add restricted filesystem access to sel_ldr

src/trusted/service_runtime/sys_filename.c

 /*
  * Copyright (c) 2013 The Native Client Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "native_client/src/trusted/service_runtime/sys_filename.h"
 
 #include <string.h>
 
@@ skipping 26 matching lines @@
       return -NACL_ABI_EFAULT;
     }
 
     NaClLog(LOG_ERROR, "NaClSys: pathname string too long\n");
     return -NACL_ABI_ENAMETOOLONG;
   }
 
   return 0;
 }
 
+static uint32_t CopyHostPathFromUser(struct NaClApp *nap,
+                                     char           *dest,
+                                     size_t         num_bytes,
+                                     uintptr_t      src) {
+  /*
+   * The purpose of this function is to not only copy the path bytes from the
+   * NaClApp, but to make sure the path is properly sanitized and has the
+   * NaClRootFolder prefixed, if provided.
+   * Start and see if there even is a root.
+   */
+  if (NaClRootFolder == NULL) {
+    return CopyPathFromUser(nap, dest, num_bytes, src);
+  }
+  /*
+   * Make sure we have room for the trailing null byte and an actual path.
+   */
+  if (NaClRootFolderLen + 1 >= num_bytes) {
+    return -NACL_ABI_ENAMETOOLONG;
+  }
+  /*
+   * Okay, add the root folder to dest (which will have a trailing slash
+   * already), then copy the path in after.
+   */
+  memcpy(dest, NaClRootFolder, NaClRootFolderLen);
+  return CopyPathFromUser(nap,
+                          dest + NaClRootFolderLen,
+                          num_bytes - NaClRootFolderLen,
+                          src);
+  /*
+   * TODO(jtolds): make sure we sanitize the path we just got so it has no ".."
+   *  path elements.

[jtolds, 2015/06/25 23:05:05]

does this even need to happen?

[Mark Seaborn, 2015/06/25 23:55:09]

If you don't remove ".." elements, isn't it trivial to read outside of
NaClRootFolder?

[jtolds, 2015/06/26 22:07:11]

currently working through these comments, but i just didn't know if path
sanitization happened at some higher level or something.

+   */
+}
+
+int NaClCopyHostPathOutToUser(struct NaClApp  *nap,
+                              uintptr_t       dst_usr_addr,
+                              char            *path) {
+  /*
+   * TODO(jtolds): remove NaClRootFolder prefix and fail if it doesn't match

[jtolds, 2015/06/25 23:05:05]

this function is only used to get the CWD. what should happen if the CWD is not
inside the untrusted root? should we chdir before starting to reduce that
chance?

+   */
+  return NaClCopyOutToUser(nap, dst_usr_addr, path, strlen(path) + 1);
+}
+
 int32_t NaClSysOpen(struct NaClAppThread  *natp,
                     uint32_t              pathname,
                     int                   flags,
                     int                   mode) {
   struct NaClApp       *nap = natp->nap;
   uint32_t             retval = -NACL_ABI_EINVAL;
   char                 path[NACL_CONFIG_PATH_MAX];
   nacl_host_stat_t     stbuf;
   int                  allowed_flags;
 
   NaClLog(3, "NaClSysOpen(0x%08"NACL_PRIxPTR", "
           "0x%08"NACL_PRIx32", 0x%x, 0x%x)\n",
           (uintptr_t) natp, pathname, flags, mode);
 
-  if (!NaClAclBypassChecks) {
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL) {
     return -NACL_ABI_EACCES;
   }
 
