Index: sandbox/linux/seccomp/sandbox.cc |
=================================================================== |
--- sandbox/linux/seccomp/sandbox.cc (revision 57969) |
+++ sandbox/linux/seccomp/sandbox.cc (working copy) |
@@ -1,838 +0,0 @@ |
-// Copyright (c) 2010 The Chromium Authors. All rights reserved. |
-// Use of this source code is governed by a BSD-style license that can be |
-// found in the LICENSE file. |
- |
-#include "library.h" |
-#include "sandbox_impl.h" |
-#include "syscall_table.h" |
- |
-namespace playground { |
- |
-// Global variables |
-int Sandbox::proc_self_maps_ = -1; |
-enum Sandbox::SandboxStatus Sandbox::status_ = STATUS_UNKNOWN; |
-int Sandbox::pid_; |
-int Sandbox::processFdPub_; |
-int Sandbox::cloneFdPub_; |
-Sandbox::SysCalls::kernel_sigaction Sandbox::sa_segv_; |
-Sandbox::ProtectedMap Sandbox::protectedMap_; |
-std::vector<SecureMem::Args*> Sandbox::secureMemPool_; |
- |
-bool Sandbox::sendFd(int transport, int fd0, int fd1, const void* buf, |
- size_t len) { |
- int fds[2], count = 0; |
- if (fd0 >= 0) { fds[count++] = fd0; } |
- if (fd1 >= 0) { fds[count++] = fd1; } |
- if (!count) { |
- return false; |
- } |
- char cmsg_buf[CMSG_SPACE(count*sizeof(int))]; |
- memset(cmsg_buf, 0, sizeof(cmsg_buf)); |
- struct SysCalls::kernel_iovec iov[2] = { { 0 } }; |
- struct SysCalls::kernel_msghdr msg = { 0 }; |
- int dummy = 0; |
- iov[0].iov_base = &dummy; |
- iov[0].iov_len = sizeof(dummy); |
- if (buf && len > 0) { |
- iov[1].iov_base = const_cast<void *>(buf); |
- iov[1].iov_len = len; |
- } |
- msg.msg_iov = iov; |
- msg.msg_iovlen = (buf && len > 0) ? 2 : 1; |
- msg.msg_control = cmsg_buf; |
- msg.msg_controllen = CMSG_LEN(count*sizeof(int)); |
- struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); |
- cmsg->cmsg_level = SOL_SOCKET; |
- cmsg->cmsg_type = SCM_RIGHTS; |
- cmsg->cmsg_len = CMSG_LEN(count*sizeof(int)); |
- memcpy(CMSG_DATA(cmsg), fds, count*sizeof(int)); |
- SysCalls sys; |
- return NOINTR_SYS(sys.sendmsg(transport, &msg, 0)) == |
- (ssize_t)(sizeof(dummy) + ((buf && len > 0) ? len : 0)); |
-} |
- |
-bool Sandbox::getFd(int transport, int* fd0, int* fd1, void* buf, size_t*len) { |
- int count = 0; |
- int *err = NULL; |
- if (fd0) { |
- count++; |
- err = fd0; |
- *fd0 = -1; |
- } |
- if (fd1) { |
- if (!count++) { |
- err = fd1; |
- } |
- *fd1 = -1; |
- } |
- if (!count) { |
- return false; |
- } |
- char cmsg_buf[CMSG_SPACE(count*sizeof(int))]; |
- memset(cmsg_buf, 0, sizeof(cmsg_buf)); |
- struct SysCalls::kernel_iovec iov[2] = { { 0 } }; |
- struct SysCalls::kernel_msghdr msg = { 0 }; |
- iov[0].iov_base = err; |
- iov[0].iov_len = sizeof(int); |
- if (buf && len && *len > 0) { |
- iov[1].iov_base = buf; |
- iov[1].iov_len = *len; |
- } |
- msg.msg_iov = iov; |
- msg.msg_iovlen = (buf && len && *len > 0) ? 2 : 1; |
- msg.msg_control = cmsg_buf; |
- msg.msg_controllen = CMSG_LEN(count*sizeof(int)); |
- SysCalls sys; |
- ssize_t bytes = NOINTR_SYS(sys.recvmsg(transport, &msg, 0)); |
- if (len) { |
- *len = bytes > (int)sizeof(int) ? |
- bytes - sizeof(int) : 0; |
- } |
- if (bytes != (ssize_t)(sizeof(int) + ((buf && len && *len > 0) ? *len : 0))){ |
- *err = bytes >= 0 ? 0 : -EBADF; |
- return false; |
- } |
- if (*err) { |
- // "err" is the first four bytes of the payload. If these are non-zero, |
- // the sender on the other side of the socketpair sent us an errno value. |
- // We don't expect to get any file handles in this case. |
- return false; |
- } |
- struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); |
- if ((msg.msg_flags & (MSG_TRUNC|MSG_CTRUNC)) || |
- !cmsg || |
- cmsg->cmsg_level != SOL_SOCKET || |
- cmsg->cmsg_type != SCM_RIGHTS || |
- cmsg->cmsg_len != CMSG_LEN(count*sizeof(int))) { |
- *err = -EBADF; |
- return false; |
- } |
- if (fd1) { *fd1 = ((int *)CMSG_DATA(cmsg))[--count]; } |
- if (fd0) { *fd0 = ((int *)CMSG_DATA(cmsg))[--count]; } |
- return true; |
-} |
- |
-void Sandbox::setupSignalHandlers() { |
- // Set SIGCHLD to SIG_DFL so that waitpid() can work |
