OLD | NEW |
---|---|
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/baseline_policy.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <sys/mman.h> | 8 #include <sys/mman.h> |
9 #include <sys/socket.h> | 9 #include <sys/socket.h> |
10 #include <sys/syscall.h> | 10 #include <sys/syscall.h> |
(...skipping 26 matching lines...) Expand all Loading... | |
37 SyscallSets::IsAllowedGettime(sysno) || | 37 SyscallSets::IsAllowedGettime(sysno) || |
38 SyscallSets::IsAllowedPrctl(sysno) || | 38 SyscallSets::IsAllowedPrctl(sysno) || |
39 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || | 39 SyscallSets::IsAllowedProcessStartOrDeath(sysno) || |
40 SyscallSets::IsAllowedSignalHandling(sysno) || | 40 SyscallSets::IsAllowedSignalHandling(sysno) || |
41 SyscallSets::IsFutex(sysno) || | 41 SyscallSets::IsFutex(sysno) || |
42 SyscallSets::IsGetSimpleId(sysno) || | 42 SyscallSets::IsGetSimpleId(sysno) || |
43 SyscallSets::IsKernelInternalApi(sysno) || | 43 SyscallSets::IsKernelInternalApi(sysno) || |
44 #if defined(__arm__) | 44 #if defined(__arm__) |
45 SyscallSets::IsArmPrivate(sysno) || | 45 SyscallSets::IsArmPrivate(sysno) || |
46 #endif | 46 #endif |
47 #if defined(__mips__) | |
48 SyscallSets::IsMipsSpecific(sysno) || | |
Kees Cook
2014/05/02 22:06:35
...Private vs ...Specific ?
nedeljko
2014/05/07 15:40:05
There is no private syscall range on mips like the
| |
49 #endif | |
47 SyscallSets::IsAllowedOperationOnFd(sysno); | 50 SyscallSets::IsAllowedOperationOnFd(sysno); |
48 } | 51 } |
49 | 52 |
50 // System calls that will trigger the crashing SIGSYS handler. | 53 // System calls that will trigger the crashing SIGSYS handler. |
51 bool IsBaselinePolicyWatched(int sysno) { | 54 bool IsBaselinePolicyWatched(int sysno) { |
52 return SyscallSets::IsAdminOperation(sysno) || | 55 return SyscallSets::IsAdminOperation(sysno) || |
53 SyscallSets::IsAdvancedScheduler(sysno) || | 56 SyscallSets::IsAdvancedScheduler(sysno) || |
54 SyscallSets::IsAdvancedTimer(sysno) || | 57 SyscallSets::IsAdvancedTimer(sysno) || |
55 SyscallSets::IsAsyncIo(sysno) || | 58 SyscallSets::IsAsyncIo(sysno) || |
56 SyscallSets::IsDebug(sysno) || | 59 SyscallSets::IsDebug(sysno) || |
57 SyscallSets::IsEventFd(sysno) || | 60 SyscallSets::IsEventFd(sysno) || |
58 SyscallSets::IsExtendedAttributes(sysno) || | 61 SyscallSets::IsExtendedAttributes(sysno) || |
59 SyscallSets::IsFaNotify(sysno) || | 62 SyscallSets::IsFaNotify(sysno) || |
60 SyscallSets::IsFsControl(sysno) || | 63 SyscallSets::IsFsControl(sysno) || |
61 SyscallSets::IsGlobalFSViewChange(sysno) || | 64 SyscallSets::IsGlobalFSViewChange(sysno) || |
62 SyscallSets::IsGlobalProcessEnvironment(sysno) || | 65 SyscallSets::IsGlobalProcessEnvironment(sysno) || |
63 SyscallSets::IsGlobalSystemStatus(sysno) || | 66 SyscallSets::IsGlobalSystemStatus(sysno) || |
64 SyscallSets::IsInotify(sysno) || | 67 SyscallSets::IsInotify(sysno) || |
65 SyscallSets::IsKernelModule(sysno) || | 68 SyscallSets::IsKernelModule(sysno) || |
66 SyscallSets::IsKeyManagement(sysno) || | 69 SyscallSets::IsKeyManagement(sysno) || |
67 SyscallSets::IsKill(sysno) || | 70 SyscallSets::IsKill(sysno) || |
68 SyscallSets::IsMessageQueue(sysno) || | 71 SyscallSets::IsMessageQueue(sysno) || |
69 SyscallSets::IsMisc(sysno) || | 72 SyscallSets::IsMisc(sysno) || |
70 #if defined(__x86_64__) | 73 #if defined(__x86_64__) |
71 SyscallSets::IsNetworkSocketInformation(sysno) || | 74 SyscallSets::IsNetworkSocketInformation(sysno) || |
72 #endif | 75 #endif |
73 SyscallSets::IsNuma(sysno) || | 76 SyscallSets::IsNuma(sysno) || |
