OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <sys/mman.h> | 8 #include <sys/mman.h> |
9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
(...skipping 26 matching lines...) Expand all Loading... |
37 SyscallSets::IsAllowedGettime(sysno) || | 37 SyscallSets::IsAllowedGettime(sysno) || |
38 SyscallSets::IsAllowedPrctl(sysno) || | 38 SyscallSets::IsAllowedPrctl(sysno) || |
39 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || | 39 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || |
40 SyscallSets::IsAllowedSignalHandling(sysno) || | 40 SyscallSets::IsAllowedSignalHandling(sysno) || |
41 SyscallSets::IsFutex(sysno) || | 41 SyscallSets::IsFutex(sysno) || |
42 SyscallSets::IsGetSimpleId(sysno) || | 42 SyscallSets::IsGetSimpleId(sysno) || |
43 SyscallSets::IsKernelInternalApi(sysno) || | 43 SyscallSets::IsKernelInternalApi(sysno) || |
44 #if defined(__arm__) | 44 #if defined(__arm__) |
45 SyscallSets::IsArmPrivate(sysno) || | 45 SyscallSets::IsArmPrivate(sysno) || |
46 #endif | 46 #endif |
| 47 #if defined(__mips__) |
| 48 SyscallSets::IsMipsPrivate(sysno) || |
| 49 #endif |
47 SyscallSets::IsAllowedOperationOnFd(sysno); | 50 SyscallSets::IsAllowedOperationOnFd(sysno); |
48 } | 51 } |
49 | 52 |
50 // System calls that will trigger the crashing SIGSYS handler. | 53 // System calls that will trigger the crashing SIGSYS handler. |
51 bool IsBaselinePolicyWatched(int sysno) { | 54 bool IsBaselinePolicyWatched(int sysno) { |
52 return SyscallSets::IsAdminOperation(sysno) || | 55 return SyscallSets::IsAdminOperation(sysno) || |
53 SyscallSets::IsAdvancedScheduler(sysno) || | 56 SyscallSets::IsAdvancedScheduler(sysno) || |
54 SyscallSets::IsAdvancedTimer(sysno) || | 57 SyscallSets::IsAdvancedTimer(sysno) || |
55 SyscallSets::IsAsyncIo(sysno) || | 58 SyscallSets::IsAsyncIo(sysno) || |
56 SyscallSets::IsDebug(sysno) || | 59 SyscallSets::IsDebug(sysno) || |
57 SyscallSets::IsEventFd(sysno) || | 60 SyscallSets::IsEventFd(sysno) || |
58 SyscallSets::IsExtendedAttributes(sysno) || | 61 SyscallSets::IsExtendedAttributes(sysno) || |
59 SyscallSets::IsFaNotify(sysno) || | 62 SyscallSets::IsFaNotify(sysno) || |
60 SyscallSets::IsFsControl(sysno) || | 63 SyscallSets::IsFsControl(sysno) || |
61 SyscallSets::IsGlobalFSViewChange(sysno) || | 64 SyscallSets::IsGlobalFSViewChange(sysno) || |
62 SyscallSets::IsGlobalProcessEnvironment(sysno) || | 65 SyscallSets::IsGlobalProcessEnvironment(sysno) || |
63 SyscallSets::IsGlobalSystemStatus(sysno) || | 66 SyscallSets::IsGlobalSystemStatus(sysno) || |
64 SyscallSets::IsInotify(sysno) || | 67 SyscallSets::IsInotify(sysno) || |
65 SyscallSets::IsKernelModule(sysno) || | 68 SyscallSets::IsKernelModule(sysno) || |
66 SyscallSets::IsKeyManagement(sysno) || | 69 SyscallSets::IsKeyManagement(sysno) || |
67 SyscallSets::IsKill(sysno) || | 70 SyscallSets::IsKill(sysno) || |
68 SyscallSets::IsMessageQueue(sysno) || | 71 SyscallSets::IsMessageQueue(sysno) || |
69 SyscallSets::IsMisc(sysno) || | 72 SyscallSets::IsMisc(sysno) || |
70 #if defined(__x86_64__) | 73 #if defined(__x86_64__) |
71 SyscallSets::IsNetworkSocketInformation(sysno) || | 74 SyscallSets::IsNetworkSocketInformation(sysno) || |
72 #endif | 75 #endif |
73 SyscallSets::IsNuma(sysno) || | 76 SyscallSets::IsNuma(sysno) || |
74 SyscallSets::IsProcessGroupOrSession(sysno) || | 77 SyscallSets::IsProcessGroupOrSession(sysno) || |
