X-Git-Url: http://mj.ucw.cz/gitweb/?a=blobdiff_plain;f=box%2Fbox.c;h=0788ac4b51ec54b3484b054d5b9ac67bef42e06d;hb=84b464bb23734b1d2dbaa4eada95d1282ff664ae;hp=65734db9b3c7a2ce6d1db0eae071c9c248dd6b7e;hpb=9e030699033caacbda788bc1a02cfa076c65fb71;p=eval.git diff --git a/box/box.c b/box/box.c index 65734db..0788ac4 100644 --- a/box/box.c +++ b/box/box.c @@ -7,6 +7,8 @@ #define _LARGEFILE64_SOURCE #define _GNU_SOURCE +#include "autoconf.h" + #include #include #include @@ -23,10 +25,18 @@ #include #include #include -#include #include +#include #include +#if defined(CONFIG_BOX_KERNEL_AMD64) && !defined(CONFIG_BOX_USER_AMD64) +#include +#define NATIVE_NR_execve 59 /* 64-bit execve */ +#else +#include +#define NATIVE_NR_execve __NR_execve +#endif + #define NONRET __attribute__((noreturn)) #define UNUSED __attribute__((unused)) #define ARRAY_SIZE(a) (int)(sizeof(a)/sizeof(a[0])) @@ -237,7 +247,7 @@ static unsigned char syscall_action[NUM_ACTIONS] = { S(stat) = A_FILENAME, S(lstat) = A_FILENAME, S(readlink) = A_FILENAME, -#ifndef CONFIG_BOX_AMD64 +#ifndef CONFIG_BOX_USER_AMD64 S(oldstat) = A_FILENAME, S(oldlstat) = A_FILENAME, S(truncate64) = A_FILENAME, @@ -282,7 +292,7 @@ static unsigned char syscall_action[NUM_ACTIONS] = { S(get_thread_area) = A_YES, S(set_tid_address) = A_YES, S(exit_group) = A_YES | A_SAMPLE_MEM, -#ifndef CONFIG_BOX_AMD64 +#ifndef CONFIG_BOX_USER_AMD64 S(oldfstat) = A_YES, S(ftruncate64) = A_YES, S(_llseek) = A_YES, @@ -318,7 +328,7 @@ static unsigned char syscall_action[NUM_ACTIONS] = { S(rt_sigqueueinfo) = A_YES | A_LIBERAL, S(rt_sigsuspend) = A_YES | A_LIBERAL, S(_sysctl) = A_YES | A_LIBERAL, -#ifndef CONFIG_BOX_AMD64 +#ifndef CONFIG_BOX_USER_AMD64 S(sigaction) = A_YES | A_LIBERAL, S(sgetmask) = A_YES | A_LIBERAL, S(ssetmask) = A_YES | A_LIBERAL, @@ -597,7 +607,7 @@ setup_environment(void) /*** Low-level parsing of syscalls ***/ -#ifdef CONFIG_BOX_AMD64 +#ifdef CONFIG_BOX_KERNEL_AMD64 typedef uint64_t arg_t; #else typedef uint32_t arg_t; @@ -627,7 +637,7 @@ static int read_user_mem(arg_t addr, char *buf, int len) return read(mem_fd, buf, len); } -#ifdef CONFIG_BOX_AMD64 +#ifdef CONFIG_BOX_KERNEL_AMD64 static void get_syscall_args(struct syscall_args *a, int is_exit) @@ -635,9 +645,6 @@ get_syscall_args(struct syscall_args *a, int is_exit) if (ptrace(PTRACE_GETREGS, box_pid, NULL, &a->user) < 0) die("ptrace(PTRACE_GETREGS): %m"); a->sys = a->user.regs.orig_rax; - a->arg1 = a->user.regs.rdi; - a->arg2 = a->user.regs.rsi; - a->arg3 = a->user.regs.rdx; a->result = a->user.regs.rax; /* @@ -655,27 +662,53 @@ get_syscall_args(struct syscall_args *a, int is_exit) if (is_exit) return; + int sys_type; + uint16_t instr; + switch (a->user.regs.cs) { case 0x23: - err("FO: Forbidden 32-bit mode syscall"); + // 32-bit CPU mode => only 32-bit syscalls can be issued + sys_type = 32; + break; case 0x33: + // 64-bit CPU mode + if (read_user_mem(a->user.regs.rip-2, (char *) &instr, 2) != 2) + err("FO: Cannot read syscall instruction"); + switch (instr) + { + case 0x050f: + break; + case 0x80cd: + err("FO: Forbidden 32-bit syscall in 64-bit mode"); + default: + err("XX: Unknown syscall instruction %04x", instr); + } + sys_type = 64; break; default: err("XX: Unknown code segment %04jx", (intmax_t) a->user.regs.cs); } - uint16_t instr; - if (read_user_mem(a->user.regs.rip-2, (char *) &instr, 2) != 2) - err("FO: Cannot read syscall instruction"); - switch (instr) +#ifdef CONFIG_BOX_USER_AMD64 + if (sys_type != 64) + err("FO: Forbidden %d-bit mode syscall", sys_type); +#else + if (sys_type != (exec_seen ? 32 : 64)) + err("FO: Forbidden %d-bit mode syscall", sys_type); +#endif + + if (sys_type == 32) { - case 0x050f: - break; - case 0x80cd: - err("FO: Forbidden 32-bit syscall in 64-bit mode"); - default: - err("FO: Unknown syscall instruction %04x", instr); + a->arg1 = a->user.regs.rbx; + a->arg2 = a->user.regs.rcx; + a->arg3 = a->user.regs.rdx; + } + else + { + a->arg1 = a->user.regs.rdi; + a->arg2 = a->user.regs.rsi; + a->arg3 = a->user.regs.rdx; } } @@ -688,6 +721,11 @@ set_syscall_nr(struct syscall_args *a, arg_t sys) die("ptrace(PTRACE_SETREGS): %m"); } +static void +sanity_check(void) +{ +} + #else static void @@ -711,6 +749,19 @@ set_syscall_nr(struct syscall_args *a, arg_t sys) die("ptrace(PTRACE_SETREGS): %m"); } +static void +sanity_check(void) +{ +#if !defined(CONFIG_BOX_ALLOW_INSECURE) + struct utsname uts; + if (uname(&uts) < 0) + die("uname() failed: %m"); + + if (!strcmp(uts.machine, "x86_64")) + die("Running 32-bit sandbox on 64-bit kernels is inherently unsafe. Please get a 64-bit version."); +#endif +} + #endif /*** Syscall checks ***/ @@ -719,20 +770,12 @@ static void valid_filename(arg_t addr) { char namebuf[4096], *p, *end; - static int mem_fd; if (!file_access) err("FA: File access forbidden"); if (file_access >= 9) return; - if (!mem_fd) - { - sprintf(namebuf, "/proc/%d/mem", (int) box_pid); - mem_fd = open(namebuf, O_RDONLY); - if (mem_fd < 0) - die("open(%s): %m", namebuf); - } p = end = namebuf; do { @@ -744,15 +787,13 @@ valid_filename(arg_t addr) l = remains; if (!l) err("FA: Access to file with name too long"); - if (lseek64(mem_fd, addr, SEEK_SET) < 0) - die("lseek64(mem): %m"); - remains = read(mem_fd, end, l); + remains = read_user_mem(addr, end, l); if (remains < 0) die("read(mem): %m"); if (!remains) err("FA: Access to file with name out of memory"); - end += l; - addr += l; + end += remains; + addr += remains; } } while (*p++); @@ -1064,7 +1105,7 @@ boxkeeper(void) if (!exec_seen) { msg("[master] "); - if (sys == __NR_execve) + if (sys == NATIVE_NR_execve) exec_seen = 1; } else if ((act = valid_syscall(&a)) >= 0) @@ -1296,6 +1337,7 @@ main(int argc, char **argv) if (optind >= argc) usage(); + sanity_check(); uid = geteuid(); if (setreuid(uid, uid) < 0) die("setreuid: %m");