- SysCalls sys; |
- struct SysCalls::kernel_sigaction sa; |
- memset(&sa, 0, sizeof(sa)); |
- sa.sa_handler_ = SIG_DFL; |
- sys.sigaction(SIGCHLD, &sa, NULL); |
- |
- // Set up SEGV handler for dealing with RDTSC instructions, system calls |
- // that have been rewritten to use INT0, for sigprocmask() emulation, for |
- // the creation of threads, and for user-provided SEGV handlers. |
- sa.sa_sigaction_ = segv(); |
- sa.sa_flags = SA_SIGINFO | SA_NODEFER; |
- sys.sigaction(SIGSEGV, &sa, &sa_segv_); |
- |
- // Unblock SIGSEGV and SIGCHLD |
- SysCalls::kernel_sigset_t mask; |
- memset(&mask, 0x00, sizeof(mask)); |
- mask.sig[0] |= (1 << (SIGSEGV - 1)) | (1 << (SIGCHLD - 1)); |
- sys.sigprocmask(SIG_UNBLOCK, &mask, 0); |
-} |
- |
-void (*Sandbox::segv())(int signo, SysCalls::siginfo *context, void *unused) { |
- void (*fnc)(int signo, SysCalls::siginfo *context, void *unused); |
- asm volatile( |
- "call 999f\n" |
-#if defined(__x86_64__) |
- // Inspect instruction at the point where the segmentation fault |
- // happened. If it is RDTSC, forward the request to the trusted |
- // thread. |
- "mov $-3, %%r14\n" // request for RDTSC |
- "mov 0xB0(%%rsp), %%r15\n" // %rip at time of segmentation fault |
- "cmpw $0x310F, (%%r15)\n" // RDTSC |
- "jz 0f\n" |
- "cmpw $0x010F, (%%r15)\n" // RDTSCP |
- "jnz 8f\n" |
- "cmpb $0xF9, 2(%%r15)\n" |
- "jnz 8f\n" |
- "mov $-4, %%r14\n" // request for RDTSCP |
- "0:" |
-#ifndef NDEBUG |
- "lea 100f(%%rip), %%rdi\n" |
- "call playground$debugMessage\n" |
-#endif |
- "sub $4, %%rsp\n" |
- "push %%r14\n" |
- "mov %%gs:16, %%edi\n" // fd = threadFdPub |
- "mov %%rsp, %%rsi\n" // buf = %rsp |
- "mov $4, %%edx\n" // len = sizeof(int) |
- "1:mov $1, %%eax\n" // NR_write |
- "syscall\n" |
- "cmp %%rax, %%rdx\n" |
- "jz 5f\n" |
- "cmp $-4, %%eax\n" // EINTR |
- "jz 1b\n" |
- "2:add $12, %%rsp\n" |
- "movq $0, 0x98(%%rsp)\n" // %rax at time of segmentation fault |
- "movq $0, 0x90(%%rsp)\n" // %rdx at time of segmentation fault |
- "cmpw $0x310F, (%%r15)\n" // RDTSC |
- "jz 3f\n" |
- "movq $0, 0xA0(%%rsp)\n" // %rcx at time of segmentation fault |
- "3:addq $2, 0xB0(%%rsp)\n" // %rip at time of segmentation fault |
- "cmpw $0x010F, (%%r15)\n" // RDTSC |
- "jnz 4f\n" |
- "addq $1, 0xB0(%%rsp)\n" // %rip at time of segmentation fault |
- "4:ret\n" |
- "5:mov $12, %%edx\n" // len = 3*sizeof(int) |
- "6:mov $0, %%eax\n" // NR_read |
- "syscall\n" |
- "cmp $-4, %%eax\n" // EINTR |
- "jz 6b\n" |
- "cmp %%rax, %%rdx\n" |
- "jnz 2b\n" |
- "mov 0(%%rsp), %%eax\n" |
- "mov 4(%%rsp), %%edx\n" |
- "mov 8(%%rsp), %%ecx\n" |
- "add $12, %%rsp\n" |
- "mov %%rdx, 0x90(%%rsp)\n" // %rdx at time of segmentation fault |
- "cmpw $0x310F, (%%r15)\n" // RDTSC |
- "jz 7f\n" |
- "mov %%rcx, 0xA0(%%rsp)\n" // %rcx at time of segmentation fault |
- "7:mov %%rax, 0x98(%%rsp)\n" // %rax at time of segmentation fault |
- "jmp 3b\n" |
- |
- // If the instruction is INT 0, then this was probably the result |
- // of playground::Library being unable to find a way to safely |
- // rewrite the system call instruction. Retrieve the CPU register |
- // at the time of the segmentation fault and invoke syscallWrapper(). |
- "8:cmpw $0x00CD, (%%r15)\n" // INT $0x0 |
- "jnz 16f\n" |
-#ifndef NDEBUG |
- "lea 200f(%%rip), %%rdi\n" |
- "call playground$debugMessage\n" |
-#endif |
- "mov 0x98(%%rsp), %%rax\n" // %rax at time of segmentation fault |
- "mov 0x70(%%rsp), %%rdi\n" // %rdi at time of segmentation fault |
- "mov 0x78(%%rsp), %%rsi\n" // %rsi at time of segmentation fault |
- "mov 0x90(%%rsp), %%rdx\n" // %rdx at time of segmentation fault |
- "mov 0x40(%%rsp), %%r10\n" // %r10 at time of segmentation fault |
- "mov 0x30(%%rsp), %%r8\n" // %r8 at time of segmentation fault |
- "mov 0x38(%%rsp), %%r9\n" // %r9 at time of segmentation fault |
- |
- // Handle rt_sigprocmask() |
- "cmp $14, %%rax\n" // NR_rt_sigprocmask |
- "jnz 12f\n" |
- "mov $-22, %%rax\n" // -EINVAL |
- "cmp $8, %%r10\n" // %r10 = sigsetsize (8 bytes = 64 signals) |
