156                      AnyOf(type == SOCK_STREAM, type == SOCK_DGRAM),
157                      protocol == 0),
158                Error(EPERM))
159          .Else(Error(EINVAL));
160    }
161    return Allow();
162  }
163
164 private:
165  DISALLOW_COPY_AND_ASSIGN(BooleanLogicPolicy);
166};
167
168TEST(BPFDSL, BooleanLogic) {
169  PolicyEmulator emulator(golden::kBooleanLogicPolicy, BooleanLogicPolicy());
170
171  const intptr_t kFakeSV = 0x12345;
172
173  // Acceptable combinations that should return EPERM.
174  emulator.ExpectErrno(
175      EPERM, FakeSyscall(__NR_socketpair, AF_UNIX, SOCK_STREAM, 0, kFakeSV));
176  emulator.ExpectErrno(
177      EPERM, FakeSyscall(__NR_socketpair, AF_UNIX, SOCK_DGRAM, 0, kFakeSV));
178
179  // Combinations that are invalid for only one reason; should return EINVAL.
180  emulator.ExpectErrno(
181      EINVAL, FakeSyscall(__NR_socketpair, AF_INET, SOCK_STREAM, 0, kFakeSV));
182  emulator.ExpectErrno(EINVAL, FakeSyscall(__NR_socketpair, AF_UNIX,
183                                           SOCK_SEQPACKET, 0, kFakeSV));
184  emulator.ExpectErrno(EINVAL, FakeSyscall(__NR_socketpair, AF_UNIX,
185                                           SOCK_STREAM, IPPROTO_TCP, kFakeSV));
186
187  // Completely unacceptable combination; should also return EINVAL.
188  emulator.ExpectErrno(
189      EINVAL, FakeSyscall(__NR_socketpair, AF_INET, SOCK_SEQPACKET, IPPROTO_UDP,
190                          kFakeSV));
191}
192#endif  // !ARCH_CPU_X86
193
194class MoreBooleanLogicPolicy : public Policy {
195 public:
196  MoreBooleanLogicPolicy() {}
197  ~MoreBooleanLogicPolicy() override {}
198  ResultExpr EvaluateSyscall(int sysno) const override {
199    if (sysno == __NR_setresuid) {
200      const Arg<uid_t> ruid(0), euid(1), suid(2);
201      return If(AnyOf(ruid == 0, euid == 0, suid == 0), Error(EPERM))
202          .ElseIf(AllOf(ruid == 1, euid == 1, suid == 1), Error(EAGAIN))
203          .Else(Error(EINVAL));
204    }
205    return Allow();
206  }
207
208 private:
209  DISALLOW_COPY_AND_ASSIGN(MoreBooleanLogicPolicy);
210};
211
212TEST(BPFDSL, MoreBooleanLogic) {
213  PolicyEmulator emulator(golden::kMoreBooleanLogicPolicy,
214                          MoreBooleanLogicPolicy());
215
216  // Expect EPERM if any set to 0.
217  emulator.ExpectErrno(EPERM, FakeSyscall(__NR_setresuid, 0, 5, 5));
218  emulator.ExpectErrno(EPERM, FakeSyscall(__NR_setresuid, 5, 0, 5));
219  emulator.ExpectErrno(EPERM, FakeSyscall(__NR_setresuid, 5, 5, 0));
220
221  // Expect EAGAIN if all set to 1.
222  emulator.ExpectErrno(EAGAIN, FakeSyscall(__NR_setresuid, 1, 1, 1));
223
224  // Expect EINVAL for anything else.
225  emulator.ExpectErrno(EINVAL, FakeSyscall(__NR_setresuid, 5, 1, 1));
226  emulator.ExpectErrno(EINVAL, FakeSyscall(__NR_setresuid, 1, 5, 1));
227  emulator.ExpectErrno(EINVAL, FakeSyscall(__NR_setresuid, 1, 1, 5));
228  emulator.ExpectErrno(EINVAL, FakeSyscall(__NR_setresuid, 3, 4, 5));
229}
230
231static const uintptr_t kDeadBeefAddr =
232    static_cast<uintptr_t>(0xdeadbeefdeadbeefULL);
233
234class ArgSizePolicy : public Policy {
235 public:
236  ArgSizePolicy() {}
237  ~ArgSizePolicy() override {}
238  ResultExpr EvaluateSyscall(int sysno) const override {
239    if (sysno == __NR_uname) {
240      const Arg<uintptr_t> addr(0);
241      return If(addr == kDeadBeefAddr, Error(EPERM)).Else(Allow());
242    }
243    return Allow();
244  }
245
246 private:
247  DISALLOW_COPY_AND_ASSIGN(ArgSizePolicy);
248};
249
250TEST(BPFDSL, ArgSizeTest) {
251  PolicyEmulator emulator(golden::kArgSizePolicy, ArgSizePolicy());
252
253  emulator.ExpectAllow(FakeSyscall(__NR_uname, 0));
254  emulator.ExpectErrno(EPERM, FakeSyscall(__NR_uname, kDeadBeefAddr));
255}
256
257class NegativeConstantsPolicy : public Policy {
258 public:
259  NegativeConstantsPolicy() {}
260  ~NegativeConstantsPolicy() override {}
261  ResultExpr EvaluateSyscall(int sysno) const override {
262    if (sysno == __NR_fcntl) {
263      const Arg<int> fd(0);
264      return If(fd == -314, Error(EPERM)).Else(Allow());
265    }
266    return Allow();
267  }
268
269 private:
270  DISALLOW_COPY_AND_ASSIGN(NegativeConstantsPolicy);
271};
272
273TEST(BPFDSL, NegativeConstantsTest) {
274  PolicyEmulator emulator(golden::kNegativeConstantsPolicy,
275                          NegativeConstantsPolicy());
276
277  emulator.ExpectAllow(FakeSyscall(__NR_fcntl, -5, F_DUPFD));
278  emulator.ExpectAllow(FakeSyscall(__NR_fcntl, 20, F_DUPFD));
279  emulator.ExpectErrno(EPERM, FakeSyscall(__NR_fcntl, -314, F_DUPFD));
280}
281
282#if 0
283// TODO(mdempsky): This is really an integration test.
