1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef SANDBOX_LINUX_SECCOMP_BPF_SANDBOX_BPF_H__ 6 #define SANDBOX_LINUX_SECCOMP_BPF_SANDBOX_BPF_H__ 7 8 #include <stddef.h> 9 #include <sys/types.h> 10 #include <sys/wait.h> 11 12 #include <algorithm> 13 #include <limits> 14 #include <map> 15 #include <set> 16 #include <utility> 17 #include <vector> 18 19 #include "sandbox/linux/seccomp-bpf/die.h" 20 #include "sandbox/linux/seccomp-bpf/errorcode.h" 21 #include "sandbox/linux/seccomp-bpf/linux_seccomp.h" 22 #include "sandbox/linux/seccomp-bpf/port.h" 23 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy_forward.h" 24 25 namespace playground2 { 26 27 struct arch_seccomp_data { 28 int nr; 29 uint32_t arch; 30 uint64_t instruction_pointer; 31 uint64_t args[6]; 32 }; 33 34 struct arch_sigsys { 35 void *ip; 36 int nr; 37 unsigned int arch; 38 }; 39 40 class CodeGen; 41 class SandboxUnittestHelper; 42 struct Instruction; 43 44 class Sandbox { 45 public: 46 enum SandboxStatus { 47 STATUS_UNKNOWN, // Status prior to calling supportsSeccompSandbox() 48 STATUS_UNSUPPORTED, // The kernel does not appear to support sandboxing 49 STATUS_UNAVAILABLE, // Currently unavailable but might work again later 50 STATUS_AVAILABLE, // Sandboxing is available but not currently active 51 STATUS_ENABLED // The sandbox is now active 52 }; 53 54 // BpfSandboxPolicy is the following type: 55 // ErrorCode (Sandbox *sb, int sysnum, void *aux); 56 // When calling setSandboxPolicy(), the caller can provide an arbitrary 57 // pointer in |aux|. This pointer will then be forwarded to the sandbox 58 // policy each time a call is made through an EvaluateSyscall function 59 // pointer. One common use case would be to pass the "aux" pointer as an 60 // argument to Trap() functions. 61 typedef BpfSandboxPolicy* EvaluateSyscall; 62 typedef std::vector<std::pair<EvaluateSyscall, void *> >Evaluators; 63 64 // A vector of BPF instructions that need to be installed as a filter 65 // program in the kernel. 66 typedef std::vector<struct sock_filter> Program; 67 68 // Constructors and destructors. 69 // NOTE: Setting a policy and starting the sandbox is a one-way operation. 70 // The kernel does not provide any option for unloading a loaded 71 // sandbox. Strictly speaking, that means we should disallow calling 72 // the destructor, if StartSandbox() has ever been called. In practice, 73 // this makes it needlessly complicated to operate on "Sandbox" 74 // objects. So, we instead opted to allow object destruction. But it 75 // should be noted that during its lifetime, the object probably made 76 // irreversible state changes to the runtime environment. These changes 77 // stay in effect even after the destructor has been run. 78 Sandbox(); 79 ~Sandbox(); 80 81 // Checks whether a particular system call number is valid on the current 82 // architecture. E.g. on ARM there's a non-contiguous range of private 83 // system calls. 84 static bool IsValidSyscallNumber(int sysnum); 85 86 // There are a lot of reasons why the Seccomp sandbox might not be available. 87 // This could be because the kernel does not support Seccomp mode, or it 88 // could be because another sandbox is already active. 89 // "proc_fd" should be a file descriptor for "/proc", or -1 if not 90 // provided by the caller. 91 static SandboxStatus SupportsSeccompSandbox(int proc_fd); 92 93 // The sandbox needs to be able to access files in "/proc/self". If this 94 // directory is not accessible when "startSandbox()" gets called, the caller 95 // can provide an already opened file descriptor by calling "set_proc_fd()". 96 // The sandbox becomes the new owner of this file descriptor and will 97 // eventually close it when "StartSandbox()" executes. 98 void set_proc_fd(int proc_fd); 99 100 // The system call evaluator function is called with the system 101 // call number. It can decide to allow the system call unconditionally 102 // by returning ERR_ALLOWED; it can deny the system call unconditionally by 103 // returning an appropriate "errno" value; or it can request inspection 104 // of system call argument(s) by returning a suitable ErrorCode. 