-  retval = CopyPathFromUser(nap, path, sizeof path, (uintptr_t) pathname);
+  retval = CopyHostPathFromUser(nap, path, sizeof path, (uintptr_t) pathname);
   if (0 != retval)
     goto cleanup;
 
   allowed_flags = (NACL_ABI_O_ACCMODE | NACL_ABI_O_CREAT | NACL_ABI_O_EXCL
                    | NACL_ABI_O_TRUNC | NACL_ABI_O_APPEND
                    | NACL_ABI_O_DIRECTORY);
   if (0 != (flags & ~allowed_flags)) {
     NaClLog(LOG_WARNING, "Invalid open flags 0%o, ignoring extraneous bits\n",
             flags);
     flags &= allowed_flags;
@@ skipping 83 matching lines @@
                     uint32_t              nasp) {
   struct NaClApp      *nap = natp->nap;
   int32_t             retval = -NACL_ABI_EINVAL;
   char                path[NACL_CONFIG_PATH_MAX];
   nacl_host_stat_t    stbuf;
 
   NaClLog(3,
           ("Entered NaClSysStat(0x%08"NACL_PRIxPTR", 0x%08"NACL_PRIx32","
            " 0x%08"NACL_PRIx32")\n"), (uintptr_t) natp, pathname, nasp);
 
-  if (!NaClAclBypassChecks) {
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL) {
     return -NACL_ABI_EACCES;
   }
 
-  retval = CopyPathFromUser(nap, path, sizeof path, pathname);
+  retval = CopyHostPathFromUser(nap, path, sizeof path, pathname);
   if (0 != retval)
     goto cleanup;
 
   /*
    * Perform a host stat.
    */
   retval = NaClHostDescStat(path, &stbuf);
   if (0 == retval) {
     struct nacl_abi_stat abi_stbuf;
 
     retval = NaClAbiStatHostDescStatXlateCtor(&abi_stbuf, &stbuf);
     if (!NaClCopyOutToUser(nap, nasp, &abi_stbuf, sizeof abi_stbuf)) {
       retval = -NACL_ABI_EFAULT;
     }
   }
 cleanup:
   return retval;
 }
 
 int32_t NaClSysMkdir(struct NaClAppThread *natp,
                      uint32_t             pathname,
                      int                  mode) {
   struct NaClApp *nap = natp->nap;
   char           path[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
-  if (!NaClAclBypassChecks) {
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL) {
     retval = -NACL_ABI_EACCES;
     goto cleanup;
   }
 
-  retval = CopyPathFromUser(nap, path, sizeof path, pathname);
+  retval = CopyHostPathFromUser(nap, path, sizeof path, pathname);
   if (0 != retval)
     goto cleanup;
 
   retval = NaClHostDescMkdir(path, mode);
 cleanup:
   return retval;
 }
 
 int32_t NaClSysRmdir(struct NaClAppThread *natp,
                      uint32_t             pathname) {
   struct NaClApp *nap = natp->nap;
   char           path[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
-  if (!NaClAclBypassChecks) {
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL) {
     retval = -NACL_ABI_EACCES;
     goto cleanup;
   }
 
-  retval = CopyPathFromUser(nap, path, sizeof path, pathname);
+  retval = CopyHostPathFromUser(nap, path, sizeof path, pathname);
   if (0 != retval)
     goto cleanup;
 
   retval = NaClHostDescRmdir(path);
 cleanup:
   return retval;
 }
 
 int32_t NaClSysChdir(struct NaClAppThread *natp,
                      uint32_t             pathname) {
   struct NaClApp *nap = natp->nap;
   char           path[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
-  if (!NaClAclBypassChecks) {
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL) {
     retval = -NACL_ABI_EACCES;
     goto cleanup;
   }
 
-  retval = CopyPathFromUser(nap, path, sizeof path, pathname);
+  retval = CopyHostPathFromUser(nap, path, sizeof path, pathname);
   if (0 != retval)
     goto cleanup;
 
   retval = NaClHostDescChdir(path);
 cleanup:
   return retval;
 }
 
 int32_t NaClSysGetcwd(struct NaClAppThread *natp,
                       uint32_t             buffer,
                       int                  len) {
   struct NaClApp *nap = natp->nap;
   int32_t        retval = -NACL_ABI_EINVAL;
   char           path[NACL_CONFIG_PATH_MAX];
 
