1 /*
2 * Copyright (C) 2024 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "host/commands/process_sandboxer/policies.h"
18
19 #include <sys/mman.h>
20
21 #include <sandboxed_api/sandbox2/policybuilder.h>
22 #include <sandboxed_api/sandbox2/util/bpf_helper.h>
23
24 #include "host/commands/process_sandboxer/filesystem.h"
25
26 namespace cuttlefish::process_sandboxer {
27
BaselinePolicy(const HostInfo & host,std::string_view exe)28 sandbox2::PolicyBuilder BaselinePolicy(const HostInfo& host,
29 std::string_view exe) {
30 return sandbox2::PolicyBuilder()
31 .AddLibrariesForBinary(exe, JoinPath(host.host_artifacts_path, "lib64"))
32 // For dynamic linking and memory allocation
33 .AllowDynamicStartup()
34 .AllowExit()
35 .AllowGetPIDs()
36 .AllowGetRandom()
37 // Observed by `strace` on `socket_vsock_proxy` with x86_64 AOSP `glibc`.
38 .AddPolicyOnMmap([](bpf_labels& labels) -> std::vector<sock_filter> {
39 return {
40 ARG_32(2), // prot
41 JEQ32(PROT_NONE, JUMP(&labels, cf_mmap_prot_none)),
42 JEQ32(PROT_READ, JUMP(&labels, cf_mmap_prot_read)),
43 JEQ32(PROT_READ | PROT_EXEC, JUMP(&labels, cf_mmap_prot_read_exec)),
44 JNE32(PROT_READ | PROT_WRITE, JUMP(&labels, cf_mmap_prot_end)),
45 // PROT_READ | PROT_WRITE
46 ARG_32(3), // flags
47 JEQ32(MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, ALLOW),
48 JUMP(&labels, cf_mmap_prot_end),
49 // PROT_READ | PROT_EXEC
50 LABEL(&labels, cf_mmap_prot_read_exec),
51 ARG_32(3), // flags
52 JEQ32(MAP_PRIVATE | MAP_DENYWRITE, ALLOW),
53 JEQ32(MAP_PRIVATE | MAP_FIXED | MAP_DENYWRITE, ALLOW),
54 JUMP(&labels, cf_mmap_prot_end),
55 // PROT_READ
56 LABEL(&labels, cf_mmap_prot_read),
57 ARG_32(3), // flags
58 JEQ32(MAP_PRIVATE | MAP_ANONYMOUS, ALLOW),
59 JEQ32(MAP_PRIVATE | MAP_DENYWRITE, ALLOW),
60 JEQ32(MAP_PRIVATE | MAP_FIXED | MAP_DENYWRITE, ALLOW),
61 JEQ32(MAP_PRIVATE, ALLOW),
62 JUMP(&labels, cf_mmap_prot_end),
63 // PROT_NONE
64 LABEL(&labels, cf_mmap_prot_none),
65 ARG_32(3), // flags
66 JEQ32(MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, ALLOW),
67 JEQ32(MAP_PRIVATE | MAP_ANONYMOUS, ALLOW),
68
69 LABEL(&labels, cf_mmap_prot_end),
70 };
71 })
72 .AllowReadlink()
73 .AllowRestartableSequences(sandbox2::PolicyBuilder::kAllowSlowFences)
74 .AllowWrite();
75 }
76
77 } // namespace cuttlefish::process_sandboxer
78