74 SyscallSets::IsProcessGroupOrSession(sysno) || | 77 SyscallSets::IsProcessGroupOrSession(sysno) || |
75 #if defined(__i386__) | 78 #if defined(__i386__) || defined(__mips__) |
76 SyscallSets::IsSocketCall(sysno) || | 79 SyscallSets::IsSocketCall(sysno) || |
77 #endif | 80 #endif |
78 #if defined(__arm__) | 81 #if defined(__arm__) |
79 SyscallSets::IsArmPciConfig(sysno) || | 82 SyscallSets::IsArmPciConfig(sysno) || |
80 #endif | 83 #endif |
84 #if defined(__mips__) | |
85 SyscallSets::IsMipsMisc(sysno) || | |
86 #endif | |
81 SyscallSets::IsTimer(sysno); | 87 SyscallSets::IsTimer(sysno); |
82 } | 88 } |
83 | 89 |
84 // |fs_denied_errno| is the errno return for denied filesystem access. | 90 // |fs_denied_errno| is the errno return for denied filesystem access. |
85 ErrorCode EvaluateSyscallImpl(int fs_denied_errno, | 91 ErrorCode EvaluateSyscallImpl(int fs_denied_errno, |
86 pid_t current_pid, | 92 pid_t current_pid, |
87 SandboxBPF* sandbox, | 93 SandboxBPF* sandbox, |
88 int sysno) { | 94 int sysno) { |
89 #if defined(ADDRESS_SANITIZER) | 95 #if defined(ADDRESS_SANITIZER) |
90 if (sysno == __NR_sigaltstack) { | 96 if (sysno == __NR_sigaltstack) { |
91 // Required for better stack overflow detection in ASan. Disallowed in | 97 // Required for better stack overflow detection in ASan. Disallowed in |
92 // non-ASan builds. | 98 // non-ASan builds. |
93 return ErrorCode(ErrorCode::ERR_ALLOWED); | 99 return ErrorCode(ErrorCode::ERR_ALLOWED); |
94 } | 100 } |
95 #endif | 101 #endif |
96 if (IsBaselinePolicyAllowed(sysno)) { | 102 if (IsBaselinePolicyAllowed(sysno)) { |
97 return ErrorCode(ErrorCode::ERR_ALLOWED); | 103 return ErrorCode(ErrorCode::ERR_ALLOWED); |
98 } | 104 } |
99 | 105 |
100 #if defined(__x86_64__) || defined(__arm__) | 106 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__) |
101 if (sysno == __NR_socketpair) { | 107 if (sysno == __NR_socketpair) { |
102 // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen. | 108 // Only allow AF_UNIX, PF_UNIX. Crash if anything else is seen. |
103 COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different); | 109 COMPILE_ASSERT(AF_UNIX == PF_UNIX, af_unix_pf_unix_different); |
104 return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX, | 110 return sandbox->Cond(0, ErrorCode::TP_32BIT, ErrorCode::OP_EQUAL, AF_UNIX, |
105 ErrorCode(ErrorCode::ERR_ALLOWED), | 111 ErrorCode(ErrorCode::ERR_ALLOWED), |
106 sandbox->Trap(CrashSIGSYS_Handler, NULL)); | 112 sandbox->Trap(CrashSIGSYS_Handler, NULL)); |
107 } | 113 } |
108 #endif | 114 #endif |
109 | 115 |
110 if (sysno == __NR_madvise) { | 116 if (sysno == __NR_madvise) { |
111 // Only allow MADV_DONTNEED (aka MADV_FREE). | 117 // Only allow MADV_DONTNEED (aka MADV_FREE). |
112 return sandbox->Cond(2, ErrorCode::TP_32BIT, | 118 return sandbox->Cond(2, ErrorCode::TP_32BIT, |
113 ErrorCode::OP_EQUAL, MADV_DONTNEED, | 119 ErrorCode::OP_EQUAL, MADV_DONTNEED, |
114 ErrorCode(ErrorCode::ERR_ALLOWED), | 120 ErrorCode(ErrorCode::ERR_ALLOWED), |
115 ErrorCode(EPERM)); | 121 ErrorCode(EPERM)); |
116 } | 122 } |
117 | 123 |
118 #if defined(__i386__) || defined(__x86_64__) | 124 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) |
119 if (sysno == __NR_mmap) | 125 if (sysno == __NR_mmap) |
120 return RestrictMmapFlags(sandbox); | 126 return RestrictMmapFlags(sandbox); |
121 #endif | 127 #endif |
122 | 128 |
123 #if defined(__i386__) || defined(__arm__) | 129 #if defined(__i386__) || defined(__arm__) || defined(__mips__) |
124 if (sysno == __NR_mmap2) | 130 if (sysno == __NR_mmap2) |
