OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <sys/mman.h> | 8 #include <sys/mman.h> |
9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
(...skipping 26 matching lines...) Expand all Loading... |
37 SyscallSets::IsAllowedGettime(sysno) || | 37 SyscallSets::IsAllowedGettime(sysno) || |
38 SyscallSets::IsAllowedPrctl(sysno) || | 38 SyscallSets::IsAllowedPrctl(sysno) || |
39 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || | 39 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || |
40 SyscallSets::IsAllowedSignalHandling(sysno) || | 40 SyscallSets::IsAllowedSignalHandling(sysno) || |
41 SyscallSets::IsFutex(sysno) || | 41 SyscallSets::IsFutex(sysno) || |
42 SyscallSets::IsGetSimpleId(sysno) || | 42 SyscallSets::IsGetSimpleId(sysno) || |
43 SyscallSets::IsKernelInternalApi(sysno) || | 43 SyscallSets::IsKernelInternalApi(sysno) || |
44 #if defined(__arm__) | 44 #if defined(__arm__) |
45 SyscallSets::IsArmPrivate(sysno) || | 45 SyscallSets::IsArmPrivate(sysno) || |
46 #endif | 46 #endif |
| 47 #if defined(__mips__) |
| 48 SyscallSets::IsMipsPrivate(sysno) || |
| 49 #endif |
47 SyscallSets::IsAllowedOperationOnFd(sysno); | 50 SyscallSets::IsAllowedOperationOnFd(sysno); |
48 } | 51 } |
49 | 52 |
50 // System calls that will trigger the crashing SIGSYS handler. | 53 // System calls that will trigger the crashing SIGSYS handler. |
51 bool IsBaselinePolicyWatched(int sysno) { | 54 bool IsBaselinePolicyWatched(int sysno) { |
52 return SyscallSets::IsAdminOperation(sysno) || | 55 return SyscallSets::IsAdminOperation(sysno) || |
53 SyscallSets::IsAdvancedScheduler(sysno) || | 56 SyscallSets::IsAdvancedScheduler(sysno) || |
54 SyscallSets::IsAdvancedTimer(sysno) || | 57 SyscallSets::IsAdvancedTimer(sysno) || |
55 SyscallSets::IsAsyncIo(sysno) || | 58 SyscallSets::IsAsyncIo(sysno) || |
56 SyscallSets::IsDebug(sysno) || | 59 SyscallSets::IsDebug(sysno) || |
57 SyscallSets::IsEventFd(sysno) || | 60 SyscallSets::IsEventFd(sysno) || |
58 SyscallSets::IsExtendedAttributes(sysno) || | 61 SyscallSets::IsExtendedAttributes(sysno) || |
59 SyscallSets::IsFaNotify(sysno) || | 62 SyscallSets::IsFaNotify(sysno) || |
60 SyscallSets::IsFsControl(sysno) || | 63 SyscallSets::IsFsControl(sysno) || |
61 SyscallSets::IsGlobalFSViewChange(sysno) || | 64 SyscallSets::IsGlobalFSViewChange(sysno) || |
62 SyscallSets::IsGlobalProcessEnvironment(sysno) || | 65 SyscallSets::IsGlobalProcessEnvironment(sysno) || |
63 SyscallSets::IsGlobalSystemStatus(sysno) || | 66 SyscallSets::IsGlobalSystemStatus(sysno) || |
64 SyscallSets::IsInotify(sysno) || | 67 SyscallSets::IsInotify(sysno) || |
65 SyscallSets::IsKernelModule(sysno) || | 68 SyscallSets::IsKernelModule(sysno) || |
66 SyscallSets::IsKeyManagement(sysno) || | 69 SyscallSets::IsKeyManagement(sysno) || |
67 SyscallSets::IsKill(sysno) || | 70 SyscallSets::IsKill(sysno) || |
68 SyscallSets::IsMessageQueue(sysno) || | 71 SyscallSets::IsMessageQueue(sysno) || |
69 SyscallSets::IsMisc(sysno) || | 72 SyscallSets::IsMisc(sysno) || |
70 #if defined(__x86_64__) | 73 #if defined(__x86_64__) |
71 SyscallSets::IsNetworkSocketInformation(sysno) || | 74 SyscallSets::IsNetworkSocketInformation(sysno) || |
72 #endif | 75 #endif |
73 SyscallSets::IsNuma(sysno) || | 76 SyscallSets::IsNuma(sysno) || |
74 SyscallSets::IsProcessGroupOrSession(sysno) || | 77 SyscallSets::IsProcessGroupOrSession(sysno) || |
75 #if defined(__i386__) | 78 #if defined(__i386__) || defined(__mips__) |
76 SyscallSets::IsSocketCall(sysno) || | 79 SyscallSets::IsSocketCall(sysno) || |