284
285class TrappingPolicy : public Policy {
286 public:
287  TrappingPolicy() {}
288  ~TrappingPolicy() override {}
289  ResultExpr EvaluateSyscall(int sysno) const override {
290    if (sysno == __NR_uname) {
291      return Trap(UnameTrap, &count_);
292    }
293    return Allow();
294  }
295
296 private:
297  static intptr_t count_;
298
299  static intptr_t UnameTrap(const struct arch_seccomp_data& data, void* aux) {
300    BPF_ASSERT_EQ(&count_, aux);
301    return ++count_;
302  }
303
304  DISALLOW_COPY_AND_ASSIGN(TrappingPolicy);
305};
306
307intptr_t TrappingPolicy::count_;
308
309BPF_TEST_C(BPFDSL, TrapTest, TrappingPolicy) {
310  ASSERT_SYSCALL_RESULT(1, uname, NULL);
311  ASSERT_SYSCALL_RESULT(2, uname, NULL);
312  ASSERT_SYSCALL_RESULT(3, uname, NULL);
313}
314#endif
315
316class MaskingPolicy : public Policy {
317 public:
318  MaskingPolicy() {}
319  ~MaskingPolicy() override {}
320  ResultExpr EvaluateSyscall(int sysno) const override {
321    if (sysno == __NR_setuid) {
322      const Arg<uid_t> uid(0);
323      return If((uid & 0xf) == 0, Error(EINVAL)).Else(Error(EACCES));
324    }
325    if (sysno == __NR_setgid) {
326      const Arg<gid_t> gid(0);
327      return If((gid & 0xf0) == 0xf0, Error(EINVAL)).Else(Error(EACCES));
328    }
329    if (sysno == __NR_setpgid) {
330      const Arg<pid_t> pid(0);
331      return If((pid & 0xa5) == 0xa0, Error(EINVAL)).Else(Error(EACCES));
332    }
333    return Allow();
334  }
335
336 private:
337  DISALLOW_COPY_AND_ASSIGN(MaskingPolicy);
338};
339
340TEST(BPFDSL, MaskTest) {
341  PolicyEmulator emulator(golden::kMaskingPolicy, MaskingPolicy());
342
343  for (uid_t uid = 0; uid < 0x100; ++uid) {
344    const int expect_errno = (uid & 0xf) == 0 ? EINVAL : EACCES;
345    emulator.ExpectErrno(expect_errno, FakeSyscall(__NR_setuid, uid));
346  }
347
348  for (gid_t gid = 0; gid < 0x100; ++gid) {
349    const int expect_errno = (gid & 0xf0) == 0xf0 ? EINVAL : EACCES;
350    emulator.ExpectErrno(expect_errno, FakeSyscall(__NR_setgid, gid));
351  }
352
353  for (pid_t pid = 0; pid < 0x100; ++pid) {
354    const int expect_errno = (pid & 0xa5) == 0xa0 ? EINVAL : EACCES;
355    emulator.ExpectErrno(expect_errno, FakeSyscall(__NR_setpgid, pid, 0));
356  }
357}
358
359class ElseIfPolicy : public Policy {
360 public:
361  ElseIfPolicy() {}
362  ~ElseIfPolicy() override {}
363  ResultExpr EvaluateSyscall(int sysno) const override {
364    if (sysno == __NR_setuid) {
365      const Arg<uid_t> uid(0);
366      return If((uid & 0xfff) == 0, Error(0))
367          .ElseIf((uid & 0xff0) == 0, Error(EINVAL))
368          .ElseIf((uid & 0xf00) == 0, Error(EEXIST))
369          .Else(Error(EACCES));
370    }
371    return Allow();
372  }
373
374 private:
375  DISALLOW_COPY_AND_ASSIGN(ElseIfPolicy);
376};
377
378TEST(BPFDSL, ElseIfTest) {
379  PolicyEmulator emulator(golden::kElseIfPolicy, ElseIfPolicy());
380
381  emulator.ExpectErrno(0, FakeSyscall(__NR_setuid, 0));
382
383  emulator.ExpectErrno(EINVAL, FakeSyscall(__NR_setuid, 0x0001));