105 // The "aux" parameter can be used to pass optional data to the system call 106 // evaluator. There are different possible uses for this data, but one of the 107 // use cases would be for the policy to then forward this pointer to a Trap() 108 // handler. In this case, of course, the data that is pointed to must remain 109 // valid for the entire time that Trap() handlers can be called; typically, 110 // this would be the lifetime of the program. 111 void SetSandboxPolicy(EvaluateSyscall syscallEvaluator, void *aux); 112 113 // We can use ErrorCode to request calling of a trap handler. This method 114 // performs the required wrapping of the callback function into an 115 // ErrorCode object. 116 // The "aux" field can carry a pointer to arbitrary data. See EvaluateSyscall 117 // for a description of how to pass data from SetSandboxPolicy() to a Trap() 118 // handler. 119 ErrorCode Trap(Trap::TrapFnc fnc, const void *aux); 120 121 // Calls a user-space trap handler and disables all sandboxing for system 122 // calls made from this trap handler. 123 // This feature is available only if explicitly enabled by the user having 124 // set the CHROME_SANDBOX_DEBUGGING environment variable. 125 // Returns an ET_INVALID ErrorCode, if called when not enabled. 126 // NOTE: This feature, by definition, disables all security features of 127 // the sandbox. It should never be used in production, but it can be 128 // very useful to diagnose code that is incompatible with the sandbox. 129 // If even a single system call returns "UnsafeTrap", the security of 130 // entire sandbox should be considered compromised. 131 ErrorCode UnsafeTrap(Trap::TrapFnc fnc, const void *aux); 132 133 // From within an UnsafeTrap() it is often useful to be able to execute 134 // the system call that triggered the trap. The ForwardSyscall() method 135 // makes this easy. It is more efficient than calling glibc's syscall() 136 // function, as it avoid the extra round-trip to the signal handler. And 137 // it automatically does the correct thing to report kernel-style error 138 // conditions, rather than setting errno. See the comments for TrapFnc for 139 // details. In other words, the return value from ForwardSyscall() is 140 // directly suitable as a return value for a trap handler. 141 static intptr_t ForwardSyscall(const struct arch_seccomp_data& args); 142 143 // We can also use ErrorCode to request evaluation of a conditional 144 // statement based on inspection of system call parameters. 145 // This method wrap an ErrorCode object around the conditional statement. 146 // Argument "argno" (1..6) will be compared to "value" using comparator 147 // "op". If the condition is true "passed" will be returned, otherwise 148 // "failed". 149 // If "is32bit" is set, the argument must in the range of 0x0..(1u << 32 - 1) 150 // If it is outside this range, the sandbox treats the system call just 151 // the same as any other ABI violation (i.e. it aborts with an error 152 // message). 153 ErrorCode Cond(int argno, ErrorCode::ArgType is_32bit, 154 ErrorCode::Operation op, 155 uint64_t value, const ErrorCode& passed, 156 const ErrorCode& failed); 157 158 // Kill the program and print an error message. 159 ErrorCode Kill(const char *msg); 160 161 // This is the main public entry point. It finds all system calls that 162 // need rewriting, sets up the resources needed by the sandbox, and 163 // enters Seccomp mode. 164 // It is possible to stack multiple sandboxes by creating separate "Sandbox" 165 // objects and calling "StartSandbox()" on each of them. Please note, that 166 // this requires special care, though, as newly stacked sandboxes can never 167 // relax restrictions imposed by earlier sandboxes. Furthermore, installing 168 // a new policy requires making system calls, that might already be 169 // disallowed. 170 // Finally, stacking does add more kernel overhead than having a single 171 // combined policy. So, it should only be used if there are no alternatives. 172 void StartSandbox(); 173 174 // Assembles a BPF filter program from the current policy. After calling this 175 // function, you must not call any other sandboxing function. 