77 #endif | 80 #endif |
78 #if defined(__arm__) | 81 #if defined(__arm__) |
79 SyscallSets::IsArmPciConfig(sysno) || | 82 SyscallSets::IsArmPciConfig(sysno) || |
80 #endif | 83 #endif |
| 84 #if defined(__mips__) |
| 85 SyscallSets::IsMipsMisc(sysno) || |
| 86 #endif |
81 SyscallSets::IsTimer(sysno); | 87 SyscallSets::IsTimer(sysno); |
82 } | 88 } |
83 | 89 |
84 // |fs_denied_errno| is the errno return for denied filesystem access. | 90 // |fs_denied_errno| is the errno return for denied filesystem access. |
85 ErrorCode EvaluateSyscallImpl(int fs_denied_errno, | 91 ErrorCode EvaluateSyscallImpl(int fs_denied_errno, |
86 pid_t current_pid, | 92 pid_t current_pid, |
87 SandboxBPF* sandbox, | 93 SandboxBPF* sandbox, |
88 int sysno) { | 94 int sysno) { |
89 #if defined(ADDRESS_SANITIZER) | 95 #if defined(ADDRESS_SANITIZER) |
90 if (sysno == __NR_sigaltstack) { | 96 if (sysno == __NR_sigaltstack) { |
91 // Required for better stack overflow detection in ASan. Disallowed in | 97 // Required for better stack overflow detection in ASan. Disallowed in |
92 // non-ASan builds. | 98 // non-ASan builds. |
93 return ErrorCode(ErrorCode::ERR_ALLOWED); | 99 return ErrorCode(ErrorCode::ERR_ALLOWED); |
94 } | 100 } |
95 #endif | 101 #endif |
96 if (IsBaselinePolicyAllowed(sysno)) { | 102 if (IsBaselinePolicyAllowed(sysno)) { |
97 return ErrorCode(ErrorCode::ERR_ALLOWED); | 103 return ErrorCode(ErrorCode::ERR_ALLOWED); |
98 } | 104 } |
99 | 105 |
100 if (sysno == __NR_clone) { | 106 if (sysno == __NR_clone) { |
101 return RestrictCloneToThreadsAndEPERMFork(sandbox); | 107 return RestrictCloneToThreadsAndEPERMFork(sandbox); |
102 } | 108 } |
103 | 109 |
104 #if defined(__x86_64__) || defined(__arm__) | 110 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__) |
105 if (sysno == __NR_socketpair) { | 111 if (sysno == __NR_socketpair) { |
106 // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen. | 112 // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen. |
107 COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different); | 113 COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different); |
108 return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX, | 114 return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX, |
109 ErrorCode(ErrorCode::ERR_ALLOWED), | 115 ErrorCode(ErrorCode::ERR_ALLOWED), |
110 sandbox->Trap(CrashSIGSYS_Handler, NULL)); | 116 sandbox->Trap(CrashSIGSYS_Handler, NULL)); |
111 } | 117 } |
112 #endif | 118 #endif |
113 | 119 |
114 if (sysno == __NR_madvise) { | 120 if (sysno == __NR_madvise) { |
115 // Only allow MADV_DONTNEED (aka MADV_FREE). | 121 // Only allow MADV_DONTNEED (aka MADV_FREE). |
116 return sandbox->Cond(2, ErrorCode::TP_32BIT, | 122 return sandbox->Cond(2, ErrorCode::TP_32BIT, |
117 ErrorCode::OP_EQUAL, MADV_DONTNEED, | 123 ErrorCode::OP_EQUAL, MADV_DONTNEED, |
118 ErrorCode(ErrorCode::ERR_ALLOWED), | 124 ErrorCode(ErrorCode::ERR_ALLOWED), |
119 ErrorCode(EPERM)); | 125 ErrorCode(EPERM)); |
120 } | 126 } |
121 | 127 |
122 #if defined(__i386__) || defined(__x86_64__) | 128 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) |
123 if (sysno == __NR_mmap) | 129 if (sysno == __NR_mmap) |
124 return RestrictMmapFlags(sandbox); | 130 return RestrictMmapFlags(sandbox); |
125 #endif | 131 #endif |
126 | 132 |
127 #if defined(__i386__) || defined(__arm__) | 133 #if defined(__i386__) || defined(__arm__) || defined(__mips__) |
128 if (sysno == __NR_mmap2) | 134 if (sysno == __NR_mmap2) |