- "jl 7b\n" |
- "mov 0x130(%%rsp), %%r10\n" // signal mask at time of segmentation fault |
- "test %%rsi, %%rsi\n" // only set mask, if set is non-NULL |
- "jz 11f\n" |
- "mov 0(%%rsi), %%rsi\n" |
- "cmp $0, %%rdi\n" // %rdi = how (SIG_BLOCK) |
- "jnz 9f\n" |
- "or %%rsi, 0x130(%%rsp)\n" // signal mask at time of segmentation fault |
- "jmp 11f\n" |
- "9:cmp $1, %%rdi\n" // %rdi = how (SIG_UNBLOCK) |
- "jnz 10f\n" |
- "xor $-1, %%rsi\n" |
- "and %%rsi, 0x130(%%rsp)\n" // signal mask at time of segmentation fault |
- "jmp 11f\n" |
- "10:cmp $2, %%rdi\n" // %rdi = how (SIG_SETMASK) |
- "jnz 7b\n" |
- "mov %%rsi, 0x130(%%rsp)\n" // signal mask at time of segmentation fault |
- "11:xor %%rax, %%rax\n" |
- "test %%rdx, %%rdx\n" // only return old mask, if set is non-NULL |
- "jz 7b\n" |
- "mov %%r10, 0(%%rdx)\n" // old_set |
- "jmp 7b\n" |
- |
- // Handle rt_sigreturn() |
- "12:cmp $15, %%rax\n" // NR_rt_sigreturn |
- "jnz 14f\n" |
- "mov 0xA8(%%rsp), %%rsp\n" // %rsp at time of segmentation fault |
- "13:syscall\n" // rt_sigreturn() is unrestricted |
- "mov $66, %%edi\n" // rt_sigreturn() should never return |
- "mov $231, %%eax\n" // NR_exit_group |
- "jmp 13b\n" |
- |
- // Copy signal frame onto new stack. See clone.cc for details |
- "14:cmp $56+0xF000, %%rax\n" // NR_clone + 0xF000 |
- "jnz 15f\n" |
- "lea 8(%%rsp), %%rax\n" // retain stack frame upon returning |
- "mov %%rax, 0xA8(%%rsp)\n" // %rsp at time of segmentation fault |
- "jmp 7b\n" |
- |
- // Forward system call to syscallWrapper() |
- "15:lea 7b(%%rip), %%rcx\n" |
- "push %%rcx\n" |
- "push 0xB8(%%rsp)\n" // %rip at time of segmentation fault |
- "lea playground$syscallWrapper(%%rip), %%rcx\n" |
- "jmp *%%rcx\n" |
- |
- // In order to implement SA_NODEFER, we have to keep track of recursive |
- // calls to SIGSEGV handlers. This means we have to increment a counter |
- // before calling the user's signal handler, and decrement it on |
- // leaving the user's signal handler. |
- // Some signal handlers look at the return address of the signal |
- // stack, and more importantly "gdb" uses the call to rt_sigreturn() |
- // as a magic signature when doing stacktraces. So, we have to use |
- // a little more unusual code to regain control after the user's |
- // signal handler is done. We adjust the return address to point to |
- // non-executable memory. And when we trigger another SEGV we pop the |
- // extraneous signal frame and then call rt_sigreturn(). |
- // N.B. We currently do not correctly adjust the SEGV counter, if the |
- // user's signal handler exits in way other than by returning (e.g. by |
- // directly calling rt_sigreturn(), or by calling siglongjmp()). |
- "16:lea 22f(%%rip), %%r14\n" |
- "cmp %%r14, %%r15\n" |
- "jnz 17f\n" // check if returning from user's handler |
- "decl %%gs:0x105C-0xE0\n" // decrement SEGV recursion counter |
- "mov 0xA8(%%rsp), %%rsp\n" // %rsp at time of segmentation fault |
- "mov $0xF, %%eax\n" // NR_rt_sigreturn |
- "syscall\n" |
- |
- // This was a genuine segmentation fault. Check Sandbox::sa_segv_ for |
- // what we are supposed to do. |
- "17:mov playground$sa_segv@GOTPCREL(%%rip), %%rax\n" |
- "cmp $0, 0(%%rax)\n" // SIG_DFL |
- "jz 18f\n" |
- "cmp $1, 0(%%rax)\n" // SIG_IGN |
- "jnz 19f\n" // can't really ignore synchronous signals |
- |
- // Trigger the kernel's default signal disposition. The only way we can |
- // do this from seccomp mode is by blocking the signal and retriggering |
- // it. |
- "18:orb $4, 0x131(%%rsp)\n" // signal mask at time of segmentation fault |
- "ret\n" |
- |
- // Check sa_flags: |
- // - We can ignore SA_NOCLDSTOP, SA_NOCLDWAIT, and SA_RESTART as they |
- // do not have any effect for SIGSEGV. |
- // - On x86-64, we can also ignore SA_SIGINFO, as the calling |
- // conventions for sa_handler() are a subset of the conventions for |
- // sa_sigaction(). |
- // - We have to always register our signal handler with SA_NODEFER so |