-  if (!NaClAclBypassChecks) {
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL) {
     retval = -NACL_ABI_EACCES;
     goto cleanup;
   }
 
   if (len >= NACL_CONFIG_PATH_MAX)
     len = NACL_CONFIG_PATH_MAX - 1;
 
   retval = NaClHostDescGetcwd(path, len);
   if (retval != 0)
     goto cleanup;
 
-  if (!NaClCopyOutToUser(nap, buffer, &path, strlen(path) + 1))
+  if (!NaClCopyHostPathOutToUser(nap, buffer, &path[0]))
     retval = -NACL_ABI_EFAULT;
 
 cleanup:
   return retval;
 }
 
 int32_t NaClSysUnlink(struct NaClAppThread *natp,
                       uint32_t             pathname) {
   struct NaClApp *nap = natp->nap;
   char           path[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
-  if (!NaClAclBypassChecks) {
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL) {
     retval = -NACL_ABI_EACCES;
     goto cleanup;
   }
 
-  retval = CopyPathFromUser(nap, path, sizeof path, pathname);
+  retval = CopyHostPathFromUser(nap, path, sizeof path, pathname);
   if (0 != retval)
     goto cleanup;
 
   retval = NaClHostDescUnlink(path);
   NaClLog(3, "NaClHostDescUnlink '%s' -> %d\n", path, retval);
 cleanup:
   return retval;
 }
 
 int32_t NaClSysTruncate(struct NaClAppThread *natp,
                         uint32_t             pathname,
                         uint32_t             length_addr) {
   struct NaClApp *nap = natp->nap;
   char           path[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
   nacl_abi_off_t length;
 
-  if (!NaClAclBypassChecks)
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL)
     return -NACL_ABI_EACCES;
 
-  retval = CopyPathFromUser(nap, path, sizeof path, pathname);
+  retval = CopyHostPathFromUser(nap, path, sizeof path, pathname);
   if (0 != retval)
     return retval;
 
   if (!NaClCopyInFromUser(nap, &length, length_addr, sizeof length))
     return -NACL_ABI_EFAULT;
 
   retval = NaClHostDescTruncate(path, length);
   NaClLog(3, "NaClHostDescTruncate '%s' %"NACL_PRId64" -> %d\n",
           path, length, retval);
   return retval;
 }
 
 int32_t NaClSysLstat(struct NaClAppThread  *natp,
                      uint32_t              pathname,
                      uint32_t              nasp) {
   struct NaClApp      *nap = natp->nap;
   int32_t             retval = -NACL_ABI_EINVAL;
   char                path[NACL_CONFIG_PATH_MAX];
   nacl_host_stat_t    stbuf;
 
   NaClLog(3,
           ("Entered NaClSysLstat(0x%08"NACL_PRIxPTR", 0x%08"NACL_PRIx32","
            " 0x%08"NACL_PRIx32")\n"), (uintptr_t) natp, pathname, nasp);
 
-  if (!NaClAclBypassChecks) {
+  if (NaClRootFolder != NULL) {
+    retval = CopyHostPathFromUser(nap, path, sizeof path, pathname);
+    if (0 != retval)
+      return retval;
+
+    /*
+     * Mounted root folders don't support symlinks yet, so pretend they don't
+     * exist, and all symlinks are actually whatever they point to. CAREFUL,
+     * this means having symlinks that point outside of your mounted root

[Mark Seaborn, 2015/06/25 23:55:09]

Furthermore, note that if you have a relative symlink whose destination contains
a "..", it might start out pointing to within the sandbox filesystem, but
rename() or link() could be used to move it so that it points outside.

This is the kind of detail that can be covered in a file in documentation/.