129 return RestrictMmapFlags(sandbox); | 135 return RestrictMmapFlags(sandbox); |
130 #endif | 136 #endif |
131 | 137 |
132 if (sysno == __NR_mprotect) | 138 if (sysno == __NR_mprotect) |
133 return RestrictMprotectFlags(sandbox); | 139 return RestrictMprotectFlags(sandbox); |
134 | 140 |
135 if (sysno == __NR_fcntl) | 141 if (sysno == __NR_fcntl) |
136 return RestrictFcntlCommands(sandbox); | 142 return RestrictFcntlCommands(sandbox); |
137 | 143 |
138 #if defined(__i386__) || defined(__arm__) | 144 #if defined(__i386__) || defined(__arm__) || defined(__mips__) |
139 if (sysno == __NR_fcntl64) | 145 if (sysno == __NR_fcntl64) |
140 return RestrictFcntlCommands(sandbox); | 146 return RestrictFcntlCommands(sandbox); |
141 #endif | 147 #endif |
142 | 148 |
143 if (SyscallSets::IsKill(sysno)) { | 149 if (SyscallSets::IsKill(sysno)) { |
144 return RestrictKillTarget(current_pid, sandbox, sysno); | 150 return RestrictKillTarget(current_pid, sandbox, sysno); |
145 } | 151 } |
146 | 152 |
147 if (SyscallSets::IsFileSystem(sysno) || | 153 if (SyscallSets::IsFileSystem(sysno) || |
148 SyscallSets::IsCurrentDirectory(sysno)) { | 154 SyscallSets::IsCurrentDirectory(sysno)) { |
149 return ErrorCode(fs_denied_errno); | 155 return ErrorCode(fs_denied_errno); |
150 } | 156 } |
151 | 157 |
152 if (SyscallSets::IsAnySystemV(sysno)) { | 158 if (SyscallSets::IsAnySystemV(sysno)) { |
153 return ErrorCode(EPERM); | 159 return ErrorCode(EPERM); |
154 } | 160 } |
155 | 161 |
156 if (SyscallSets::IsUmask(sysno) || | 162 if (SyscallSets::IsUmask(sysno) || |
157 SyscallSets::IsDeniedFileSystemAccessViaFd(sysno) || | 163 SyscallSets::IsDeniedFileSystemAccessViaFd(sysno) || |
158 SyscallSets::IsDeniedGetOrModifySocket(sysno) || | 164 SyscallSets::IsDeniedGetOrModifySocket(sysno) || |
159 SyscallSets::IsProcessPrivilegeChange(sysno)) { | 165 SyscallSets::IsProcessPrivilegeChange(sysno)) { |
160 return ErrorCode(EPERM); | 166 return ErrorCode(EPERM); |
161 } | 167 } |
162 | 168 |
163 #if defined(__i386__) | 169 #if defined(__i386__) || defined(__mips__) |
164 if (SyscallSets::IsSocketCall(sysno)) | 170 if (SyscallSets::IsSocketCall(sysno)) |
165 return RestrictSocketcallCommand(sandbox); | 171 return RestrictSocketcallCommand(sandbox); |
166 #endif | 172 #endif |
167 | 173 |
168 if (IsBaselinePolicyWatched(sysno)) { | 174 if (IsBaselinePolicyWatched(sysno)) { |
169 // Previously unseen syscalls. TODO(jln): some of these should | 175 // Previously unseen syscalls. TODO(jln): some of these should |
170 // be denied gracefully right away. | 176 // be denied gracefully right away. |
171 return sandbox->Trap(CrashSIGSYS_Handler, NULL); | 177 return sandbox->Trap(CrashSIGSYS_Handler, NULL); |
172 } | 178 } |
173 | 179 |
(...skipping 20 matching lines...) Expand all Loading... |
194 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, | 200 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, |
195 int sysno) const { | 201 int sysno) const { |
196 // Make sure that this policy is used in the creating process. | 202 // Make sure that this policy is used in the creating process. |
197 if (1 == sysno) { | 203 if (1 == sysno) { |
198 DCHECK_EQ(syscall(__NR_getpid), current_pid_); | 204 DCHECK_EQ(syscall(__NR_getpid), current_pid_); |
199 } | 205 } |
200 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); | 206 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); |
201 } | 207 } |
202 | 208 |
203 } // namespace sandbox. | 209 } // namespace sandbox. |
OLD | NEW |