- // that the user's signal handler can make system calls which might |
- // require additional help from our SEGV handler. |
- // - If the user's signal handler wasn't supposed to be SA_NODEFER, then |
- // we emulate this behavior by keeping track of a recursion counter. |
- // |
- // TODO(markus): If/when we add support for sigaltstack(), we have to |
- // handle SA_ONSTACK. |
- "19:cmpl $0, %%gs:0x105C-0xE0\n"// check if we failed inside of SEGV handler |
- "jnz 18b\n" // if so, then terminate program |
- "mov 0(%%rax), %%rbx\n" // sa_segv_.sa_sigaction |
- "mov 8(%%rax), %%rcx\n" // sa_segv_.sa_flags |
- "btl $31, %%ecx\n" // SA_RESETHAND |
- "jnc 20f\n" |
- "movq $0, 0(%%rax)\n" // set handler to SIG_DFL |
- "20:btl $30, %%ecx\n" // SA_NODEFER |
- "jc 21f\n" |
- "mov %%r14, 0(%%rsp)\n" // trigger a SEGV on return, so that we can |
- "incl %%gs:0x105C-0xE0\n" // clean up state; incr. recursion counter |
- "21:jmp *%%rbx\n" // call user's signal handler |
- |
- |
- // Non-executable version of the restorer function. We use this to |
- // trigger a SEGV upon returning from the user's signal handler, giving |
- // us an ability to clean up prior to returning from the SEGV handler. |
- ".pushsection .data\n" // move code into non-executable section |
- "22:mov $0xF, %%rax\n" // gdb looks for this signature when doing |
- "syscall\n" // backtraces |
- ".popsection\n" |
-#elif defined(__i386__) |
- // Inspect instruction at the point where the segmentation fault |
- // happened. If it is RDTSC, forward the request to the trusted |
- // thread. |
- "mov $-3, %%ebx\n" // request for RDTSC |
- "mov 0xDC(%%esp), %%ebp\n" // %eip at time of segmentation fault |
- "cmpw $0x310F, (%%ebp)\n" // RDTSC |
- "jz 0f\n" |
- "cmpw $0x010F, (%%ebp)\n" // RDTSCP |
- "jnz 9f\n" |
- "cmpb $0xF9, 2(%%ebp)\n" |
- "jnz 9f\n" |
- "mov $-4, %%ebx\n" // request for RDTSCP |
- "0:" |
-#ifndef NDEBUG |
- "lea 100f, %%eax\n" |
- "push %%eax\n" |
- "call playground$debugMessage\n" |
- "sub $4, %%esp\n" |
-#else |
- "sub $8, %%esp\n" // allocate buffer for receiving timestamp |
-#endif |
- "push %%ebx\n" |
- "mov %%fs:16, %%ebx\n" // fd = threadFdPub |
- "mov %%esp, %%ecx\n" // buf = %esp |
- "mov $4, %%edx\n" // len = sizeof(int) |
- "1:mov %%edx, %%eax\n" // NR_write |
- "int $0x80\n" |
- "cmp %%eax, %%edx\n" |
- "jz 7f\n" |
- "cmp $-4, %%eax\n" // EINTR |
- "jz 1b\n" |
- "2:add $12, %%esp\n" // remove temporary buffer from stack |
- "xor %%eax, %%eax\n" |
- "movl $0, 0xC8(%%esp)\n" // %edx at time of segmentation fault |
- "cmpw $0x310F, (%%ebp)\n" // RDTSC |
- "jz 3f\n" |
- "movl $0, 0xCC(%%esp)\n" // %ecx at time of segmentation fault |
- "3:mov %%eax, 0xD0(%%esp)\n" // %eax at time of segmentation fault |
- "4:mov 0xDC(%%esp), %%ebp\n" // %eip at time of segmentation fault |
- "addl $2, 0xDC(%%esp)\n" // %eip at time of segmentation fault |
- "cmpw $0x010F, (%%ebp)\n" // RDTSCP |
- "jnz 5f\n" |
- "addl $1, 0xDC(%%esp)\n" // %eip at time of segmentation fault |
- "5:sub $0x1C8, %%esp\n" // a legacy signal stack is much larger |
- "mov 0x1CC(%%esp), %%eax\n" // push signal number |
- "push %%eax\n" |
- "lea 0x270(%%esp), %%esi\n" // copy siginfo register values |
- "lea 0x4(%%esp), %%edi\n" // into new location |
- "mov $22, %%ecx\n" |
- "cld\n" |
- "rep movsl\n" |
- "mov 0x2C8(%%esp), %%ebx\n" // copy first half of signal mask |
- "mov %%ebx, 0x54(%%esp)\n" |
- "lea 6f, %%esi\n" // copy "magic" restorer function |
- "push %%esi\n" // push restorer function |
- "lea 0x2D4(%%esp), %%edi\n" // patch up retcode magic numbers |
- "movb $2, %%cl\n" |
- "rep movsl\n" |
- "ret\n" // return to restorer function |
- |
- // The restorer function is sometimes used by gdb as a magic marker to |
- // recognize signal stack frames. Don't change any of the next three |
- // instructions. |
- "6:pop %%eax\n" // remove dummy argument (signo) |
- "mov $119, %%eax\n" // NR_sigreturn |
- "int $0x80\n" |
- "7:mov $12, %%edx\n" // len = 3*sizeof(int) |
- "8:mov $3, %%eax\n" // NR_read |
- "int $0x80\n" |
