X-Git-Url: http://mj.ucw.cz/gitweb/?a=blobdiff_plain;f=box%2Fbox.c;h=7fe08a7398d652ecde081561d78d82b1de06dddc;hb=2e672447a48106a49ae5083bf68c4c260691e343;hp=b44d11a6217e57a3d9de5470f0d38fc7ab4ca7fa;hpb=1799a7e247753c6243f42a0a33a6d17bf0b3d7d8;p=eval.git diff --git a/box/box.c b/box/box.c index b44d11a..7fe08a7 100644 --- a/box/box.c +++ b/box/box.c @@ -7,6 +7,8 @@ #define _LARGEFILE64_SOURCE #define _GNU_SOURCE +#include "autoconf.h" + #include #include #include @@ -23,10 +25,18 @@ #include #include #include -#include #include +#include #include +#if defined(CONFIG_BOX_KERNEL_AMD64) && !defined(CONFIG_BOX_USER_AMD64) +#include +#define NATIVE_NR_execve 59 /* 64-bit execve */ +#else +#include +#define NATIVE_NR_execve __NR_execve +#endif + #define NONRET __attribute__((noreturn)) #define UNUSED __attribute__((unused)) #define ARRAY_SIZE(a) (int)(sizeof(a)/sizeof(a[0])) @@ -237,7 +247,7 @@ static unsigned char syscall_action[NUM_ACTIONS] = { S(stat) = A_FILENAME, S(lstat) = A_FILENAME, S(readlink) = A_FILENAME, -#ifndef CONFIG_BOX_AMD64 +#ifndef CONFIG_BOX_USER_AMD64 S(oldstat) = A_FILENAME, S(oldlstat) = A_FILENAME, S(truncate64) = A_FILENAME, @@ -282,7 +292,9 @@ static unsigned char syscall_action[NUM_ACTIONS] = { S(get_thread_area) = A_YES, S(set_tid_address) = A_YES, S(exit_group) = A_YES | A_SAMPLE_MEM, -#ifndef CONFIG_BOX_AMD64 +#ifdef CONFIG_BOX_USER_AMD64 + S(arch_prctl) = A_YES, +#else S(oldfstat) = A_YES, S(ftruncate64) = A_YES, S(_llseek) = A_YES, @@ -318,7 +330,7 @@ static unsigned char syscall_action[NUM_ACTIONS] = { S(rt_sigqueueinfo) = A_YES | A_LIBERAL, S(rt_sigsuspend) = A_YES | A_LIBERAL, S(_sysctl) = A_YES | A_LIBERAL, -#ifndef CONFIG_BOX_AMD64 +#ifndef CONFIG_BOX_USER_AMD64 S(sigaction) = A_YES | A_LIBERAL, S(sgetmask) = A_YES | A_LIBERAL, S(ssetmask) = A_YES | A_LIBERAL, @@ -413,6 +425,7 @@ static struct path_rule default_path_rules[] = { { "/proc/meminfo", A_YES }, { "/proc/self/stat", A_YES }, { "/proc/self/exe", A_YES }, // Needed by FPC 2.0.x runtime + { "/proc/self/maps", A_YES }, // Needed by glibc when it reports arena corruption }; static struct path_rule *user_path_rules; @@ -597,7 +610,7 @@ setup_environment(void) /*** Low-level parsing of syscalls ***/ -#ifdef CONFIG_BOX_AMD64 +#ifdef CONFIG_BOX_KERNEL_AMD64 typedef uint64_t arg_t; #else typedef uint32_t arg_t; @@ -610,20 +623,105 @@ struct syscall_args { struct user user; }; -#ifdef CONFIG_BOX_AMD64 +static int user_mem_fd; + +static int read_user_mem(arg_t addr, char *buf, int len) +{ + if (!user_mem_fd) + { + char memname[64]; + sprintf(memname, "/proc/%d/mem", (int) box_pid); + user_mem_fd = open(memname, O_RDONLY); + if (user_mem_fd < 0) + die("open(%s): %m", memname); + } + if (lseek64(user_mem_fd, addr, SEEK_SET) < 0) + die("lseek64(mem): %m"); + return read(user_mem_fd, buf, len); +} + +static void close_user_mem(void) +{ + if (user_mem_fd) + { + close(user_mem_fd); + user_mem_fd = 0; + } +} + +#ifdef CONFIG_BOX_KERNEL_AMD64 static void -get_syscall_args(struct syscall_args *a) +get_syscall_args(struct syscall_args *a, int is_exit) { if (ptrace(PTRACE_GETREGS, box_pid, NULL, &a->user) < 0) die("ptrace(PTRACE_GETREGS): %m"); a->sys = a->user.regs.orig_rax; - a->arg1 = a->user.regs.rdi; - a->arg2 = a->user.regs.rsi; - a->arg3 = a->user.regs.rdx; a->result = a->user.regs.rax; - // FIXME: Check that it's really a 64-bit syscall + /* + * CAVEAT: We have to check carefully that this is a real 64-bit syscall. + * We test whether the process runs in 64-bit mode, but surprisingly this + * is not enough: a 64-bit process can still issue the INT 0x80 instruction + * which performs a 32-bit syscall. Currently, the only known way how to + * detect this situation is to inspect the instruction code (the kernel + * keeps a syscall type flag internally, but it is not accessible from + * user space). Hopefully, there is no instruction whose suffix is the + * code of the SYSCALL instruction. Sometimes, one would wish the + * instruction