1 /* Copyright (c) 2012 The Chromium OS Authors. All rights reserved. 2 * Use of this source code is governed by a BSD-style license that can be 3 * found in the LICENSE file. 4 */ 5 6 #include <stdio.h> 7 #include <stdlib.h> 8 #include <string.h> 9 10 #include "syscall_filter.h" 11 12 #include "util.h" 13 14 #define MAX_LINE_LENGTH 1024 15 #define MAX_POLICY_LINE_LENGTH 1024 16 17 #define ONE_INSTR 1 18 #define TWO_INSTRS 2 19 20 int str_to_op(const char *op_str) 21 { 22 if (!strcmp(op_str, "==")) { 23 return EQ; 24 } else if (!strcmp(op_str, "!=")) { 25 return NE; 26 } else if (!strcmp(op_str, "&")) { 27 return SET; 28 } else { 29 return 0; 30 } 31 } 32 33 struct sock_filter *new_instr_buf(size_t count) 34 { 35 struct sock_filter *buf = calloc(count, sizeof(struct sock_filter)); 36 if (!buf) 37 die("could not allocate BPF instruction buffer"); 38 39 return buf; 40 } 41 42 struct filter_block *new_filter_block() 43 { 44 struct filter_block *block = calloc(1, sizeof(struct filter_block)); 45 if (!block) 46 die("could not allocate BPF filter block"); 47 48 block->instrs = NULL; 49 block->last = block->next = NULL; 50 51 return block; 52 } 53 54 void append_filter_block(struct filter_block *head, 55 struct sock_filter *instrs, size_t len) 56 { 57 struct filter_block *new_last; 58 59 /* 60 * If |head| has no filter assigned yet, 61 * we don't create a new node. 62 */ 63 if (head->instrs == NULL) { 64 new_last = head; 65 } else { 66 new_last = new_filter_block(); 67 if (head->next != NULL) { 68 head->last->next = new_last; 69 head->last = new_last; 70 } else { 71 head->last = head->next = new_last; 72 } 73 head->total_len += len; 74 } 75 76 new_last->instrs = instrs; 77 new_last->total_len = new_last->len = len; 78 new_last->last = new_last->next = NULL; 79 } 80 81 void extend_filter_block_list(struct filter_block *list, 82 struct filter_block *another) 83 { 84 if (list->last != NULL) { 85 list->last->next = another; 86 list->last = another->last; 87 } else { 88 list->next = another; 89 list->last = another->last; 90 } 91 list->total_len += another->total_len; 92 } 93 94 void append_ret_kill(struct filter_block *head) 95 { 96 struct sock_filter *filter = new_instr_buf(ONE_INSTR); 97 set_bpf_ret_kill(filter); 98 append_filter_block(head, filter, ONE_INSTR); 99 } 100 101 void append_ret_trap(struct filter_block *head) 102 { 103 struct sock_filter *filter = new_instr_buf(ONE_INSTR); 104 set_bpf_ret_trap(filter); 105 append_filter_block(head, filter, ONE_INSTR); 106 } 107 108 void append_ret_errno(struct filter_block *head, int errno_val) 109 { 110 struct sock_filter *filter = new_instr_buf(ONE_INSTR); 111 set_bpf_ret_errno(filter, errno_val); 112 append_filter_block(head, filter, ONE_INSTR); 113 } 114 115 void append_allow_syscall(struct filter_block *head, int nr) 116 { 117 struct sock_filter *filter = new_instr_buf(ALLOW_SYSCALL_LEN); 118 size_t len = bpf_allow_syscall(filter, nr); 119 if (len != ALLOW_SYSCALL_LEN) 120 die("error building syscall number comparison"); 121 122 append_filter_block(head, filter, len); 123 } 124 125 void allow_log_syscalls(struct filter_block *head) 126 { 127 unsigned int i; 128 for (i = 0; i < log_syscalls_len; i++) { 129 warn("allowing syscall: %s", log_syscalls[i]); 130 append_allow_syscall(head, lookup_syscall(log_syscalls[i])); 131 } 132 } 133 134 unsigned int get_label_id(struct bpf_labels *labels, const char *label_str) 135 { 136 int label_id = bpf_label_id(labels, label_str); 137 if (label_id < 0) 138 die("could not allocate BPF label string"); 139 return label_id; 140 } 141 142 unsigned int group_end_lbl(struct bpf_labels *labels, int nr, int idx) 143 { 144 char lbl_str[MAX_BPF_LABEL_LEN]; 145 snprintf(lbl_str, MAX_BPF_LABEL_LEN, "%d_%d_end", nr, idx); 146 return get_label_id(labels, lbl_str); 147 } 148 149 unsigned int success_lbl(struct