- "cmp $-4, %%eax\n" // EINTR |
- "jz 8b\n" |
- "cmp %%eax, %%edx\n" |
- "jnz 2b\n" |
- "pop %%eax\n" |
- "pop %%edx\n" |
- "pop %%ecx\n" |
- "mov %%edx, 0xC8(%%esp)\n" // %edx at time of segmentation fault |
- "cmpw $0x310F, (%%ebp)\n" // RDTSC |
- "jz 3b\n" |
- "mov %%ecx, 0xCC(%%esp)\n" // %ecx at time of segmentation fault |
- "jmp 3b\n" |
- |
- // If the instruction is INT 0, then this was probably the result |
- // of playground::Library being unable to find a way to safely |
- // rewrite the system call instruction. Retrieve the CPU register |
- // at the time of the segmentation fault and invoke syscallWrapper(). |
- "9:cmpw $0x00CD, (%%ebp)\n" // INT $0x0 |
- "jnz 20f\n" |
-#ifndef NDEBUG |
- "lea 200f, %%eax\n" |
- "push %%eax\n" |
- "call playground$debugMessage\n" |
- "add $0x4, %%esp\n" |
-#endif |
- "mov 0xD0(%%esp), %%eax\n" // %eax at time of segmentation fault |
- "mov 0xC4(%%esp), %%ebx\n" // %ebx at time of segmentation fault |
- "mov 0xCC(%%esp), %%ecx\n" // %ecx at time of segmentation fault |
- "mov 0xC8(%%esp), %%edx\n" // %edx at time of segmentation fault |
- "mov 0xB8(%%esp), %%esi\n" // %esi at time of segmentation fault |
- "mov 0xB4(%%esp), %%edi\n" // %edi at time of segmentation fault |
- "mov 0xB2(%%esp), %%ebp\n" // %ebp at time of segmentation fault |
- |
- // Handle sigprocmask() and rt_sigprocmask() |
- "cmp $175, %%eax\n" // NR_rt_sigprocmask |
- "jnz 10f\n" |
- "mov $-22, %%eax\n" // -EINVAL |
- "cmp $8, %%esi\n" // %esi = sigsetsize (8 bytes = 64 signals) |
- "jl 3b\n" |
- "jmp 11f\n" |
- "10:cmp $126, %%eax\n" // NR_sigprocmask |
- "jnz 15f\n" |
- "mov $-22, %%eax\n" |
- "11:mov 0xFC(%%esp), %%edi\n" // signal mask at time of segmentation fault |
- "mov 0x100(%%esp), %%ebp\n" |
- "test %%ecx, %%ecx\n" // only set mask, if set is non-NULL |
- "jz 14f\n" |
- "mov 0(%%ecx), %%esi\n" |
- "mov 4(%%ecx), %%ecx\n" |
- "cmp $0, %%ebx\n" // %ebx = how (SIG_BLOCK) |
- "jnz 12f\n" |
- "or %%esi, 0xFC(%%esp)\n" // signal mask at time of segmentation fault |
- "or %%ecx, 0x100(%%esp)\n" |
- "jmp 14f\n" |
- "12:cmp $1, %%ebx\n" // %ebx = how (SIG_UNBLOCK) |
- "jnz 13f\n" |
- "xor $-1, %%esi\n" |
- "xor $-1, %%ecx\n" |
- "and %%esi, 0xFC(%%esp)\n" // signal mask at time of segmentation fault |
- "and %%ecx, 0x100(%%esp)\n" |
- "jmp 14f\n" |
- "13:cmp $2, %%ebx\n" // %ebx = how (SIG_SETMASK) |
- "jnz 3b\n" |
- "mov %%esi, 0xFC(%%esp)\n" // signal mask at time of segmentation fault |
- "mov %%ecx, 0x100(%%esp)\n" |
- "14:xor %%eax, %%eax\n" |
- "test %%edx, %%edx\n" // only return old mask, if set is non-NULL |
- "jz 3b\n" |
- "mov %%edi, 0(%%edx)\n" // old_set |
- "mov %%ebp, 4(%%edx)\n" |
- "jmp 3b\n" |
- |
- // Handle sigreturn() and rt_sigreturn() |
- // See syscall.cc for a discussion on how we can emulate rt_sigreturn() |
- // by calling sigreturn() with a suitably adjusted stack. |
- "15:cmp $119, %%eax\n" // NR_sigreturn |
- "jnz 17f\n" |
- "mov 0xC0(%%esp), %%esp\n" // %esp at time of segmentation fault |
- "16:int $0x80\n" // sigreturn() is unrestricted |
- "17:cmp $173, %%eax\n" // NR_rt_sigreturn |
- "jnz 18f\n" |
- "mov 0xC0(%%esp), %%esp\n" // %esp at time of segmentation fault |
- "sub $4, %%esp\n" // add fake return address |
- "jmp 4b\n" |
- |
- // Copy signal frame onto new stack. In the process, we have to convert |
- // it from an RT signal frame to a legacy signal frame. |
- // See clone.cc for details |
- "18:cmp $120+0xF000, %%eax\n" // NR_clone + 0xF000 |
- "jnz 19f\n" |
- "lea -0x1C8(%%esp), %%eax\n"// retain stack frame upon returning |
- "mov %%eax, 0xC0(%%esp)\n" // %esp at time of segmentation fault |
- "jmp 3b\n" |
- |
- // Forward system call to syscallWrapper() |
- "19:call playground$syscallWrapper\n" |
- "jmp 3b\n" |
- |
- // In order to implement SA_NODEFER, we have to keep track of recursive |
- // calls to SIGSEGV handlers. This means we have to increment a counter |
- // before calling the user's signal handler, and decrement it on |