125 return RestrictMmapFlags(sandbox); | 131 return RestrictMmapFlags(sandbox); |
126 #endif | 132 #endif |
127 | 133 |
128 if (sysno == __NR_mprotect) | 134 if (sysno == __NR_mprotect) |
129 return RestrictMprotectFlags(sandbox); | 135 return RestrictMprotectFlags(sandbox); |
130 | 136 |
131 if (sysno == __NR_fcntl) | 137 if (sysno == __NR_fcntl) |
132 return RestrictFcntlCommands(sandbox); | 138 return RestrictFcntlCommands(sandbox); |
133 | 139 |
134 #if defined(__i386__) || defined(__arm__) | 140 #if defined(__i386__) || defined(__arm__) || defined(__mips__) |
135 if (sysno == __NR_fcntl64) | 141 if (sysno == __NR_fcntl64) |
136 return RestrictFcntlCommands(sandbox); | 142 return RestrictFcntlCommands(sandbox); |
137 #endif | 143 #endif |
138 | 144 |
139 if (SyscallSets::IsKill(sysno)) { | 145 if (SyscallSets::IsKill(sysno)) { |
140 return RestrictKillTarget(current_pid, sandbox, sysno); | 146 return RestrictKillTarget(current_pid, sandbox, sysno); |
141 } | 147 } |
142 | 148 |
143 if (SyscallSets::IsFileSystem(sysno) || | 149 if (SyscallSets::IsFileSystem(sysno) || |
144 SyscallSets::IsCurrentDirectory(sysno)) { | 150 SyscallSets::IsCurrentDirectory(sysno)) { |
145 return ErrorCode(fs_denied_errno); | 151 return ErrorCode(fs_denied_errno); |
146 } | 152 } |
147 | 153 |
148 if (SyscallSets::IsAnySystemV(sysno)) { | 154 if (SyscallSets::IsAnySystemV(sysno)) { |
149 return ErrorCode(EPERM); | 155 return ErrorCode(EPERM); |
150 } | 156 } |
151 | 157 |
152 if (SyscallSets::IsUmask(sysno) || | 158 if (SyscallSets::IsUmask(sysno) || |
153 SyscallSets::IsDeniedFileSystemAccessViaFd(sysno) || | 159 SyscallSets::IsDeniedFileSystemAccessViaFd(sysno) || |
154 SyscallSets::IsDeniedGetOrModifySocket(sysno) || | 160 SyscallSets::IsDeniedGetOrModifySocket(sysno) || |
155 SyscallSets::IsProcessPrivilegeChange(sysno)) { | 161 SyscallSets::IsProcessPrivilegeChange(sysno)) { |
156 return ErrorCode(EPERM); | 162 return ErrorCode(EPERM); |
157 } | 163 } |
158 | 164 |
159 #if defined(__i386__) | 165 #if defined(__i386__) || defined(__mips__) |
160 if (SyscallSets::IsSocketCall(sysno)) | 166 if (SyscallSets::IsSocketCall(sysno)) |
161 return RestrictSocketcallCommand(sandbox); | 167 return RestrictSocketcallCommand(sandbox); |
162 #endif | 168 #endif |
163 | 169 |
164 if (IsBaselinePolicyWatched(sysno)) { | 170 if (IsBaselinePolicyWatched(sysno)) { |
165 // Previously unseen syscalls. TODO(jln): some of these should | 171 // Previously unseen syscalls. TODO(jln): some of these should |
166 // be denied gracefully right away. | 172 // be denied gracefully right away. |
167 return sandbox->Trap(CrashSIGSYS_Handler, NULL); | 173 return sandbox->Trap(CrashSIGSYS_Handler, NULL); |
168 } | 174 } |
169 | 175 |
(...skipping 20 matching lines...) Expand all Loading... | |
190 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, | 196 ErrorCode BaselinePolicy::EvaluateSyscall(SandboxBPF* sandbox, |
191 int sysno) const { | 197 int sysno) const { |
192 // Make sure that this policy is used in the creating process. | 198 // Make sure that this policy is used in the creating process. |
193 if (1 == sysno) { | 199 if (1 == sysno) { |
194 DCHECK_EQ(syscall(__NR_getpid), current_pid_); | 200 DCHECK_EQ(syscall(__NR_getpid), current_pid_); |
195 } | 201 } |
196 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); | 202 return EvaluateSyscallImpl(fs_denied_errno_, current_pid_, sandbox, sysno); |
197 } | 203 } |
198 | 204 |
199 } // namespace sandbox. | 205 } // namespace sandbox. |
OLD | NEW |