+     * folder can allow chroot jail breaking!
+     * For this reason, symlink creation is also disabled.
+     */
+    retval = NaClHostDescStat(path, &stbuf);
+    if (0 == retval) {
+      struct nacl_abi_stat abi_stbuf;
+
+      retval = NaClAbiStatHostDescStatXlateCtor(&abi_stbuf, &stbuf);
+      if (!NaClCopyOutToUser(nap, nasp, &abi_stbuf, sizeof abi_stbuf)) {
+        return -NACL_ABI_EFAULT;
+      }
+    }
+    return retval;
+
+  } else if (NaClAclBypassChecks) {
+    retval = CopyPathFromUser(nap, path, sizeof path, pathname);
+    if (0 != retval)
+      return retval;
+
+    /*
+     * Perform a host lstat directly
+     */
+    retval = NaClHostDescLstat(path, &stbuf);
+    if (0 == retval) {
+      struct nacl_abi_stat abi_stbuf;
+
+      retval = NaClAbiStatHostDescStatXlateCtor(&abi_stbuf, &stbuf);
+      if (!NaClCopyOutToUser(nap, nasp, &abi_stbuf, sizeof abi_stbuf)) {
+        return -NACL_ABI_EFAULT;
+      }
+    }
+    return retval;
+
+  } else {
     return -NACL_ABI_EACCES;
   }
-
-  retval = CopyPathFromUser(nap, path, sizeof path, pathname);
-  if (0 != retval)
-    return retval;
-
-  /*
-   * Perform a host stat.
-   */
-  retval = NaClHostDescLstat(path, &stbuf);
-  if (0 == retval) {
-    struct nacl_abi_stat abi_stbuf;
-
-    retval = NaClAbiStatHostDescStatXlateCtor(&abi_stbuf, &stbuf);
-    if (!NaClCopyOutToUser(nap, nasp, &abi_stbuf, sizeof abi_stbuf)) {
-      return -NACL_ABI_EFAULT;
-    }
-  }
-  return retval;
 }
 
 int32_t NaClSysLink(struct NaClAppThread *natp,
                     uint32_t              oldname,
                     uint32_t              newname) {
   struct NaClApp *nap = natp->nap;
   char           oldpath[NACL_CONFIG_PATH_MAX];
   char           newpath[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
-  if (!NaClAclBypassChecks)
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL)
     return -NACL_ABI_EACCES;
 
-  retval = CopyPathFromUser(nap, oldpath, sizeof oldpath, oldname);
+  retval = CopyHostPathFromUser(nap, oldpath, sizeof oldpath, oldname);
   if (0 != retval)
     return retval;
 
-  retval = CopyPathFromUser(nap, newpath, sizeof newpath, newname);
+  retval = CopyHostPathFromUser(nap, newpath, sizeof newpath, newname);
   if (0 != retval)
     return retval;
 
   return NaClHostDescLink(oldpath, newpath);
 }
 
 int32_t NaClSysRename(struct NaClAppThread *natp,
                       uint32_t             oldname,
                       uint32_t             newname) {
   struct NaClApp *nap = natp->nap;
   char           oldpath[NACL_CONFIG_PATH_MAX];
   char           newpath[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
-  if (!NaClAclBypassChecks)
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL)
     return -NACL_ABI_EACCES;
 
-  retval = CopyPathFromUser(nap, oldpath, sizeof oldpath, oldname);
+  retval = CopyHostPathFromUser(nap, oldpath, sizeof oldpath, oldname);
   if (0 != retval)
     return retval;
 
-  retval = CopyPathFromUser(nap, newpath, sizeof newpath, newname);
+  retval = CopyHostPathFromUser(nap, newpath, sizeof newpath, newname);
   if (0 != retval)
     return retval;
 
   return NaClHostDescRename(oldpath, newpath);
 }
 
 int32_t NaClSysSymlink(struct NaClAppThread *natp,
                        uint32_t             oldname,
                        uint32_t             newname) {
   struct NaClApp *nap = natp->nap;
   char           oldpath[NACL_CONFIG_PATH_MAX];
   char           newpath[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
+  if (NaClRootFolder != NULL) {
+    /*
+     * Mounted root folders don't support symlinks yet, so pretend they don't
+     * exist and can't be created. See also lstat and readlink.
+     * Could be convinced to do ENOSYS instead of EPERM.
+     */
+    return -NACL_ABI_EPERM;
+  }
+
   if (!NaClAclBypassChecks)
     return -NACL_ABI_EACCES;
 