75 #if defined(__i386__) | 78 #if defined(__i386__) || defined(__mips__) |
76 SyscallSets::IsSocketCall(sysno) || | 79 SyscallSets::IsSocketCall(sysno) || |
77 #endif | 80 #endif |
78 #if defined(__arm__) | 81 #if defined(__arm__) |
79 SyscallSets::IsArmPciConfig(sysno) || | 82 SyscallSets::IsArmPciConfig(sysno) || |
80 #endif | 83 #endif |
| 84 #if defined(__mips__) |
| 85 SyscallSets::IsMipsMisc(sysno) || |
| 86 #endif |
81 SyscallSets::IsTimer(sysno); | 87 SyscallSets::IsTimer(sysno); |
82 } | 88 } |
83 | 89 |
84 // |fs_denied_errno| is the errno return for denied filesystem access. | 90 // |fs_denied_errno| is the errno return for denied filesystem access. |
85 ErrorCode EvaluateSyscallImpl(int fs_denied_errno, | 91 ErrorCode EvaluateSyscallImpl(int fs_denied_errno, |
86 pid_t current_pid, | 92 pid_t current_pid, |
87 SandboxBPF* sandbox, | 93 SandboxBPF* sandbox, |
88 int sysno) { | 94 int sysno) { |
89 #if defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER) || \ | 95 #if defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER) || \ |
90 defined(MEMORY_SANITIZER) | 96 defined(MEMORY_SANITIZER) |
(...skipping 18 matching lines...) Expand all Loading... |
109 return ErrorCode(ErrorCode::ERR_ALLOWED); | 115 return ErrorCode(ErrorCode::ERR_ALLOWED); |
110 } | 116 } |
111 | 117 |
112 if (sysno == __NR_clone) { | 118 if (sysno == __NR_clone) { |
113 return RestrictCloneToThreadsAndEPERMFork(sandbox); | 119 return RestrictCloneToThreadsAndEPERMFork(sandbox); |
114 } | 120 } |
115 | 121 |
116 if (sysno == __NR_fcntl) | 122 if (sysno == __NR_fcntl) |
117 return RestrictFcntlCommands(sandbox); | 123 return RestrictFcntlCommands(sandbox); |
118 | 124 |
119 #if defined(__i386__) || defined(__arm__) | 125 #if defined(__i386__) || defined(__arm__) || defined(__mips__) |
120 if (sysno == __NR_fcntl64) | 126 if (sysno == __NR_fcntl64) |
121 return RestrictFcntlCommands(sandbox); | 127 return RestrictFcntlCommands(sandbox); |
122 #endif | 128 #endif |
123 | 129 |
124 if (sysno == __NR_madvise) { | 130 if (sysno == __NR_madvise) { |
125 // Only allow MADV_DONTNEED (aka MADV_FREE). | 131 // Only allow MADV_DONTNEED (aka MADV_FREE). |
126 return sandbox->Cond(2, ErrorCode::TP_32BIT, | 132 return sandbox->Cond(2, ErrorCode::TP_32BIT, |
127 ErrorCode::OP_EQUAL, MADV_DONTNEED, | 133 ErrorCode::OP_EQUAL, MADV_DONTNEED, |
128 ErrorCode(ErrorCode::ERR_ALLOWED), | 134 ErrorCode(ErrorCode::ERR_ALLOWED), |
129 ErrorCode(EPERM)); | 135 ErrorCode(EPERM)); |
130 } | 136 } |
131 | 137 |
132 #if defined(__i386__) || defined(__x86_64__) | 138 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) |
133 if (sysno == __NR_mmap) | 139 if (sysno == __NR_mmap) |
134 return RestrictMmapFlags(sandbox); | 140 return RestrictMmapFlags(sandbox); |
135 #endif | 141 #endif |
136 | 142 |
137 #if defined(__i386__) || defined(__arm__) | 143 #if defined(__i386__) || defined(__arm__) || defined(__mips__) |
138 if (sysno == __NR_mmap2) | 144 if (sysno == __NR_mmap2) |
139 return RestrictMmapFlags(sandbox); | 145 return RestrictMmapFlags(sandbox); |
140 #endif | 146 #endif |
141 | 147 |
142 if (sysno == __NR_mprotect) | 148 if (sysno == __NR_mprotect) |
143 return RestrictMprotectFlags(sandbox); | 149 return RestrictMprotectFlags(sandbox); |
144 | 150 |
145 #if defined(__x86_64__) || defined(__arm__) | 151 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__) |
146 if (sysno == __NR_socketpair) { | 152 if (sysno == __NR_socketpair) { |