- // leaving the user's signal handler. |
- // Some signal handlers look at the return address of the signal |
- // stack, and more importantly "gdb" uses the call to {,rt_}sigreturn() |
- // as a magic signature when doing stacktraces. So, we have to use |
- // a little more unusual code to regain control after the user's |
- // signal handler is done. We adjust the return address to point to |
- // non-executable memory. And when we trigger another SEGV we pop the |
- // extraneous signal frame and then call sigreturn(). |
- // N.B. We currently do not correctly adjust the SEGV counter, if the |
- // user's signal handler exits in way other than by returning (e.g. by |
- // directly calling {,rt_}sigreturn(), or by calling siglongjmp()). |
- "20:lea 30f, %%edi\n" // rt-style restorer function |
- "lea 31f, %%esi\n" // legacy restorer function |
- "cmp %%ebp, %%edi\n" // check if returning from user's handler |
- "jnz 21f\n" |
- "decl %%fs:0x1040-0x58\n" // decrement SEGV recursion counter |
- "mov 0xC0(%%esp), %%esp\n" // %esp at time of segmentation fault |
- "jmp 29f\n" |
- "21:cmp %%ebp, %%esi\n" // check if returning from user's handler |
- "jnz 22f\n" |
- "decl %%fs:0x1040-0x58\n" // decrement SEGV recursion counter |
- "mov 0xC0(%%esp), %%esp\n" // %esp at time of segmentation fault |
- "jmp 6b\n" |
- |
- // This was a genuine segmentation fault. Check Sandbox::sa_segv_ for |
- // what we are supposed to do. |
- "22:lea playground$sa_segv, %%eax\n" |
- "cmp $0, 0(%%eax)\n" // SIG_DFL |
- "jz 23f\n" |
- "cmp $1, 0(%%eax)\n" // SIG_IGN |
- "jnz 24f\n" // can't really ignore synchronous signals |
- |
- // Trigger the kernel's default signal disposition. The only way we can |
- // do this from seccomp mode is by blocking the signal and retriggering |
- // it. |
- "23:orb $4, 0xFD(%%esp)\n" // signal mask at time of segmentation fault |
- "jmp 5b\n" |
- |
- // Check sa_flags: |
- // - We can ignore SA_NOCLDSTOP, SA_NOCLDWAIT, and SA_RESTART as they |
- // do not have any effect for SIGSEGV. |
- // - We have to always register our signal handler with SA_NODEFER so |
- // that the user's signal handler can make system calls which might |
- // require additional help from our SEGV handler. |
- // - If the user's signal handler wasn't supposed to be SA_NODEFER, then |
- // we emulate this behavior by keeping track of a recursion counter. |
- // |
- // TODO(markus): If/when we add support for sigaltstack(), we have to |
- // handle SA_ONSTACK. |
- "24:cmpl $0, %%fs:0x1040-0x58\n"// check if we failed inside of SEGV handler |
- "jnz 23b\n" // if so, then terminate program |
- "mov 0(%%eax), %%ebx\n" // sa_segv_.sa_sigaction |
- "mov 4(%%eax), %%ecx\n" // sa_segv_.sa_flags |
- "btl $31, %%ecx\n" // SA_RESETHAND |
- "jnc 25f\n" |
- "movl $0, 0(%%eax)\n" // set handler to SIG_DFL |
- "25:btl $30, %%ecx\n" // SA_NODEFER |
- "jc 28f\n" |
- "btl $2, %%ecx\n" // SA_SIGINFO |
- "jnc 26f\n" |
- "mov %%edi, 0(%%esp)\n" // trigger a SEGV on return |
- "incl %%fs:0x1040-0x58\n" // increment recursion counter |
- "jmp *%%ebx\n" // call user's signal handler |
- "26:mov %%esi, 0(%%esp)\n" |
- "incl %%fs:0x1040-0x58\n" // increment recursion counter |
- |
- // We always register the signal handler to give us rt-style signal |
- // frames. But if the user asked for legacy signal frames, we must |
- // convert the signal frame prior to calling the user's signal handler. |
- "27:sub $0x1C8, %%esp\n" // a legacy signal stack is much larger |
- "mov 0x1CC(%%esp), %%eax\n" // push signal number |
- "push %%eax\n" |
- "mov 0x1CC(%%esp), %%eax\n" // push restorer function |
- "push %%eax\n" |
- "lea 0x274(%%esp), %%esi\n" // copy siginfo register values |
- "lea 0x8(%%esp), %%edi\n" // into new location |
- "mov $22, %%ecx\n" |
- "cld\n" |
- "rep movsl\n" |
- "mov 0x2CC(%%esp), %%eax\n" // copy first half of signal mask |
- "mov %%eax, 0x58(%%esp)\n" |
- "lea 31f, %%esi\n" |
- "lea 0x2D4(%%esp), %%edi\n" // patch up retcode magic numbers |
- "movb $2, %%cl\n" |
