1 // Copyright 2014 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include <errno.h> 6 #include <fcntl.h> 7 #include <sys/ptrace.h> 8 #include <sys/stat.h> 9 #include <sys/types.h> 10 #include <unistd.h> 11 12 #include "base/bind.h" 13 #include "base/bind_helpers.h" 14 #include "base/compiler_specific.h" 15 #include "base/posix/eintr_wrapper.h" 16 #include "base/strings/string_util.h" 17 #include "base/sys_info.h" 18 #include "sandbox/linux/services/scoped_process.h" 19 #include "sandbox/linux/services/yama.h" 20 #include "sandbox/linux/tests/unit_tests.h" 21 #include "testing/gtest/include/gtest/gtest.h" 22 23 namespace sandbox { 24 25 namespace { 26 27 bool HasLinux32Bug() { 28 #if defined(__i386__) 29 // On 3.2 kernels, yama doesn't work for 32-bit binaries on 64-bit kernels. 30 // This is fixed in 3.4. 31 bool is_kernel_64bit = 32 base::SysInfo::OperatingSystemArchitecture() == "x86_64"; 33 bool is_linux = base::SysInfo::OperatingSystemName() == "Linux"; 34 bool is_3_dot_2 = base::StartsWith( 35 base::SysInfo::OperatingSystemVersion(), "3.2", 36 base::CompareCase::INSENSITIVE_ASCII); 37 if (is_kernel_64bit && is_linux && is_3_dot_2) 38 return true; 39 #endif // defined(__i386__) 40 return false; 41 } 42 43 bool CanPtrace(pid_t pid) { 44 int ret; 45 ret = ptrace(PTRACE_ATTACH, pid, NULL, NULL); 46 if (ret == -1) { 47 CHECK_EQ(EPERM, errno); 48 return false; 49 } 50 // Wait for the process to be stopped so that it can be detached. 51 siginfo_t process_info; 52 int wait_ret = HANDLE_EINTR(waitid(P_PID, pid, &process_info, WSTOPPED)); 53 PCHECK(0 == wait_ret); 54 PCHECK(0 == ptrace(PTRACE_DETACH, pid, NULL, NULL)); 55 return true; 56 } 57 58 // _exit(0) if pid can be ptraced by the current process. 59 // _exit(1) otherwise. 60 void ExitZeroIfCanPtrace(pid_t pid) { 61 if (CanPtrace(pid)) { 62 _exit(0); 63 } else { 64 _exit(1); 65 } 66 } 67 68 bool CanSubProcessPtrace(pid_t pid) { 69 ScopedProcess process(base::Bind(&ExitZeroIfCanPtrace, pid)); 70 bool signaled; 71 int exit_code = process.WaitForExit(&signaled); 72 CHECK(!signaled); 73 return 0 == exit_code; 74 } 75 76 // The tests below assume that the system-level configuration will not change 77 // while they run. 78 79 TEST(Yama, GetStatus) { 80 int status1 = Yama::GetStatus(); 81 82 // Check that the value is a possible bitmask. 83 ASSERT_LE(0, status1); 84 ASSERT_GE(Yama::STATUS_KNOWN | Yama::STATUS_PRESENT | Yama::STATUS_ENFORCING | 85 Yama::STATUS_STRICT_ENFORCING, 86 status1); 87 88 // The status should not just be a random value. 89 int status2 = Yama::GetStatus(); 90 EXPECT_EQ(status1, status2); 91 92 // This test is not running sandboxed, there is no reason to not know the 93 // status. 94 EXPECT_NE(0, Yama::STATUS_KNOWN & status1); 95 96 if (status1 & Yama::STATUS_STRICT_ENFORCING) { 97 // If Yama is strictly enforcing, it is also enforcing. 98 EXPECT_TRUE(status1 & Yama::STATUS_ENFORCING); 99 } 100 101 if (status1 & Yama::STATUS_ENFORCING) { 102 // If Yama is enforcing, Yama is present. 103 EXPECT_NE(0, status1 & Yama::STATUS_PRESENT); 104 } 105 106 // Verify that the helper functions work as intended. 107 EXPECT_EQ(static_cast<bool>(status1 & Yama::STATUS_ENFORCING), 108 Yama::IsEnforcing()); 109 EXPECT_EQ(static_cast<bool>(status1 & Yama::STATUS_PRESENT), 110 Yama::IsPresent()); 111 112 fprintf(stdout, 113 "Yama present: %s - enforcing: %s\n", 114 Yama::IsPresent() ? "Y" : "N", 115 Yama::IsEnforcing() ? "Y" : "N"); 116 } 117 118 SANDBOX_TEST(Yama, RestrictPtraceSucceedsWhenYamaPresent) { 119 // This call will succeed iff Yama is present. 120 bool restricted = Yama::RestrictPtracersToAncestors(); 121 CHECK_EQ(restricted, Yama::IsPresent()); 122 } 123 124 // Attempts to enable or disable Yama restrictions. 125 void SetYamaRestrictions(bool enable_restriction) { 126 if (enable_restriction) { 127 Yama::RestrictPtracersToAncestors(); 128 } else { 129 Yama::DisableYamaRestrictions(); 130 } 131 } 132 133 TEST(Yama, RestrictPtraceWorks) { 134 if (HasLinux32Bug()) 135 return; 136 137 ScopedProcess process1(base::Bind(&SetYamaRestrictions, true)); 138 ASSERT_TRUE(process1.WaitForClosureToRun()); 139 140 if (Yama::IsEnforcing()) { 141 // A sibling process cannot ptrace process1. 142 ASSERT_FALSE(CanSubProcessPtrace(process1.GetPid())); 143 } 144 145 if (!(Yama::GetStatus() & Yama::STATUS_STRICT_ENFORCING)) { 146 // However, parent can ptrace process1. 147 ASSERT_TRUE(CanPtrace(process1.GetPid())); 148 149 // A sibling can ptrace process2 which disables any Yama protection. 150 ScopedProcess process2(base::Bind(&SetYamaRestrictions, false)); 151 ASSERT_TRUE(process2.WaitForClosureToRun()); 152 ASSERT_TRUE(CanSubProcessPtrace(process2.GetPid())); 153 } 154 } 155 156 SANDBOX_TEST(Yama, RestrictPtraceIsDefault) { 157 if (!Yama::IsPresent() || HasLinux32Bug()) 158 return; 159 160 CHECK(Yama::DisableYamaRestrictions()); 161 ScopedProcess process1(base::Bind(&base::DoNothing)); 162 163 if (Yama::IsEnforcing()) { 164 // Check that process1 is protected by Yama, even though it has 165 // been created from a process that disabled Yama. 166 CHECK(!CanSubProcessPtrace(process1.GetPid())); 167 } 168 } 169 170 } // namespace 171 172 } // namespace sandbox 173
