X-Git-Url: http://mj.ucw.cz/gitweb/?a=blobdiff_plain;f=src%2Fbox.c;h=dc41f6cb032962c272fb2ff73b71373b0d4836ed;hb=50cc126ebe949259a54f153a123848d771601b77;hp=b72c0595b01309efd0eaa6c5d865d48c2388f3ce;hpb=81f60f3c309cf87db8a5ffcb320d181e8c3f99e2;p=eval.git diff --git a/src/box.c b/src/box.c index b72c059..dc41f6c 100644 --- a/src/box.c +++ b/src/box.c @@ -1,7 +1,7 @@ /* - * A Simple Testing Sandbox + * A Simple Sandbox for MO-Eval * - * (c) 2001--2007 Martin Mares + * (c) 2001--2008 Martin Mares */ #define _LARGEFILE64_SOURCE @@ -27,6 +27,7 @@ #define NONRET __attribute__((noreturn)) #define UNUSED __attribute__((unused)) +#define ARRAY_SIZE(a) (int)(sizeof(a)/sizeof(a[0])) static int filter_syscalls; /* 0=off, 1=liberal, 2=totalitarian */ static int timeout; /* milliseconds */ @@ -35,7 +36,6 @@ static int pass_environ; static int file_access; static int verbose; static int memory_limit; -static int allow_times; static char *redir_stdin, *redir_stdout; static char *set_cwd; @@ -44,6 +44,7 @@ static int is_ptraced; static volatile int timer_tick; static struct timeval start_time; static int ticks_per_sec; +static int exec_seen; #if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ > 0 /* glibc 2.1 or newer -> has lseek64 */ @@ -78,7 +79,7 @@ die(char *msg, ...) } static void __attribute__((format(printf,1,2))) -log(char *msg, ...) +msg(char *msg, ...) { va_list args; va_start(args, msg); @@ -90,6 +91,395 @@ log(char *msg, ...) va_end(args); } +static void * +xmalloc(size_t size) +{ + void *p = malloc(size); + if (!p) + die("Out of memory"); + return p; +} + +/*** Syscall rules ***/ + +static const char * const syscall_names[] = { +#include "syscall-table.h" +}; +#define NUM_SYSCALLS ARRAY_SIZE(syscall_names) +#define NUM_ACTIONS (NUM_SYSCALLS+64) + +enum action { + A_DEFAULT, // Use the default action + A_NO, // Always forbid + A_YES, // Always permit + A_FILENAME, // Permit if arg1 is a known filename + A_LIBERAL = 128, // Valid only in liberal mode +}; + +static unsigned char syscall_action[NUM_ACTIONS] = { +#define S(x) [__NR_##x] + + // Syscalls permitted for specific file names + S(open) = A_FILENAME, + S(creat) = A_FILENAME, + S(unlink) = A_FILENAME, + S(oldstat) = A_FILENAME, + S(access) = A_FILENAME, + S(oldlstat) = A_FILENAME, + S(truncate) = A_FILENAME, + S(stat) = A_FILENAME, + S(lstat) = A_FILENAME, + S(truncate64) = A_FILENAME, + S(stat64) = A_FILENAME, + S(lstat64) = A_FILENAME, + S(readlink) = A_FILENAME, + + // Syscalls permitted always + S(exit) = A_YES, + S(read) = A_YES, + S(write) = A_YES, + S(close) = A_YES, + S(lseek) = A_YES, + S(getpid) = A_YES, + S(getuid) = A_YES, + S(oldfstat) = A_YES, + S(dup) = A_YES, + S(brk) = A_YES, + S(getgid) = A_YES, + S(geteuid) = A_YES, + S(getegid) = A_YES, + S(dup2) = A_YES, + S(ftruncate) = A_YES, + S(fstat) = A_YES, + S(personality) = A_YES, + S(_llseek) = A_YES, + S(readv) = A_YES, + S(writev) = A_YES, + S(getresuid) = A_YES, +#ifdef __NR_pread64 + S(pread64) = A_YES, + S(pwrite64) = A_YES, +#else + S(pread) = A_YES, + S(pwrite) = A_YES, +#endif + S(ftruncate64) = A_YES, + S(fstat64) = A_YES, + S(fcntl) = A_YES, + S(fcntl64) = A_YES, + S(mmap) = A_YES, + S(munmap) = A_YES, + S(ioctl) = A_YES, + S(uname) = A_YES, + S(gettid) = A_YES, + S(set_thread_area) = A_YES, + S(get_thread_area) = A_YES, + S(exit_group) = A_YES, + + // Syscalls permitted only in liberal mode + S(time) = A_YES | A_LIBERAL, + S(alarm) = A_YES | A_LIBERAL, + S(pause) = A_YES | A_LIBERAL, + S(signal) = A_YES | A_LIBERAL, + S(fchmod) = A_YES | A_LIBERAL, + S(sigaction) = A_YES | A_LIBERAL, + S(sgetmask) = A_YES | A_LIBERAL, + S(ssetmask) = A_YES | A_LIBERAL, + S(sigsuspend) = A_YES | A_LIBERAL, + S(sigpending) = A_YES | A_LIBERAL, + S(getrlimit) = A_YES | A_LIBERAL, + S(getrusage) = A_YES | A_LIBERAL, + S(ugetrlimit) = A_YES | A_LIBERAL, + S(gettimeofday) = A_YES | A_LIBERAL, + S(select) = A_YES | A_LIBERAL, + S(readdir) = A_YES | A_LIBERAL, + S(setitimer) = A_YES | A_LIBERAL, + S(getitimer) = A_YES | A_LIBERAL, + S(sigreturn) = A_YES | A_LIBERAL, + S(mprotect) = A_YES | A_LIBERAL, + S(sigprocmask) = A_YES | A_LIBERAL, + S(getdents) = A_YES | A_LIBERAL, + S(getdents64) = A_YES | A_LIBERAL, + S(_newselect) = A_YES | A_LIBERAL, + S(fdatasync) = A_YES | A_LIBERAL, + S(mremap) = A_YES | A_LIBERAL, + S(poll) = A_YES | A_LIBERAL, + S(getcwd) = A_YES | A_LIBERAL, + S(nanosleep) = A_YES | A_LIBERAL, + S(rt_sigreturn) = A_YES | A_LIBERAL, + S(rt_sigaction) = A_YES | A_LIBERAL, + S(rt_sigprocmask) = A_YES | A_LIBERAL, + S(rt_sigpending) = A_YES | A_LIBERAL, + S(rt_sigtimedwait) = A_YES | A_LIBERAL, + S(rt_sigqueueinfo) = A_YES | A_LIBERAL, + S(rt_sigsuspend) = A_YES | A_LIBERAL, + S(mmap2) = A_YES | A_LIBERAL, + S(_sysctl) = A_YES | A_LIBERAL, +#undef S +}; + +static const char * +syscall_name(unsigned int id, char *buf) +{ + if (id < NUM_SYSCALLS && syscall_names[id]) + return syscall_names[id]; + else + { + sprintf(buf, "#%d", id); + return buf; + } +} + +static int +syscall_by_name(char *name) +{ + for (unsigned int i=0; i= NUM_ACTIONS) + return NUM_ACTIONS; + return l; +} + +static int +set_syscall_action(char *a) +{ + char *sep = strchr(a, '='); + enum action act = A_YES; + if (sep) + { + *sep++ = 0; + if (!strcmp(sep, "yes")) + act = A_YES; + else if (!strcmp(sep, "no")) + act = A_NO; + else if (!strcmp(sep, "file")) + act = A_FILENAME; + else + return 0; + } + + int sys = syscall_by_name(a); + if (sys < 0) + die("Unknown syscall `%s'", a); + if (sys >= NUM_ACTIONS) + die("Syscall `%s' out of range", a); + syscall_action[sys] = act; + return 1; +} + +/*** Path rules ***/ + +struct path_rule { + char *path; + enum action action; + struct path_rule *next; +}; + +static struct path_rule default_path_rules[] = { + { "/etc/", A_YES }, + { "/lib/", A_YES }, + { "/usr/lib/", A_YES }, + { "/opt/lib/", A_YES }, + { "/usr/share/zoneinfo/", A_YES }, + { "/usr/share/locale/", A_YES }, + { "/dev/null", A_YES }, + { "/dev/zero", A_YES }, + { "/proc/meminfo", A_YES }, + { "/proc/self/stat", A_YES }, + { "/proc/self/exe", A_YES }, // Needed by FPC 2.0.x runtime +}; + +static struct path_rule *user_path_rules; +static struct path_rule **last_path_rule = &user_path_rules; + +static int +set_path_action(char *a) +{ + char *sep = strchr(a, '='); + enum action act = A_YES; + if (sep) + { + *sep++ = 0; + if (!strcmp(sep, "yes")) + act = A_YES; + else if (!strcmp(sep, "no")) + act = A_NO; + else + return 0; + } + + struct path_rule *r = xmalloc(sizeof(*r) + strlen(a) + 1); + r->path = (char *)(r+1); + strcpy(r->path, a); + r->action = act; + r->next = NULL; + *last_path_rule = r; + last_path_rule = &r->next; + return 1; +} + +static enum action +match_path_rule(struct path_rule *r, char *path) +{ + char *rr = r->path; + while (*rr) + if (*rr++ != *path++) + { + if (rr[-1] == '/' && !path[-1]) + break; + return A_DEFAULT; + } + if (rr > r->path && rr[-1] != '/' && *path) + return A_DEFAULT; + return r->action; +} + +/*** Environment rules ***/ + +struct env_rule { + char *var; // Variable to match + char *val; // ""=clear, NULL=inherit + int var_len; + struct env_rule *next; +}; + +static struct env_rule *first_env_rule; +static struct env_rule **last_env_rule = &first_env_rule; + +static struct env_rule default_env_rules[] = { + { "LIBC_FATAL_STDERR_", "1" } +}; + +static int +set_env_action(char *a0) +{ + struct env_rule *r = xmalloc(sizeof(*r) + strlen(a0) + 1); + char *a = (char *)(r+1); + strcpy(a, a0); + + char *sep = strchr(a, '='); + if (sep == a) + return 0; + r->var = a; + if (sep) + { + *sep++ = 0; + r->val = sep; + } + else + r->val = NULL; + *last_env_rule = r; + last_env_rule = &r->next; + r->next = NULL; + return 1; +} + +static int +match_env_var(char *env_entry, struct env_rule *r) +{ + if (strncmp(env_entry, r->var, r->var_len)) + return 0; + return (env_entry[r->var_len] == '='); +} + +static void +apply_env_rule(char **env, int *env_sizep, struct env_rule *r) +{ + // First remove the variable if already set + int pos = 0; + while (pos < *env_sizep && !match_env_var(env[pos], r)) + pos++; + if (pos < *env_sizep) + { + (*env_sizep)--; + env[pos] = env[*env_sizep]; + env[*env_sizep] = NULL; + } + + // What is the new value? + char *new; + if (r->val) + { + if (!r->val[0]) + return; + new = xmalloc(r->var_len + 1 + strlen(r->val) + 1); + sprintf(new, "%s=%s", r->var, r->val); + } + else + { + pos = 0; + while (environ[pos] && !match_env_var(environ[pos], r)) + pos++; + if (!(new = environ[pos])) + return; + } + + // Add it at the end of the array + env[(*env_sizep)++] = new; + env[*env_sizep] = NULL; +} + +static char ** +setup_environment(void) +{ + // Link built-in rules with user rules + for (int i=ARRAY_SIZE(default_env_rules)-1; i >= 0; i--) + { + default_env_rules[i].next = first_env_rule; + first_env_rule = &default_env_rules[i]; + } + + // Scan the original environment + char **orig_env = environ; + int orig_size = 0; + while (orig_env[orig_size]) + orig_size++; + + // For each rule, reserve one more slot and calculate length + int num_rules = 0; + for (struct env_rule *r = first_env_rule; r; r=r->next) + { + num_rules++; + r->var_len = strlen(r->var); + } + + // Create a new environment + char **env = xmalloc((orig_size + num_rules + 1) * sizeof(char *)); + int size; + if (pass_environ) + { + memcpy(env, environ, orig_size * sizeof(char *)); + size = orig_size; + } + else + size = 0; + env[size] = NULL; + + // Apply the rules one by one + for (struct env_rule *r = first_env_rule; r; r=r->next) + apply_env_rule(env, &size, r); + + // Return the new env and pass some gossip + if (verbose > 1) + { + fprintf(stderr, "Passing environment:\n"); + for (int i=0; env[i]; i++) + fprintf(stderr, "\t%s\n", env[i]); + } + return env; +} + +/*** Syscall checks ***/ + static void valid_filename(unsigned long addr) { @@ -132,143 +522,66 @@ valid_filename(unsigned long addr) } while (*p++); - log("[%s] ", namebuf); + msg("[%s] ", namebuf); if (file_access >= 3) return; + + // Everything in current directory is permitted if (!strchr(namebuf, '/') && strcmp(namebuf, "..")) return; + + // ".." anywhere in the path is forbidden + enum action act = A_DEFAULT; + if (strstr(namebuf, "..")) + act = A_NO; + + // Scan user rules + for (struct path_rule *r = user_path_rules; r && !act; r=r->next) + act = match_path_rule(r, namebuf); + + // Scan built-in rules if (file_access >= 2) - { - if ((!strncmp(namebuf, "/etc/", 5) || - !strncmp(namebuf, "/lib/", 5) || - !strncmp(namebuf, "/usr/lib/", 9) || - !strncmp(namebuf, "/opt/lib/", 9)) - && !strstr(namebuf, "..")) - return; - if (!strcmp(namebuf, "/dev/null") || - !strcmp(namebuf, "/dev/zero") || - !strcmp(namebuf, "/proc/meminfo") || - !strcmp(namebuf, "/proc/self/stat") || - !strcmp(namebuf, "/proc/self/exe") || /* Needed by FPC 2.0.x runtime */ - !strncmp(namebuf, "/usr/share/zoneinfo/", 20)) - return; - } - die("Forbidden access to file `%s'", namebuf); + for (int i=0; iregs.orig_eax) + unsigned int sys = u->regs.orig_eax; + enum action act = (sys < NUM_ACTIONS) ? syscall_action[sys] : A_DEFAULT; + + if (act & A_LIBERAL) { - case __NR_execve: - { - static int exec_counter; - return !exec_counter++; - } - case __NR_open: - case __NR_creat: - case __NR_unlink: - case __NR_oldstat: - case __NR_access: - case __NR_oldlstat: - case __NR_truncate: - case __NR_stat: - case __NR_lstat: - case __NR_truncate64: - case __NR_stat64: - case __NR_lstat64: - case __NR_readlink: - valid_filename(u->regs.ebx); + if (filter_syscalls == 1) + act &= ~A_LIBERAL; + else + act = A_DEFAULT; + } + switch (act) + { + case A_YES: return 1; - case __NR_exit: - case __NR_read: - case __NR_write: - case __NR_close: - case __NR_lseek: - case __NR_getpid: - case __NR_getuid: - case __NR_oldfstat: - case __NR_dup: - case __NR_brk: - case __NR_getgid: - case __NR_geteuid: - case __NR_getegid: - case __NR_dup2: - case __NR_ftruncate: - case __NR_fstat: - case __NR_personality: - case __NR__llseek: - case __NR_readv: - case __NR_writev: - case __NR_getresuid: -#ifdef __NR_pread64 - case __NR_pread64: - case __NR_pwrite64: -#else - case __NR_pread: - case __NR_pwrite: -#endif - case __NR_ftruncate64: - case __NR_fstat64: - case __NR_fcntl: - case __NR_fcntl64: - case __NR_mmap: - case __NR_munmap: - case __NR_ioctl: - case __NR_uname: - case __NR_gettid: - case __NR_set_thread_area: - case __NR_get_thread_area: - case __NR_exit_group: + case A_NO: + return 0; + case A_FILENAME: + valid_filename(u->regs.ebx); return 1; - case __NR_time: - case __NR_alarm: - case __NR_pause: - case __NR_signal: - case __NR_fchmod: - case __NR_sigaction: - case __NR_sgetmask: - case __NR_ssetmask: - case __NR_sigsuspend: - case __NR_sigpending: - case __NR_getrlimit: - case __NR_getrusage: - case __NR_gettimeofday: - case __NR_select: - case __NR_readdir: - case __NR_setitimer: - case __NR_getitimer: - case __NR_sigreturn: - case __NR_mprotect: - case __NR_sigprocmask: - case __NR_getdents: - case __NR_getdents64: - case __NR__newselect: - case __NR_fdatasync: - case __NR_mremap: - case __NR_poll: - case __NR_getcwd: - case __NR_nanosleep: - case __NR_rt_sigreturn: - case __NR_rt_sigaction: - case __NR_rt_sigprocmask: - case __NR_rt_sigpending: - case __NR_rt_sigtimedwait: - case __NR_rt_sigqueueinfo: - case __NR_rt_sigsuspend: - case __NR_mmap2: - case __NR__sysctl: - return (filter_syscalls == 1); - case __NR_times: - return allow_times; + default: ; + } + + switch (sys) + { case __NR_kill: if (u->regs.ebx == box_pid) - die("Commited suicide by signal %d", (int)u->regs.ecx); + die("Committed suicide by signal %d", (int)u->regs.ecx); return 