- "rep movsl\n" |
- "jmp *%%ebx\n" // call user's signal handler |
- "28:lea 6b, %%eax\n" // set appropriate restorer function |
- "mov %%eax, 0(%%esp)\n" |
- "btl $2, %%ecx\n" // SA_SIGINFO |
- "jnc 27b\n" |
- "lea 29f, %%eax\n" |
- "mov %%eax, 0(%%esp)\n" // set appropriate restorer function |
- "jmp *%%ebx\n" // call user's signal handler |
- "29:pushl $30f\n" // emulate rt_sigreturn() |
- "jmp 5b\n" |
- |
- // Non-executable versions of the restorer function. We use these to |
- // trigger a SEGV upon returning from the user's signal handler, giving |
- // us an ability to clean up prior to returning from the SEGV handler. |
- ".pushsection .data\n" // move code into non-executable section |
- "30:mov $173, %%eax\n" // NR_rt_sigreturn |
- "int $0x80\n" // gdb looks for this signature when doing |
- ".byte 0\n" // backtraces |
- "31:pop %%eax\n" |
- "mov $119, %%eax\n" // NR_sigreturn |
- "int $0x80\n" |
- ".popsection\n" |
-#else |
-#error Unsupported target platform |
-#endif |
- ".pushsection \".rodata\"\n" |
-#ifndef NDEBUG |
- "100:.asciz \"RDTSC(P): Executing handler\\n\"\n" |
- "200:.asciz \"INT $0x0: Executing handler\\n\"\n" |
-#endif |
- ".popsection\n" |
- "999:pop %0\n" |
- : "=g"(fnc) |
- : |
- : "memory" |
-#if defined(__x86_64__) |
- , "rsp" |
-#elif defined(__i386__) |
- , "esp" |
-#endif |
- ); |
- return fnc; |
-} |
- |
-SecureMem::Args* Sandbox::getSecureMem() { |
- // Check trusted_thread.cc for the magic offset that gets us from the TLS |
- // to the beginning of the secure memory area. |
- SecureMem::Args* ret; |
-#if defined(__x86_64__) |
- asm volatile( |
- "movq %%gs:-0xE0, %0\n" |
- : "=q"(ret)); |
-#elif defined(__i386__) |
- asm volatile( |
- "movl %%fs:-0x58, %0\n" |
- : "=r"(ret)); |
-#else |
-#error Unsupported target platform |
-#endif |
- return ret; |
-} |
- |
-void Sandbox::snapshotMemoryMappings(int processFd, int proc_self_maps) { |
- SysCalls sys; |
- if (sys.lseek(proc_self_maps, 0, SEEK_SET) || |
- !sendFd(processFd, proc_self_maps, -1, NULL, 0)) { |
- failure: |
- die("Cannot access /proc/self/maps"); |
- } |
- int dummy; |
- if (read(sys, processFd, &dummy, sizeof(dummy)) != sizeof(dummy)) { |
- goto failure; |
- } |
-} |
- |
-int Sandbox::supportsSeccompSandbox(int proc_fd) { |
- if (status_ != STATUS_UNKNOWN) { |
- return status_ != STATUS_UNSUPPORTED; |
- } |
- int fds[2]; |
- SysCalls sys; |
- if (sys.pipe(fds)) { |
- status_ = STATUS_UNSUPPORTED; |
- return 0; |
- } |
- pid_t pid; |
- switch ((pid = sys.fork())) { |
- case -1: |
- status_ = STATUS_UNSUPPORTED; |
- return 0; |
- case 0: { |
- int devnull = sys.open("/dev/null", O_RDWR, 0); |
- if (devnull >= 0) { |
- sys.dup2(devnull, 0); |
- sys.dup2(devnull, 1); |
- sys.dup2(devnull, 2); |
- sys.close(devnull); |
- } |
- if (proc_fd >= 0) { |
- setProcSelfMaps(sys.openat(proc_fd, "self/maps", O_RDONLY, 0)); |
- } |
- startSandbox(); |
- write(sys, fds[1], "", 1); |
- |
- // Try to tell the trusted thread to shut down the entire process in an |
- // orderly fashion |
- defaultSystemCallHandler(__NR_exit_group, 0, 0, 0, 0, 0, 0); |
- |
- // If that did not work (e.g. because the kernel does not know about the |
- // exit_group() system call), make a direct _exit() system call instead. |
- // This system call is unrestricted in seccomp mode, so it will always |
- // succeed. Normally, we don't like it, because unlike exit_group() it |
- // does not terminate any other thread. But since we know that |
- // exit_group() exists in all kernels which support kernel-level threads, |
- // this is OK we only get here for old kernels where _exit() is OK. |
- sys._exit(0); |
- } |
- default: |
- NOINTR_SYS(sys.close(fds[1])); |
- char ch; |
- if (read(sys, fds[0], &ch, 1) != 1) { |
- status_ = STATUS_UNSUPPORTED; |
- } else { |
- status_ = STATUS_AVAILABLE; |
- } |
- int rc; |
- NOINTR_SYS(sys.waitpid(pid, &rc, 0)); |
- NOINTR_SYS(sys.close(fds[0])); |
- return status_ != STATUS_UNSUPPORTED; |
- } |
-} |
- |
-void Sandbox::setProcSelfMaps(int proc_self_maps) { |
