OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" | 5 #include "sandbox/linux/bpf_dsl/bpf_dsl.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <netinet/in.h> | 9 #include <netinet/in.h> |
10 #include <sys/socket.h> | 10 #include <sys/socket.h> |
(...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
57 static int socketpair(int domain, int type, int protocol, int sv[2]) { | 57 static int socketpair(int domain, int type, int protocol, int sv[2]) { |
58 return Syscall::Call(__NR_socketpair, domain, type, protocol, sv); | 58 return Syscall::Call(__NR_socketpair, domain, type, protocol, sv); |
59 } | 59 } |
60 #endif | 60 #endif |
61 }; | 61 }; |
62 | 62 |
63 class BasicPolicy : public SandboxBPFDSLPolicy { | 63 class BasicPolicy : public SandboxBPFDSLPolicy { |
64 public: | 64 public: |
65 BasicPolicy() {} | 65 BasicPolicy() {} |
66 virtual ~BasicPolicy() {} | 66 virtual ~BasicPolicy() {} |
67 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 67 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
68 if (sysno == __NR_getpgid) { | 68 if (sysno == __NR_getpgid) { |
69 const Arg<pid_t> pid(0); | 69 const Arg<pid_t> pid(0); |
70 return If(pid == 0, Error(EPERM)).Else(Error(EINVAL)); | 70 return If(pid == 0, Error(EPERM)).Else(Error(EINVAL)); |
71 } | 71 } |
72 if (sysno == __NR_setuid) { | 72 if (sysno == __NR_setuid) { |
73 const Arg<uid_t> uid(0); | 73 const Arg<uid_t> uid(0); |
74 return If(uid != 42, Error(ESRCH)).Else(Error(ENOMEM)); | 74 return If(uid != 42, Error(ESRCH)).Else(Error(ENOMEM)); |
75 } | 75 } |
76 return Allow(); | 76 return Allow(); |
77 } | 77 } |
78 | 78 |
79 private: | 79 private: |
80 DISALLOW_COPY_AND_ASSIGN(BasicPolicy); | 80 DISALLOW_COPY_AND_ASSIGN(BasicPolicy); |
81 }; | 81 }; |
82 | 82 |
83 BPF_TEST_C(BPFDSL, Basic, BasicPolicy) { | 83 BPF_TEST_C(BPFDSL, Basic, BasicPolicy) { |
84 ASSERT_SYSCALL_RESULT(-EPERM, getpgid, 0); | 84 ASSERT_SYSCALL_RESULT(-EPERM, getpgid, 0); |
85 ASSERT_SYSCALL_RESULT(-EINVAL, getpgid, 1); | 85 ASSERT_SYSCALL_RESULT(-EINVAL, getpgid, 1); |
86 | 86 |
87 ASSERT_SYSCALL_RESULT(-ENOMEM, setuid, 42); | 87 ASSERT_SYSCALL_RESULT(-ENOMEM, setuid, 42); |
88 ASSERT_SYSCALL_RESULT(-ESRCH, setuid, 43); | 88 ASSERT_SYSCALL_RESULT(-ESRCH, setuid, 43); |
89 } | 89 } |
90 | 90 |
91 /* On IA-32, socketpair() is implemented via socketcall(). :-( */ | 91 /* On IA-32, socketpair() is implemented via socketcall(). :-( */ |
92 #if !defined(ARCH_CPU_X86) | 92 #if !defined(ARCH_CPU_X86) |
93 class BooleanLogicPolicy : public SandboxBPFDSLPolicy { | 93 class BooleanLogicPolicy : public SandboxBPFDSLPolicy { |
94 public: | 94 public: |
95 BooleanLogicPolicy() {} | 95 BooleanLogicPolicy() {} |
96 virtual ~BooleanLogicPolicy() {} | 96 virtual ~BooleanLogicPolicy() {} |
97 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 97 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
98 if (sysno == __NR_socketpair) { | 98 if (sysno == __NR_socketpair) { |
99 const Arg<int> domain(0), type(1), protocol(2); | 99 const Arg<int> domain(0), type(1), protocol(2); |
100 return If(domain == AF_UNIX && | 100 return If(domain == AF_UNIX && |
101 (type == SOCK_STREAM || type == SOCK_DGRAM) && | 101 (type == SOCK_STREAM || type == SOCK_DGRAM) && |
102 protocol == 0, | 102 protocol == 0, |