0; case __NR_tgkill: if (u->regs.ebx == box_pid && u->regs.ecx == box_pid) - die("Commited suicide by signal %d", (int)u->regs.edx); + die("Committed suicide by signal %d", (int)u->regs.edx); return 0; default: return 0; @@ -408,7 +721,7 @@ boxkeeper(void) if (WIFSIGNALED(stat)) { box_pid = 0; - die("Caught fatal signal %d", WTERMSIG(stat)); + die("Caught fatal signal %d%s", WTERMSIG(stat), (syscall_count ? "" : " during startup")); } if (WIFSTOPPED(stat)) { @@ -421,12 +734,20 @@ boxkeeper(void) die("ptrace(PTRACE_GETREGS): %m"); stop_count++; if (!stop_count) /* Traceme request */ - log(">> Traceme request caught\n"); + msg(">> Traceme request caught\n"); else if (stop_count & 1) /* Syscall entry */ { - log(">> Syscall %3ld (%08lx,%08lx,%08lx) ", u.regs.orig_eax, u.regs.ebx, u.regs.ecx, u.regs.edx); - syscall_count++; - if (!valid_syscall(&u)) + char namebuf[32]; + msg(">> Syscall %-12s (%08lx,%08lx,%08lx) ", syscall_name(u.regs.orig_eax, namebuf), u.regs.ebx, u.regs.ecx, u.regs.edx); + if (!exec_seen) + { + msg("[master] "); + if (u.regs.orig_eax == __NR_execve) + exec_seen = 1; + } + else if (valid_syscall(&u)) + syscall_count++; + else { /* * Unfortunately, PTRACE_KILL kills _after_ the syscall completes, @@ -437,16 +758,16 @@ boxkeeper(void) u.regs.orig_eax = 0xffffffff; if (ptrace(PTRACE_SETREGS, box_pid, NULL, &u) < 0) die("ptrace(PTRACE_SETREGS): %m"); - die("Forbidden syscall %d", sys); + die("Forbidden syscall %s", syscall_name(sys, namebuf)); } } else /* Syscall return */ - log("= %ld\n", u.regs.eax); + msg("= %ld\n", u.regs.eax); ptrace(PTRACE_SYSCALL, box_pid, 0, 0); } else if (sig != SIGSTOP && sig != SIGXCPU && sig != SIGXFSZ) { - log(">> Signal %d\n", sig); + msg(">> Signal %d\n", sig); ptrace(PTRACE_SYSCALL, box_pid, 0, sig); } else @@ -462,7 +783,6 @@ box_inside(int argc, char **argv) { struct rlimit rl; char *args[argc+1]; - char *env[1] = { NULL }; memcpy(args, argv, argc * sizeof(char *)); args[argc] = NULL; @@ -491,9 +811,15 @@ box_inside(int argc, char **argv) rl.rlim_cur = rl.rlim_max = 64; if (setrlimit(RLIMIT_NOFILE, &rl) < 0) die("setrlimit: %m"); - if (filter_syscalls && ptrace(PTRACE_TRACEME) < 0) - die("ptrace(PTRACE_TRACEME): %m"); - execve(args[0], args, (pass_environ ? environ : env)); + if (filter_syscalls) + { + if (ptrace(PTRACE_TRACEME) < 0) + die("ptrace(PTRACE_TRACEME): %m"); + /* Trick: Make sure that we are stopped until the boxkeeper wakes up. */ + signal(SIGCHLD, SIG_IGN); + raise(SIGCHLD); + } + execve(args[0], args, setup_environment()); die("execve(\"%s\"): %m", args[0]); } @@ -507,14 +833,20 @@ Usage: box [] -- \n\ Options:\n\ -a \tSet file access level (0=none, 1=cwd, 2=/etc,/lib,..., 3=whole fs, 9=no checks; needs -f)\n\ -c \tChange directory to first\n\ --e\t\tPass full environment of parent process\n\ +-e\t\tInherit full environment of the parent process\n\ +-E \tInherit the environment variable from the parent process\n\ +-E =\tSet the environment variable to ; unset it if is empty\n\ -f\t\tFilter system calls (-ff=very restricted)\n\ -i \tRedirect stdin from \n\ -m \tLimit address space to KB\n\ -o \tRedirect stdout to \n\ +-p \tPermit access to the specified path (or subtree if it ends with a `/')\n\ +-p =\tDefine action for the specified path (=yes/no)\n\ +-s \tPermit the specified syscall (be careful)\n\ +-s =\tDefine action for the specified syscall (=yes/no/file)\n\ -t