bpf_labels *labels, int nr) 150 { 151 char lbl_str[MAX_BPF_LABEL_LEN]; 152 snprintf(lbl_str, MAX_BPF_LABEL_LEN, "%d_success", nr); 153 return get_label_id(labels, lbl_str); 154 } 155 156 int compile_atom(struct filter_block *head, char *atom, 157 struct bpf_labels *labels, int nr, int group_idx) 158 { 159 /* Splits the atom. */ 160 char *atom_ptr; 161 char *argidx_str = strtok_r(atom, " ", &atom_ptr); 162 char *operator_str = strtok_r(NULL, " ", &atom_ptr); 163 char *constant_str = strtok_r(NULL, " ", &atom_ptr); 164 165 if (argidx_str == NULL || operator_str == NULL || constant_str == NULL) 166 return -1; 167 168 int op = str_to_op(operator_str); 169 if (op < MIN_OPERATOR) 170 return -1; 171 172 if (strncmp(argidx_str, "arg", 3)) { 173 return -1; 174 } 175 176 char *argidx_ptr; 177 long int argidx = strtol(argidx_str + 3, &argidx_ptr, 10); 178 /* 179 * Checks to see if an actual argument index 180 * was parsed. 181 */ 182 if (argidx_ptr == argidx_str + 3) 183 return -1; 184 185 char *constant_str_ptr; 186 long int c = parse_constant(constant_str, &constant_str_ptr); 187 if (constant_str_ptr == constant_str) 188 return -1; 189 190 /* 191 * Looks up the label for the end of the AND statement 192 * this atom belongs to. 193 */ 194 unsigned int id = group_end_lbl(labels, nr, group_idx); 195 196 /* 197 * Builds a BPF comparison between a syscall argument 198 * and a constant. 199 * The comparison lives inside an AND statement. 200 * If the comparison succeeds, we continue 201 * to the next comparison. 202 * If this comparison fails, the whole AND statement 203 * will fail, so we jump to the end of this AND statement. 204 */ 205 struct sock_filter *comp_block; 206 size_t len = bpf_arg_comp(&comp_block, op, argidx, c, id); 207 if (len == 0) 208 return -1; 209 210 append_filter_block(head, comp_block, len); 211 return 0; 212 } 213 214 int compile_errno(struct filter_block *head, char *ret_errno) 215 { 216 char *errno_ptr; 217 218 /* Splits the 'return' keyword and the actual errno value. */ 219 char *ret_str = strtok_r(ret_errno, " ", &errno_ptr); 220 if (strncmp(ret_str, "return", strlen("return"))) 221 return -1; 222 223 char *errno_val_str = strtok_r(NULL, " ", &errno_ptr); 224 225 if (errno_val_str) { 226 char *errno_val_ptr; 227 int errno_val = parse_constant(errno_val_str, &errno_val_ptr); 228 /* Checks to see if we parsed an actual errno. */ 229 if (errno_val_ptr == errno_val_str || errno_val == -1) 230 return -1; 231 232 append_ret_errno(head, errno_val); 233 } else { 234 append_ret_kill(head); 235 } 236 return 0; 237 } 238 239 struct filter_block *compile_section(int nr, const char *policy_line, 240 unsigned int entry_lbl_id, struct bpf_labels *labels) 241 { 242 /* 243 * |policy_line| should be an expression of the form: 244 * "arg0 == 3 && arg1 == 5 || arg0 == 0x8" 245 * 246 * This is, an expression in DNF (disjunctive normal form); 247 * a disjunction ('||') of one or more conjunctions ('&&') 248 * of one or more atoms. 249 * 250 * Atoms are of the form "arg{DNUM} {OP} {NUM}" 251 * where: 252 * - DNUM is a decimal number. 253 * - OP is an operator: ==, !=, or & (flags set). 254 * - NUM is an octal, decimal, or hexadecimal number. 255 * 256 * When the syscall arguments make the expression true, 257 * the syscall is allowed. If not, the process is killed. 258 * 259 * To block a syscall without killing the process, 260 * |policy_line| can be of the form: 261 * "return <errno>" 262 * 263 * This "return {NUM}" policy line will block the syscall, 264 * make it return -1 and set |errno| to NUM. 265 * 266 * A regular policy line can also include a "return <errno>" clause, 267 * separated by a semicolon (';'): 268 * "arg0 == 3 && arg1 == 5 || arg0 == 0x8; return {NUM}" 269 * 270 * If the syscall arguments don't make the expression true, 271 * the syscall will be blocked as above instead of killing the process. 