384  emulator.ExpectErrno(EINVAL, FakeSyscall(__NR_setuid, 0x0002));
385
386  emulator.ExpectErrno(EEXIST, FakeSyscall(__NR_setuid, 0x0011));
387  emulator.ExpectErrno(EEXIST, FakeSyscall(__NR_setuid, 0x0022));
388
389  emulator.ExpectErrno(EACCES, FakeSyscall(__NR_setuid, 0x0111));
390  emulator.ExpectErrno(EACCES, FakeSyscall(__NR_setuid, 0x0222));
391}
392
393class SwitchPolicy : public Policy {
394 public:
395  SwitchPolicy() {}
396  ~SwitchPolicy() override {}
397  ResultExpr EvaluateSyscall(int sysno) const override {
398    if (sysno == __NR_fcntl) {
399      const Arg<int> cmd(1);
400      const Arg<unsigned long> long_arg(2);
401      return Switch(cmd)
402          .CASES((F_GETFL, F_GETFD), Error(ENOENT))
403          .Case(F_SETFD, If(long_arg == O_CLOEXEC, Allow()).Else(Error(EINVAL)))
404          .Case(F_SETFL, Error(EPERM))
405          .Default(Error(EACCES));
406    }
407    return Allow();
408  }
409
410 private:
411  DISALLOW_COPY_AND_ASSIGN(SwitchPolicy);
412};
413
414TEST(BPFDSL, SwitchTest) {
415  PolicyEmulator emulator(golden::kSwitchPolicy, SwitchPolicy());
416
417  const int kFakeSockFD = 42;
418
419  emulator.ExpectErrno(ENOENT, FakeSyscall(__NR_fcntl, kFakeSockFD, F_GETFD));
420  emulator.ExpectErrno(ENOENT, FakeSyscall(__NR_fcntl, kFakeSockFD, F_GETFL));
421
422  emulator.ExpectAllow(
423      FakeSyscall(__NR_fcntl, kFakeSockFD, F_SETFD, O_CLOEXEC));
424  emulator.ExpectErrno(EINVAL,
425                       FakeSyscall(__NR_fcntl, kFakeSockFD, F_SETFD, 0));
426
427  emulator.ExpectErrno(EPERM,
428                       FakeSyscall(__NR_fcntl, kFakeSockFD, F_SETFL, O_RDONLY));
429
430  emulator.ExpectErrno(EACCES,
431                       FakeSyscall(__NR_fcntl, kFakeSockFD, F_DUPFD, 0));
432}
433
434static intptr_t DummyTrap(const struct arch_seccomp_data& data, void* aux) {
435  return 0;
436}
437
438TEST(BPFDSL, IsAllowDeny) {
439  ResultExpr allow = Allow();
440  EXPECT_TRUE(allow->IsAllow());
441  EXPECT_FALSE(allow->IsDeny());
442
443  ResultExpr error = Error(ENOENT);
444  EXPECT_FALSE(error->IsAllow());
445  EXPECT_TRUE(error->IsDeny());
446
447  ResultExpr trace = Trace(42);
448  EXPECT_FALSE(trace->IsAllow());
449  EXPECT_FALSE(trace->IsDeny());
450
451  ResultExpr trap = Trap(DummyTrap, nullptr);
452  EXPECT_FALSE(trap->IsAllow());
453  EXPECT_TRUE(trap->IsDeny());
454
455  const Arg<int> arg(0);
456  ResultExpr maybe = If(arg == 0, Allow()).Else(Error(EPERM));
457  EXPECT_FALSE(maybe->IsAllow());
458  EXPECT_FALSE(maybe->IsDeny());
459}
460
461TEST(BPFDSL, HasUnsafeTraps) {
462  ResultExpr allow = Allow();
463  EXPECT_FALSE(allow->HasUnsafeTraps());
464
465  ResultExpr safe = Trap(DummyTrap, nullptr);
466  EXPECT_FALSE(safe->HasUnsafeTraps());
467
468  ResultExpr unsafe = UnsafeTrap(DummyTrap, nullptr);
469  EXPECT_TRUE(unsafe->HasUnsafeTraps());
470
471  const Arg<int> arg(0);
472  ResultExpr maybe = If(arg == 0, allow).Else(unsafe);
473  EXPECT_TRUE(maybe->HasUnsafeTraps());
474}
475
476}  // namespace
477}  // namespace bpf_dsl
478}  // namespace sandbox
479