176 // Typically, AssembleFilter() is only used by unit tests and by sandbox 177 // internals. It should not be used by production code. 178 // For performance reasons, we normally only run the assembled BPF program 179 // through the verifier, iff the program was built in debug mode. 180 // But by setting "force_verification", the caller can request that the 181 // verifier is run unconditionally. This is useful for unittests. 182 Program *AssembleFilter(bool force_verification); 183 184 // Returns the fatal ErrorCode that is used to indicate that somebody 185 // attempted to pass a 64bit value in a 32bit system call argument. 186 // This method is primarily needed for testing purposes. 187 ErrorCode Unexpected64bitArgument(); 188 189 private: 190 friend class CodeGen; 191 friend class SandboxUnittestHelper; 192 friend class ErrorCode; 193 194 struct Range { 195 Range(uint32_t f, uint32_t t, const ErrorCode& e) 196 : from(f), 197 to(t), 198 err(e) { 199 } 200 uint32_t from, to; 201 ErrorCode err; 202 }; 203 typedef std::vector<Range> Ranges; 204 typedef std::map<uint32_t, ErrorCode> ErrMap; 205 typedef std::set<ErrorCode, struct ErrorCode::LessThan> Conds; 206 207 // Get a file descriptor pointing to "/proc", if currently available. 208 int proc_fd() { return proc_fd_; } 209 210 // Creates a subprocess and runs "code_in_sandbox" inside of the specified 211 // policy. The caller has to make sure that "this" has not yet been 212 // initialized with any other policies. 213 bool RunFunctionInPolicy(void (*code_in_sandbox)(), 214 EvaluateSyscall syscall_evaluator, void *aux); 215 216 // Performs a couple of sanity checks to verify that the kernel supports the 217 // features that we need for successful sandboxing. 218 // The caller has to make sure that "this" has not yet been initialized with 219 // any other policies. 220 bool KernelSupportSeccompBPF(); 221 222 // Verify that the current policy passes some basic sanity checks. 223 void PolicySanityChecks(EvaluateSyscall syscall_evaluator, void *aux); 224 225 // Assembles and installs a filter based on the policy that has previously 226 // been configured with SetSandboxPolicy(). 227 void InstallFilter(); 228 229 // Verify the correctness of a compiled program by comparing it against the 230 // current policy. This function should only ever be called by unit tests and 231 // by the sandbox internals. It should not be used by production code. 232 void VerifyProgram(const Program& program, bool has_unsafe_traps); 233 234 // Finds all the ranges of system calls that need to be handled. Ranges are 235 // sorted in ascending order of system call numbers. There are no gaps in the 236 // ranges. System calls with identical ErrorCodes are coalesced into a single 237 // range. 238 void FindRanges(Ranges *ranges); 239 240 // Returns a BPF program snippet that implements a jump table for the 241 // given range of system call numbers. This function runs recursively. 242 Instruction *AssembleJumpTable(CodeGen *gen, 243 Ranges::const_iterator start, 244 Ranges::const_iterator stop); 245 246 // Returns a BPF program snippet that makes the BPF filter program exit 247 // with the given ErrorCode "err". N.B. the ErrorCode may very well be a 248 // conditional expression; if so, this function will recursively call 249 // CondExpression() and possibly RetExpression() to build a complex set of 250 // instructions. 251 Instruction *RetExpression(CodeGen *gen, const ErrorCode& err); 252 253 // Returns a BPF program that evaluates the conditional expression in 254 // "cond" and returns the appropriate value from the BPF filter program. 255 // This function recursively calls RetExpression(); it should only ever be 256 // called from RetExpression(). 257 Instruction *CondExpression(CodeGen *gen, const ErrorCode& cond); 258 259 static SandboxStatus status_; 260 261 bool quiet_; 262 int proc_fd_; 263 Evaluators *evaluators_; 264 Conds *conds_; 265 266 DISALLOW_COPY_AND_ASSIGN(Sandbox); 267 }; 268 269 } // namespace 270 271 #endif // SANDBOX_LINUX_SECCOMP_BPF_SANDBOX_BPF_H__ 272