272 */ 273 274 size_t len = 0; 275 int group_idx = 0; 276 277 /* Checks for overly long policy lines. */ 278 if (strlen(policy_line) >= MAX_POLICY_LINE_LENGTH) 279 return NULL; 280 281 /* We will modify |policy_line|, so let's make a copy. */ 282 char *line = strndup(policy_line, MAX_POLICY_LINE_LENGTH); 283 if (!line) 284 return NULL; 285 286 /* 287 * We build the filter section as a collection of smaller 288 * "filter blocks" linked together in a singly-linked list. 289 */ 290 struct filter_block *head = new_filter_block(); 291 292 /* 293 * Filter sections begin with a label where the main filter 294 * will jump after checking the syscall number. 295 */ 296 struct sock_filter *entry_label = new_instr_buf(ONE_INSTR); 297 set_bpf_lbl(entry_label, entry_lbl_id); 298 append_filter_block(head, entry_label, ONE_INSTR); 299 300 /* Checks whether we're unconditionally blocking this syscall. */ 301 if (strncmp(line, "return", strlen("return")) == 0) { 302 if (compile_errno(head, line) < 0) 303 return NULL; 304 free(line); 305 return head; 306 } 307 308 /* Splits the optional "return <errno>" part. */ 309 char *line_ptr; 310 char *arg_filter = strtok_r(line, ";", &line_ptr); 311 char *ret_errno = strtok_r(NULL, ";", &line_ptr); 312 313 /* 314 * Splits the policy line by '||' into conjunctions and each conjunction 315 * by '&&' into atoms. 316 */ 317 char *arg_filter_str = arg_filter; 318 char *group; 319 while ((group = tokenize(&arg_filter_str, "||")) != NULL) { 320 char *group_str = group; 321 char *comp; 322 while ((comp = tokenize(&group_str, "&&")) != NULL) { 323 /* Compiles each atom into a BPF block. */ 324 if (compile_atom(head, comp, labels, nr, group_idx) < 0) 325 return NULL; 326 } 327 /* 328 * If the AND statement succeeds, we're done, 329 * so jump to SUCCESS line. 330 */ 331 unsigned int id = success_lbl(labels, nr); 332 struct sock_filter *group_end_block = new_instr_buf(TWO_INSTRS); 333 len = set_bpf_jump_lbl(group_end_block, id); 334 /* 335 * The end of each AND statement falls after the 336 * jump to SUCCESS. 337 */ 338 id = group_end_lbl(labels, nr, group_idx++); 339 len += set_bpf_lbl(group_end_block + len, id); 340 append_filter_block(head, group_end_block, len); 341 } 342 343 /* 344 * If no AND statements succeed, we end up here, 345 * because we never jumped to SUCCESS. 346 * If we have to return an errno, do it, 347 * otherwise just kill the task. 348 */ 349 if (ret_errno) { 350 if (compile_errno(head, ret_errno) < 0) 351 return NULL; 352 } else { 353 append_ret_kill(head); 354 } 355 356 /* 357 * Every time the filter succeeds we jump to a predefined SUCCESS 358 * label. Add that label and BPF RET_ALLOW code now. 359 */ 360 unsigned int id = success_lbl(labels, nr); 361 struct sock_filter *success_block = new_instr_buf(TWO_INSTRS); 362 len = set_bpf_lbl(success_block, id); 363 len += set_bpf_ret_allow(success_block + len); 364 append_filter_block(head, success_block, len); 365 366 free(line); 367 return head; 368 } 369 370 int compile_filter(FILE *policy_file, struct sock_fprog *prog, 371 int log_failures) 372 { 373 char line[MAX_LINE_LENGTH]; 374 int line_count = 0; 375 376 struct bpf_labels labels; 377 labels.count = 0; 378 379 if (!policy_file) 380 return -1; 381 382 struct filter_block *head = new_filter_block(); 383 struct filter_block *arg_blocks = NULL; 384 385 /* Start filter by validating arch. */ 386 struct sock_filter *valid_arch = new_instr_buf(ARCH_VALIDATION_LEN); 387 size_t len = bpf_validate_arch(valid_arch); 388 append_filter_block(head, valid_arch, len); 389 390 /* Load syscall number. */ 391 struct sock_filter *load_nr = new_instr_buf(ONE_INSTR); 392 len = bpf_load_syscall_nr(load_nr); 393 append_filter_block(head, load_nr, len); 394 395 /* If we're logging failures, allow the necessary syscalls first. */ 396 if (log_failures) 397 allow_log_syscalls(head); 398 399 /* 400 * Loop through all the lines in the policy file. 401 * Build a jump table for the syscall number. 