codes to be unique even when read backwards :) + */ + + if (is_exit) + return; + + int sys_type; + uint16_t instr; + + switch (a->user.regs.cs) + { + case 0x23: + // 32-bit CPU mode => only 32-bit syscalls can be issued + sys_type = 32; + break; + case 0x33: + // 64-bit CPU mode + if (read_user_mem(a->user.regs.rip-2, (char *) &instr, 2) != 2) + err("FO: Cannot read syscall instruction"); + switch (instr) + { + case 0x050f: + break; + case 0x80cd: + err("FO: Forbidden 32-bit syscall in 64-bit mode"); + default: + err("XX: Unknown syscall instruction %04x", instr); + } + sys_type = 64; + break; + default: + err("XX: Unknown code segment %04jx", (intmax_t) a->user.regs.cs); + } + +#ifdef CONFIG_BOX_USER_AMD64 + if (sys_type != 64) + err("FO: Forbidden %d-bit mode syscall", sys_type); +#else + if (sys_type != (exec_seen ? 32 : 64)) + err("FO: Forbidden %d-bit mode syscall", sys_type); +#endif + + if (sys_type == 32) + { + a->arg1 = a->user.regs.rbx; + a->arg2 = a->user.regs.rcx; + a->arg3 = a->user.regs.rdx; + } + else + { + a->arg1 = a->user.regs.rdi; + a->arg2 = a->user.regs.rsi; + a->arg3 = a->user.regs.rdx; + } } static void @@ -635,10 +733,15 @@ set_syscall_nr(struct syscall_args *a, arg_t sys) die("ptrace(PTRACE_SETREGS): %m"); } +static void +sanity_check(void) +{ +} + #else static void -get_syscall_args(struct syscall_args *a) +get_syscall_args(struct syscall_args *a, int is_exit UNUSED) { if (ptrace(PTRACE_GETREGS, box_pid, NULL, &a->user) < 0) die("ptrace(PTRACE_GETREGS): %m"); @@ -658,6 +761,19 @@ set_syscall_nr(struct syscall_args *a, arg_t sys) die("ptrace(PTRACE_SETREGS): %m"); } +static void +sanity_check(void) +{ +#if !defined(CONFIG_BOX_ALLOW_INSECURE) + struct utsname uts; + if (uname(&uts) < 0) + die("uname() failed: %m"); + + if (!strcmp(uts.machine, "x86_64")) + die("Running 32-bit sandbox on 64-bit kernels is inherently unsafe. Please get a 64-bit version."); +#endif +} + #endif /*** Syscall checks ***/ @@ -666,20 +782,12 @@ static void valid_filename(arg_t addr) { char namebuf[4096], *p, *end; - static int mem_fd; if (!file_access) err("FA: File access forbidden"); if (file_access >= 9) return; - if (!mem_fd) - { - sprintf(namebuf, "/proc/%d/mem", (int) box_pid); - mem_fd = open(namebuf, O_RDONLY); - if (mem_fd < 0) - die("open(%s): %m", namebuf); - } p = end = namebuf; do { @@ -691,15 +799,13 @@ valid_filename(arg_t addr) l = remains; if (!l) err("FA: Access to file with name too long"); - if (lseek64(mem_fd, addr, SEEK_SET) < 0) - die("lseek64(mem): %m"); - remains = read(mem_fd, end, l); + remains = read_user_mem(addr, end, l); if (remains < 0) die("read(mem): %m"); if (!remains) err("FA: Access to file with name out of memory"); - end += l; - addr += l; + end += remains; + addr += remains; } } while (*p++); @@ -1000,18 +1106,22 @@ boxkeeper(void) struct syscall_args a; static unsigned int sys_tick, last_act; static arg_t last_sys; - get_syscall_args(&a); - arg_t sys = a.sys; if (++sys_tick & 1) /* Syscall entry */ { char namebuf[32]; int act; + + get_syscall_args(&a, 0); + arg_t sys = a.sys; msg(">> Syscall %-12s (%08jx,%08jx,%08jx) ", syscall_name(sys, namebuf), (intmax_t) a.arg1, (intmax_t) a.arg2, (intmax_t) a.arg3); if (!exec_seen) { msg("[master] "); - if (sys == __NR_execve) - exec_seen = 1; + if (sys == NATIVE_NR_execve) + { + exec_seen = 1; + close_user_mem(); + } } else if ((act = valid_syscall(&a)) >= 0) { @@ -1034,7 +1144,8 @@ boxkeeper(void) } else /* Syscall return */ { - if (sys == ~(arg_t)0) + get_syscall_args(&a, 1); + if (a.sys == ~(arg_t)0) { /* Some syscalls (sigreturn et al.) do not return a value */ if (!(last_act & A_NO_RETVAL)) @@ -1042,7 +1153,7 @@ boxkeeper(void) } else { - if (sys != last_sys) + if (a.sys != last_sys) err("XX: Mismatched syscall entry/exit"); } if (last_act & A_NO_RETVAL) @@ -1241,6 +1352,7 @@ main(int argc, char **argv) if (optind >= argc) usage(); + sanity_check(); uid = geteuid(); if (setreuid(uid, uid) < 0) die("setreuid: %m");