103 Error(EPERM)).Else(Error(EINVAL)); | 103 Error(EPERM)).Else(Error(EINVAL)); |
104 } | 104 } |
105 return Allow(); | 105 return Allow(); |
106 } | 106 } |
107 | 107 |
(...skipping 17 matching lines...) Expand all Loading... |
125 // Completely unacceptable combination; should also return EINVAL. | 125 // Completely unacceptable combination; should also return EINVAL. |
126 ASSERT_SYSCALL_RESULT( | 126 ASSERT_SYSCALL_RESULT( |
127 -EINVAL, socketpair, AF_INET, SOCK_SEQPACKET, IPPROTO_UDP, sv); | 127 -EINVAL, socketpair, AF_INET, SOCK_SEQPACKET, IPPROTO_UDP, sv); |
128 } | 128 } |
129 #endif // !ARCH_CPU_X86 | 129 #endif // !ARCH_CPU_X86 |
130 | 130 |
131 class MoreBooleanLogicPolicy : public SandboxBPFDSLPolicy { | 131 class MoreBooleanLogicPolicy : public SandboxBPFDSLPolicy { |
132 public: | 132 public: |
133 MoreBooleanLogicPolicy() {} | 133 MoreBooleanLogicPolicy() {} |
134 virtual ~MoreBooleanLogicPolicy() {} | 134 virtual ~MoreBooleanLogicPolicy() {} |
135 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 135 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
136 if (sysno == __NR_setresuid) { | 136 if (sysno == __NR_setresuid) { |
137 const Arg<uid_t> ruid(0), euid(1), suid(2); | 137 const Arg<uid_t> ruid(0), euid(1), suid(2); |
138 return If(ruid == 0 || euid == 0 || suid == 0, Error(EPERM)) | 138 return If(ruid == 0 || euid == 0 || suid == 0, Error(EPERM)) |
139 .ElseIf(ruid == 1 && euid == 1 && suid == 1, Error(EAGAIN)) | 139 .ElseIf(ruid == 1 && euid == 1 && suid == 1, Error(EAGAIN)) |
140 .Else(Error(EINVAL)); | 140 .Else(Error(EINVAL)); |
141 } | 141 } |
142 return Allow(); | 142 return Allow(); |
143 } | 143 } |
144 | 144 |
145 private: | 145 private: |
(...skipping 16 matching lines...) Expand all Loading... |
162 ASSERT_SYSCALL_RESULT(-EINVAL, setresuid, 3, 4, 5); | 162 ASSERT_SYSCALL_RESULT(-EINVAL, setresuid, 3, 4, 5); |
163 } | 163 } |
164 | 164 |
165 static const uintptr_t kDeadBeefAddr = | 165 static const uintptr_t kDeadBeefAddr = |
166 static_cast<uintptr_t>(0xdeadbeefdeadbeefULL); | 166 static_cast<uintptr_t>(0xdeadbeefdeadbeefULL); |
167 | 167 |
168 class ArgSizePolicy : public SandboxBPFDSLPolicy { | 168 class ArgSizePolicy : public SandboxBPFDSLPolicy { |
169 public: | 169 public: |
170 ArgSizePolicy() {} | 170 ArgSizePolicy() {} |
171 virtual ~ArgSizePolicy() {} | 171 virtual ~ArgSizePolicy() {} |
172 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 172 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
173 if (sysno == __NR_uname) { | 173 if (sysno == __NR_uname) { |
174 const Arg<uintptr_t> addr(0); | 174 const Arg<uintptr_t> addr(0); |
175 return If(addr == kDeadBeefAddr, Error(EPERM)).Else(Allow()); | 175 return If(addr == kDeadBeefAddr, Error(EPERM)).Else(Allow()); |
176 } | 176 } |
177 return Allow(); | 177 return Allow(); |
178 } | 178 } |
179 | 179 |
180 private: | 180 private: |
181 DISALLOW_COPY_AND_ASSIGN(ArgSizePolicy); | 181 DISALLOW_COPY_AND_ASSIGN(ArgSizePolicy); |
182 }; | 182 }; |
183 | 183 |
184 BPF_TEST_C(BPFDSL, ArgSizeTest, ArgSizePolicy) { | 184 BPF_TEST_C(BPFDSL, ArgSizeTest, ArgSizePolicy) { |
185 struct utsname buf; | 185 struct utsname buf; |
186 ASSERT_SYSCALL_RESULT(0, uname, &buf); | 186 ASSERT_SYSCALL_RESULT(0, uname, &buf); |
187 ASSERT_SYSCALL_RESULT( | 187 ASSERT_SYSCALL_RESULT( |