- proc_self_maps_ = proc_self_maps; |
-} |
- |
-void Sandbox::startSandbox() { |
- if (status_ == STATUS_UNSUPPORTED) { |
- die("The seccomp sandbox is not supported on this computer"); |
- } else if (status_ == STATUS_ENABLED) { |
- return; |
- } |
- |
- SysCalls sys; |
- if (proc_self_maps_ < 0) { |
- proc_self_maps_ = sys.open("/proc/self/maps", O_RDONLY, 0); |
- if (proc_self_maps_ < 0) { |
- die("Cannot access \"/proc/self/maps\""); |
- } |
- } |
- |
- // The pid is unchanged for the entire program, so we can retrieve it once |
- // and store it in a global variable. |
- pid_ = sys.getpid(); |
- |
- // Block all signals, except for the RDTSC handler |
- setupSignalHandlers(); |
- |
- // Get socketpairs for talking to the trusted process |
- int pair[4]; |
- if (sys.socketpair(AF_UNIX, SOCK_STREAM, 0, pair) || |
- sys.socketpair(AF_UNIX, SOCK_STREAM, 0, pair+2)) { |
- die("Failed to create trusted thread"); |
- } |
- processFdPub_ = pair[0]; |
- cloneFdPub_ = pair[2]; |
- SecureMemArgs* secureMem = createTrustedProcess(pair[0], pair[1], |
- pair[2], pair[3]); |
- |
- // We find all libraries that have system calls and redirect the system |
- // calls to the sandbox. If we miss any system calls, the application will be |
- // terminated by the kernel's seccomp code. So, from a security point of |
- // view, if this code fails to identify system calls, we are still behaving |
- // correctly. |
- { |
- Maps maps(proc_self_maps_); |
- const char *libs[] = { "ld", "libc", "librt", "libpthread", NULL }; |
- |
- // Intercept system calls in the VDSO segment (if any). This has to happen |
- // before intercepting system calls in any of the other libraries, as |
- // the main kernel entry point might be inside of the VDSO and we need to |
- // determine its address before we can compare it to jumps from inside |
- // other libraries. |
- for (Maps::const_iterator iter = maps.begin(); iter != maps.end(); ++iter){ |
- Library* library = *iter; |
- if (library->isVDSO() && library->parseElf()) { |
- library->makeWritable(true); |
- library->patchSystemCalls(); |
- library->makeWritable(false); |
- break; |
- } |
- } |
- |
- // Intercept system calls in libraries that are known to have them. |
- for (Maps::const_iterator iter = maps.begin(); iter != maps.end(); ++iter){ |
- Library* library = *iter; |
- const char* mapping = iter.name().c_str(); |
- |
- // Find the actual base name of the mapped library by skipping past any |
- // SPC and forward-slashes. We don't want to accidentally find matches, |
- // because the directory name included part of our well-known lib names. |
- // |
- // Typically, prior to pruning, entries would look something like this: |
- // 08:01 2289011 /lib/libc-2.7.so |
- for (const char *delim = " /"; *delim; ++delim) { |
- const char* skip = strrchr(mapping, *delim); |
- if (skip) { |
- mapping = skip + 1; |
- } |
- } |
- |
- for (const char **ptr = libs; *ptr; ptr++) { |
- const char *name = strstr(mapping, *ptr); |
- if (name == mapping) { |
- char ch = name[strlen(*ptr)]; |
- if (ch < 'A' || (ch > 'Z' && ch < 'a') || ch > 'z') { |
- if (library->parseElf()) { |
- library->makeWritable(true); |
- library->patchSystemCalls(); |
- library->makeWritable(false); |
- break; |
- } |
- } |
- } |
- } |
- } |
- } |
- |
- // Take a snapshot of the current memory mappings. These mappings will be |
- // off-limits to all future mmap(), munmap(), mremap(), and mprotect() calls. |
- snapshotMemoryMappings(processFdPub_, proc_self_maps_); |
- NOINTR_SYS(sys.close(proc_self_maps_)); |
- proc_self_maps_ = -1; |
- |
- // Creating the trusted thread enables sandboxing |
- createTrustedThread(processFdPub_, cloneFdPub_, secureMem); |
- |
- // We can no longer check for sandboxing support at this point, but we also |
- // know for a fact that it is available (as we just turned it on). So update |
- // the status to reflect this information. |
- status_ = STATUS_ENABLED; |
-} |
- |
-} // namespace |