   retval = CopyPathFromUser(nap, oldpath, sizeof oldpath, oldname);
   if (0 != retval)
     return retval;
 
   retval = CopyPathFromUser(nap, newpath, sizeof newpath, newname);
   if (0 != retval)
     return retval;
 
   return NaClHostDescSymlink(oldpath, newpath);
 }
 
 int32_t NaClSysChmod(struct NaClAppThread *natp,
                      uint32_t             path,
                      nacl_abi_mode_t      mode) {
   struct NaClApp *nap = natp->nap;
   char           pathname[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
-  if (!NaClAclBypassChecks)
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL)
     return -NACL_ABI_EACCES;
 
-  retval = CopyPathFromUser(nap, pathname, sizeof pathname, path);
+  retval = CopyHostPathFromUser(nap, pathname, sizeof pathname, path);
   if (0 != retval)
     return retval;
 
   return NaClHostDescChmod(pathname, mode);
 }
 
 int32_t NaClSysAccess(struct NaClAppThread *natp,
                       uint32_t             path,
                       int                  amode) {
   struct NaClApp *nap = natp->nap;
   char           pathname[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
-  if (!NaClAclBypassChecks)
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL)
     return -NACL_ABI_EACCES;
 
   /*
    * amode must either be F_OK or some combination of the three permission bits.
    */
   if (amode != NACL_ABI_F_OK
       && (amode & ~(NACL_ABI_R_OK | NACL_ABI_W_OK | NACL_ABI_X_OK)) != 0)
     return -NACL_ABI_EINVAL;
 
-  retval = CopyPathFromUser(nap, pathname, sizeof pathname, path);
+  retval = CopyHostPathFromUser(nap, pathname, sizeof pathname, path);
   if (0 != retval)
     return retval;
 
   retval = NaClHostDescAccess(pathname, amode);
   NaClLog(3, "NaClHostDescAccess '%s' %d -> %d\n", pathname, amode, retval);
   return retval;
 }
 
 int32_t NaClSysReadlink(struct NaClAppThread *natp,
                         uint32_t             path,
                         uint32_t             buffer,
                         uint32_t             buffer_size) {
   struct NaClApp *nap = natp->nap;
   char           pathname[NACL_CONFIG_PATH_MAX];
   char           realpath[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
   uint32_t       result_size;
 
+  if (NaClRootFolder != NULL) {
+    /* We're going to return an error, but perhaps in this case we should
+     * try and find out if the file even exists, so we can return ENOENT first,
+     * and then return EINVAL otherwise? Dunno.
+     */
+    return -NACL_ABI_ENOSYS;
+  }
+
   if (!NaClAclBypassChecks)
     return -NACL_ABI_EACCES;
 
   retval = CopyPathFromUser(nap, pathname, sizeof pathname, path);
   if (0 != retval)
     return retval;
 
   retval = NaClHostDescReadlink(pathname, realpath, sizeof(realpath));
   if (retval < 0)
     return retval;
@@ skipping 22 matching lines @@
   return result_size;
 }
 
 int32_t NaClSysUtimes(struct NaClAppThread *natp,
                       uint32_t             path,
                       uint32_t             times) {
   struct NaClApp *nap = natp->nap;
   char           pathname[NACL_CONFIG_PATH_MAX];
   int32_t        retval = -NACL_ABI_EINVAL;
 
-  if (!NaClAclBypassChecks)
+  if (!NaClAclBypassChecks && NaClRootFolder == NULL)
     return -NACL_ABI_EACCES;
 
-  retval = CopyPathFromUser(nap, pathname, sizeof pathname, path);
+  retval = CopyHostPathFromUser(nap, pathname, sizeof pathname, path);
   if (0 != retval)
     return retval;
 
   if (times == 0)
     return -NACL_ABI_EACCES;
 
   /* TODO(sbc): implement in terms of NaClHost function. */
   return -NACL_ABI_ENOSYS;
 }