402 * If the policy line has an arg filter, build the arg filter 403 * as well. 404 * Chain the filter sections together and dump them into 405 * the final buffer at the end. 406 */ 407 while (fgets(line, sizeof(line), policy_file)) { 408 ++line_count; 409 char *policy_line = line; 410 char *syscall_name = strsep(&policy_line, ":"); 411 int nr = -1; 412 413 syscall_name = strip(syscall_name); 414 415 /* Allow comments and empty lines. */ 416 if (*syscall_name == '#' || *syscall_name == '\0') 417 continue; 418 419 if (!policy_line) 420 return -1; 421 422 nr = lookup_syscall(syscall_name); 423 if (nr < 0) { 424 warn("compile_filter: nonexistent syscall '%s'", 425 syscall_name); 426 if (log_failures) { 427 /* 428 * If we're logging failures, assume we're in a 429 * debugging case and continue. 430 * This is not super risky because an invalid 431 * syscall name is likely caused by a typo or by 432 * leftover lines from a different architecture. 433 * In either case, not including a policy line 434 * is equivalent to killing the process if the 435 * syscall is made, so there's no added attack 436 * surface. 437 */ 438 continue; 439 } 440 return -1; 441 } 442 443 policy_line = strip(policy_line); 444 445 /* 446 * For each syscall, add either a simple ALLOW, 447 * or an arg filter block. 448 */ 449 if (strcmp(policy_line, "1") == 0) { 450 /* Add simple ALLOW. */ 451 append_allow_syscall(head, nr); 452 } else { 453 /* 454 * Create and jump to the label that will hold 455 * the arg filter block. 456 */ 457 unsigned int id = bpf_label_id(&labels, syscall_name); 458 struct sock_filter *nr_comp = 459 new_instr_buf(ALLOW_SYSCALL_LEN); 460 bpf_allow_syscall_args(nr_comp, nr, id); 461 append_filter_block(head, nr_comp, ALLOW_SYSCALL_LEN); 462 463 /* Build the arg filter block. */ 464 struct filter_block *block = 465 compile_section(nr, policy_line, id, &labels); 466 467 if (!block) 468 return -1; 469 470 if (arg_blocks) { 471 extend_filter_block_list(arg_blocks, block); 472 } else { 473 arg_blocks = block; 474 } 475 } 476 } 477 478 /* 479 * If none of the syscalls match, either fall back to KILL, 480 * or return TRAP. 481 */ 482 if (!log_failures) 483 append_ret_kill(head); 484 else 485 append_ret_trap(head); 486 487 /* Allocate the final buffer, now that we know its size. */ 488 size_t final_filter_len = head->total_len + 489 (arg_blocks? arg_blocks->total_len : 0); 490 if (final_filter_len > BPF_MAXINSNS) 491 return -1; 492 493 struct sock_filter *final_filter = 494 calloc(final_filter_len, sizeof(struct sock_filter)); 495 496 if (flatten_block_list(head, final_filter, 0, final_filter_len) < 0) 497 return -1; 498 499 if (flatten_block_list(arg_blocks, final_filter, 500 head->total_len, final_filter_len) < 0) 501 return -1; 502 503 free_block_list(head); 504 free_block_list(arg_blocks); 505 506 bpf_resolve_jumps(&labels, final_filter, final_filter_len); 507 508 free_label_strings(&labels); 509 510 prog->filter = final_filter; 511 prog->len = final_filter_len; 512 return 0; 513 } 514 515 int flatten_block_list(struct filter_block *head, struct sock_filter *filter, 516 size_t index, size_t cap) 517 { 518 size_t _index = index; 519 520 struct filter_block *curr; 521 size_t i; 522 523 for (curr = head; curr; curr = curr->next) { 524 for (i = 0; i < curr->len; i++) { 525 if (_index >= cap) 526 return -1; 527 filter[_index++] = curr->instrs[i]; 528 } 529 } 530 return 0; 531 } 532 533 void free_block_list(struct filter_block *head) 534 { 535 struct filter_block *current, *prev; 536 537 current = head; 538 while (current) { 539 free(current->instrs); 540 prev = current; 541 current = current->next; 542 free(prev); 543 } 544 } 545