147 // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen. | 153 // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen. |
148 COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different); | 154 COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different); |
149 return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX, | 155 return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX, |
150 ErrorCode(ErrorCode::ERR_ALLOWED), | 156 ErrorCode(ErrorCode::ERR_ALLOWED), |
151 sandbox->Trap(CrashSIGSYS_Handler, NULL)); | 157 sandbox->Trap(CrashSIGSYS_Handler, NULL)); |
152 } | 158 } |
153 #endif | 159 #endif |
154 | 160 |
155 if (SyscallSets::IsKill(sysno)) { | 161 if (SyscallSets::IsKill(sysno)) { |
156 return RestrictKillTarget(current_pid, sandbox, sysno); | 162 return RestrictKillTarget(current_pid, sandbox, sysno); |
157 } | 163 } |
158 | 164 |
159 if (SyscallSets::IsFileSystem(sysno) || | 165 if (SyscallSets::IsFileSystem(sysno) || |
160 SyscallSets::IsCurrentDirectory(sysno)) { | 166 SyscallSets::IsCurrentDirectory(sysno)) { |
161 return ErrorCode(fs_denied_errno); | 167 return ErrorCode(fs_denied_errno); |
162 } | 168 } |
163 | 169 |
164 if (SyscallSets::IsAnySystemV(sysno)) { | 170 if (SyscallSets::IsAnySystemV(sysno)) { |
165 return ErrorCode(EPERM); | 171 return ErrorCode(EPERM); |
166 } | 172 } |
167 | 173 |
168 if (SyscallSets::IsUmask(sysno) || | 174 if (SyscallSets::IsUmask(sysno) || |
169 SyscallSets::IsDeniedFileSystemAccessViaFd(sysno) || | 175 SyscallSets::IsDeniedFileSystemAccessViaFd(sysno) || |
170 SyscallSets::IsDeniedGetOrModifySocket(sysno) || | 176 SyscallSets::IsDeniedGetOrModifySocket(sysno) || |
171 SyscallSets::IsProcessPrivilegeChange(sysno)) { | 177 SyscallSets::IsProcessPrivilegeChange(sysno)) { |
172 return ErrorCode(EPERM); | 178 return ErrorCode(EPERM); |
173 } | 179 } |
174 | 180 |
175 #if defined(__i386__) | 181 #if defined(__i386__) || defined(__mips__) |
176 if (SyscallSets::IsSocketCall(sysno)) | 182 if (SyscallSets::IsSocketCall(sysno)) |
177 return RestrictSocketcallCommand(sandbox); | 183 return RestrictSocketcallCommand(sandbox); |
178 #endif | 184 #endif |
179 | 185 |
180 if (IsBaselinePolicyWatched(sysno)) { | 186 if (IsBaselinePolicyWatched(sysno)) { |
181 // Previously unseen syscalls. TODO(jln): some of these should | 187 // Previously unseen syscalls. TODO(jln): some of these should |
182 // be denied gracefully right away. | 188 // be denied gracefully right away. |
183 return sandbox->Trap(CrashSIGSYS_Handler, NULL); | 189 return sandbox->Trap(CrashSIGSYS_Handler, NULL); |
184 } | 190 } |
185 | 191 |
(...skipping 20 matching lines...) Expand all Loading... |
206 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, | 212 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, |
207 int sysno) const { | 213 int sysno) const { |
208 // Make sure that this policy is used in the creating process. | 214 // Make sure that this policy is used in the creating process. |
209 if (1 == sysno) { | 215 if (1 == sysno) { |
210 DCHECK_EQ(syscall(__NR_getpid), current_pid_); | 216 DCHECK_EQ(syscall(__NR_getpid), current_pid_); |
211 } | 217 } |
212 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); | 218 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); |
213 } | 219 } |
214 | 220 |
215 } // namespace sandbox. | 221 } // namespace sandbox. |
OLD | NEW |