188 -EPERM, uname, reinterpret_cast<struct utsname*>(kDeadBeefAddr)); | 188 -EPERM, uname, reinterpret_cast<struct utsname*>(kDeadBeefAddr)); |
189 } | 189 } |
190 | 190 |
191 class TrappingPolicy : public SandboxBPFDSLPolicy { | 191 class TrappingPolicy : public SandboxBPFDSLPolicy { |
192 public: | 192 public: |
193 TrappingPolicy() {} | 193 TrappingPolicy() {} |
194 virtual ~TrappingPolicy() {} | 194 virtual ~TrappingPolicy() {} |
195 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 195 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
196 if (sysno == __NR_uname) { | 196 if (sysno == __NR_uname) { |
197 return Trap(UnameTrap, &count_); | 197 return Trap(UnameTrap, &count_); |
198 } | 198 } |
199 return Allow(); | 199 return Allow(); |
200 } | 200 } |
201 | 201 |
202 private: | 202 private: |
203 static intptr_t count_; | 203 static intptr_t count_; |
204 | 204 |
205 static intptr_t UnameTrap(const struct arch_seccomp_data& data, void* aux) { | 205 static intptr_t UnameTrap(const struct arch_seccomp_data& data, void* aux) { |
206 BPF_ASSERT_EQ(&count_, aux); | 206 BPF_ASSERT_EQ(&count_, aux); |
207 return ++count_; | 207 return ++count_; |
208 } | 208 } |
209 | 209 |
210 DISALLOW_COPY_AND_ASSIGN(TrappingPolicy); | 210 DISALLOW_COPY_AND_ASSIGN(TrappingPolicy); |
211 }; | 211 }; |
212 | 212 |
213 intptr_t TrappingPolicy::count_; | 213 intptr_t TrappingPolicy::count_; |
214 | 214 |
215 BPF_TEST_C(BPFDSL, TrapTest, TrappingPolicy) { | 215 BPF_TEST_C(BPFDSL, TrapTest, TrappingPolicy) { |
216 ASSERT_SYSCALL_RESULT(1, uname, NULL); | 216 ASSERT_SYSCALL_RESULT(1, uname, NULL); |
217 ASSERT_SYSCALL_RESULT(2, uname, NULL); | 217 ASSERT_SYSCALL_RESULT(2, uname, NULL); |
218 ASSERT_SYSCALL_RESULT(3, uname, NULL); | 218 ASSERT_SYSCALL_RESULT(3, uname, NULL); |
219 } | 219 } |
220 | 220 |
221 class MaskingPolicy : public SandboxBPFDSLPolicy { | 221 class MaskingPolicy : public SandboxBPFDSLPolicy { |
222 public: | 222 public: |
223 MaskingPolicy() {} | 223 MaskingPolicy() {} |
224 virtual ~MaskingPolicy() {} | 224 virtual ~MaskingPolicy() {} |
225 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 225 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
226 if (sysno == __NR_setuid) { | 226 if (sysno == __NR_setuid) { |
227 const Arg<uid_t> uid(0); | 227 const Arg<uid_t> uid(0); |
228 return If((uid & 0xf) == 0, Error(EINVAL)).Else(Error(EACCES)); | 228 return If((uid & 0xf) == 0, Error(EINVAL)).Else(Error(EACCES)); |
229 } | 229 } |
230 if (sysno == __NR_setgid) { | 230 if (sysno == __NR_setgid) { |
231 const Arg<gid_t> gid(0); | 231 const Arg<gid_t> gid(0); |
232 return If((gid & 0xf0) == 0xf0, Error(EINVAL)).Else(Error(EACCES)); | 232 return If((gid & 0xf0) == 0xf0, Error(EINVAL)).Else(Error(EACCES)); |
233 } | 233 } |
234 if (sysno == __NR_setpgid) { | 234 if (sysno == __NR_setpgid) { |
235 const Arg<pid_t> pid(0); | 235 const Arg<pid_t> pid(0); |
(...skipping 20 matching lines...) Expand all Loading... |
256 for (pid_t pid = 0; pid < 0x100; ++pid) { | 256 for (pid_t pid = 0; pid < 0x100; ++pid) { |
257 const int expect_errno = (pid & 0xa5) == 0xa0 ? EINVAL : EACCES; | 257 const int expect_errno = (pid & 0xa5) == 0xa0 ? EINVAL : EACCES; |
