1 // Copyright 2013 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "components/nacl/loader/sandbox_linux/nacl_bpf_sandbox_linux.h"
6
7 #include <memory>
8 #include <utility>
9
10 #include "build/build_config.h"
11 #include "sandbox/sandbox_buildflags.h"
12
13 #if BUILDFLAG(USE_SECCOMP_BPF)
14
15 #include <errno.h>
16 #include <signal.h>
17 #include <sys/ptrace.h>
18 #include <sys/types.h>
19 #include <unistd.h>
20
21 #include "base/check_op.h"
22 #include "base/command_line.h"
23 #include "base/compiler_specific.h"
24 #include "base/files/scoped_file.h"
25 #include "base/functional/callback.h"
26 #include "base/notreached.h"
27 #include "components/nacl/common/nacl_switches.h"
28 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
29 #include "sandbox/linux/bpf_dsl/policy.h"
30 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
31 #include "sandbox/linux/system_headers/linux_syscalls.h"
32 #include "sandbox/policy/linux/sandbox_seccomp_bpf_linux.h"
33
34 #endif // BUILDFLAG(USE_SECCOMP_BPF)
35
36 namespace nacl {
37
38 #if BUILDFLAG(USE_SECCOMP_BPF)
39
40 namespace {
41
42 using sandbox::bpf_dsl::Allow;
43 using sandbox::bpf_dsl::Error;
44 using sandbox::bpf_dsl::ResultExpr;
45
46 class NaClBPFSandboxPolicy : public sandbox::bpf_dsl::Policy {
47 public:
NaClBPFSandboxPolicy()48 NaClBPFSandboxPolicy()
49 : baseline_policy_(
50 sandbox::policy::SandboxSeccompBPF::GetBaselinePolicy()),
51 policy_pid_(syscall(__NR_getpid)) {
52 const base::CommandLine* command_line =
53 base::CommandLine::ForCurrentProcess();
54 // nacl_process_host.cc doesn't always enable the debug stub when
55 // kEnableNaClDebug is passed, but it's OK to enable the extra syscalls
56 // whenever kEnableNaClDebug is passed.
57 enable_nacl_debug_ = command_line->HasSwitch(switches::kEnableNaClDebug);
58 }
59
60 NaClBPFSandboxPolicy(const NaClBPFSandboxPolicy&) = delete;
61 NaClBPFSandboxPolicy& operator=(const NaClBPFSandboxPolicy&) = delete;
62
~NaClBPFSandboxPolicy()63 ~NaClBPFSandboxPolicy() override {}
64
65 ResultExpr EvaluateSyscall(int system_call_number) const override;
InvalidSyscall() const66 ResultExpr InvalidSyscall() const override {
67 return baseline_policy_->InvalidSyscall();
68 }
69
70 private:
71 std::unique_ptr<sandbox::bpf_dsl::Policy> baseline_policy_;
72 bool enable_nacl_debug_;
73 const pid_t policy_pid_;
74 };
75
EvaluateSyscall(int sysno) const76 ResultExpr NaClBPFSandboxPolicy::EvaluateSyscall(int sysno) const {
77 DCHECK(baseline_policy_);
78
79 // EvaluateSyscall must be called from the same process that instantiated the
80 // NaClBPFSandboxPolicy.
81 DCHECK_EQ(policy_pid_, syscall(__NR_getpid));
82
83 // NaCl's GDB debug stub uses the following socket system calls. We only
84 // allow them when --enable-nacl-debug is specified.
85 if (enable_nacl_debug_) {
86 switch (sysno) {
87 // trusted/service_runtime/linux/thread_suspension.c needs sigwait(). Thread
88 // suspension is currently only used in the debug stub.
89 case __NR_rt_sigtimedwait:
90 return Allow();
91 #if defined(__x86_64__) || defined(__arm__) || defined(__mips__)
92 // transport_common.cc needs this.
93 case __NR_accept:
94 case __NR_setsockopt:
95 return Allow();
96 #elif defined(__i386__)
97 case __NR_socketcall:
98 return Allow();
99 #endif
100 default:
101 break;
102 }
103 }
104
105 switch (sysno) {
106 #if defined(__i386__) || defined(__mips__)
107 // Needed on i386 to set-up the custom segments.
108 case __NR_modify_ldt:
109 #endif
110 // NaCl uses custom signal stacks.
111 case __NR_sigaltstack:
112 // Below is fairly similar to the policy for a Chromium renderer.
113 #if defined(__i386__) || defined(__x86_64__) || defined(__mips__) || \
114 defined(__aarch64__)
115 case __NR_getrlimit:
116 #endif
117 #if defined(__i386__) || defined(__arm__)
118 case __NR_ugetrlimit:
119 #endif
120 // NaCl runtime uses flock to simulate POSIX behavior for pwrite.
121 case __NR_flock:
122 case __NR_pwrite64:
123 // set_robust_list(2) is generating quite a bit of logspam on Chrome OS
124 // (and probably on Linux too), and per its manpage it should never EPERM.
125 // Moreover, it also doesn't allow affecting other processes, since it
126 // doesn't take a |pid| argument.
127 // See crbug.com/1051197 for details.
128 case __NR_set_robust_list:
129 case __NR_sched_get_priority_max:
130 case __NR_sched_get_priority_min:
131 case __NR_sysinfo:
132 // __NR_times needed as clock() is called by CommandBufferHelper, which is
133 // used by NaCl applications that use Pepper's 3D interfaces.
134 // See crbug.com/264856 for details.
135 case __NR_times:
136 case __NR_uname:
137 return Allow();
138 case __NR_ioctl:
139 case __NR_ptrace:
140 return Error(EPERM);
141 case __NR_sched_getaffinity:
142 case __NR_sched_getparam:
143 case __NR_sched_getscheduler:
144 case __NR_sched_setscheduler:
145 return sandbox::RestrictSchedTarget(policy_pid_, sysno);
146 // NaClAddrSpaceBeforeAlloc needs prlimit64.
147 case __NR_prlimit64:
148 return sandbox::RestrictPrlimit64(policy_pid_);
149 // NaCl runtime exposes clock_getres to untrusted code.
150 case __NR_clock_getres:
151 return sandbox::RestrictClockID();
152 default:
153 return baseline_policy_->EvaluateSyscall(sysno);
154 }
155 NOTREACHED();
156 // GCC wants this.
157 return Error(EPERM);
158 }
159
RunSandboxSanityChecks()160 void RunSandboxSanityChecks() {
161 errno = 0;
162 // Make a ptrace request with an invalid PID.
163 long ptrace_ret = ptrace(PTRACE_PEEKUSER, -1 /* pid */, NULL, NULL);
164 CHECK_EQ(-1, ptrace_ret);
165 // Without the sandbox on, this ptrace call would ESRCH instead.
166 CHECK_EQ(EPERM, errno);
167 }
168
169 } // namespace
170
171 #else
172
173 #error "Seccomp-bpf disabled on supported architecture!"
174
175 #endif // BUILDFLAG(USE_SECCOMP_BPF)
176
InitializeBPFSandbox(base::ScopedFD proc_fd)177 bool InitializeBPFSandbox(base::ScopedFD proc_fd) {
178 #if BUILDFLAG(USE_SECCOMP_BPF)
179 if (sandbox::policy::SandboxSeccompBPF::StartSandboxWithExternalPolicy(
180 std::make_unique<NaClBPFSandboxPolicy>(), std::move(proc_fd))) {
181 RunSandboxSanityChecks();
182 return true;
183 }
184 #endif // BUILDFLAG(USE_SECCOMP_BPF)
185 return false;
186 }
187
188 } // namespace nacl
189