258 ASSERT_SYSCALL_RESULT(-expect_errno, setpgid, pid, 0); | 258 ASSERT_SYSCALL_RESULT(-expect_errno, setpgid, pid, 0); |
259 } | 259 } |
260 } | 260 } |
261 | 261 |
262 class ElseIfPolicy : public SandboxBPFDSLPolicy { | 262 class ElseIfPolicy : public SandboxBPFDSLPolicy { |
263 public: | 263 public: |
264 ElseIfPolicy() {} | 264 ElseIfPolicy() {} |
265 virtual ~ElseIfPolicy() {} | 265 virtual ~ElseIfPolicy() {} |
266 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 266 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
267 if (sysno == __NR_setuid) { | 267 if (sysno == __NR_setuid) { |
268 const Arg<uid_t> uid(0); | 268 const Arg<uid_t> uid(0); |
269 return If((uid & 0xfff) == 0, Error(0)) | 269 return If((uid & 0xfff) == 0, Error(0)) |
270 .ElseIf((uid & 0xff0) == 0, Error(EINVAL)) | 270 .ElseIf((uid & 0xff0) == 0, Error(EINVAL)) |
271 .ElseIf((uid & 0xf00) == 0, Error(EEXIST)) | 271 .ElseIf((uid & 0xf00) == 0, Error(EEXIST)) |
272 .Else(Error(EACCES)); | 272 .Else(Error(EACCES)); |
273 } | 273 } |
274 return Allow(); | 274 return Allow(); |
275 } | 275 } |
276 | 276 |
(...skipping 11 matching lines...) Expand all Loading... |
288 ASSERT_SYSCALL_RESULT(-EEXIST, setuid, 0x0022); | 288 ASSERT_SYSCALL_RESULT(-EEXIST, setuid, 0x0022); |
289 | 289 |
290 ASSERT_SYSCALL_RESULT(-EACCES, setuid, 0x0111); | 290 ASSERT_SYSCALL_RESULT(-EACCES, setuid, 0x0111); |
291 ASSERT_SYSCALL_RESULT(-EACCES, setuid, 0x0222); | 291 ASSERT_SYSCALL_RESULT(-EACCES, setuid, 0x0222); |
292 } | 292 } |
293 | 293 |
294 class SwitchPolicy : public SandboxBPFDSLPolicy { | 294 class SwitchPolicy : public SandboxBPFDSLPolicy { |
295 public: | 295 public: |
296 SwitchPolicy() {} | 296 SwitchPolicy() {} |
297 virtual ~SwitchPolicy() {} | 297 virtual ~SwitchPolicy() {} |
298 virtual ResultExpr EvaluateSyscall(int sysno) const OVERRIDE { | 298 virtual ResultExpr EvaluateSyscall(int sysno) const override { |
299 if (sysno == __NR_fcntl) { | 299 if (sysno == __NR_fcntl) { |
300 const Arg<int> cmd(1); | 300 const Arg<int> cmd(1); |
301 const Arg<unsigned long> long_arg(2); | 301 const Arg<unsigned long> long_arg(2); |
302 return Switch(cmd) | 302 return Switch(cmd) |
303 .CASES((F_GETFL, F_GETFD), Error(ENOENT)) | 303 .CASES((F_GETFL, F_GETFD), Error(ENOENT)) |
304 .Case(F_SETFD, If(long_arg == O_CLOEXEC, Allow()).Else(Error(EINVAL))) | 304 .Case(F_SETFD, If(long_arg == O_CLOEXEC, Allow()).Else(Error(EINVAL))) |
305 .Case(F_SETFL, Error(EPERM)) | 305 .Case(F_SETFL, Error(EPERM)) |
306 .Default(Error(EACCES)); | 306 .Default(Error(EACCES)); |
307 } | 307 } |
308 return Allow(); | 308 return Allow(); |
(...skipping 14 matching lines...) Expand all Loading... |
323 ASSERT_SYSCALL_RESULT(-EINVAL, fcntl, sock_fd.get(), F_SETFD, 0); | 323 ASSERT_SYSCALL_RESULT(-EINVAL, fcntl, sock_fd.get(), F_SETFD, 0); |
324 | 324 |
325 ASSERT_SYSCALL_RESULT(-EPERM, fcntl, sock_fd.get(), F_SETFL, O_RDONLY); | 325 ASSERT_SYSCALL_RESULT(-EPERM, fcntl, sock_fd.get(), F_SETFL, O_RDONLY); |
326 | 326 |
327 ASSERT_SYSCALL_RESULT(-EACCES, fcntl, sock_fd.get(), F_DUPFD, 0); | 327 ASSERT_SYSCALL_RESULT(-EACCES, fcntl, sock_fd.get(), F_DUPFD, 0); |
328 } | 328 } |
329 | 329 |
330 } // namespace | 330 } // namespace |
331 } // namespace bpf_dsl | 331 } // namespace bpf_dsl |
332 } // namespace sandbox | 332 } // namespace sandbox |
OLD | NEW |