1 /*
2  * Copyright (C) 2024 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "host/commands/process_sandboxer/policies.h"
18 
19 #include <linux/sockios.h>
20 #include <netinet/in.h>
21 #include <netinet/tcp.h>
22 #include <sys/ioctl.h>
23 #include <sys/mman.h>
24 #include <sys/prctl.h>
25 #include <sys/socket.h>
26 #include <syscall.h>
27 
28 #include <sandboxed_api/sandbox2/allow_unrestricted_networking.h>
29 #include <sandboxed_api/sandbox2/policybuilder.h>
30 #include <sandboxed_api/sandbox2/util/bpf_helper.h>
31 
32 #include "host/commands/process_sandboxer/filesystem.h"
33 
34 namespace cuttlefish::process_sandboxer {
35 
WebRtcPolicy(const HostInfo & host)36 sandbox2::PolicyBuilder WebRtcPolicy(const HostInfo& host) {
37   return BaselinePolicy(host, host.HostToolExe("webRTC"))
38       .AddDirectory(host.log_dir, /* is_ro= */ false)
39       .AddDirectory(
40           JoinPath(host.host_artifacts_path, "/usr/share/webrtc/assets"))
41       .AddDirectory(host.instance_uds_dir, /* is_ro= */ false)
42       .AddDirectory(host.vsock_device_dir, /* is_ro= */ false)
43       .AddDirectory(JoinPath(host.runtime_dir, "recording"), /* is_ro= */ false)
44       .AddFile(host.cuttlefish_config_path)
45       .AddFile("/dev/urandom")
46       .AddFile("/run/cuttlefish/operator")
47       // Shared memory with crosvm for audio
48       .AddPolicyOnMmap([](bpf_labels& labels) -> std::vector<sock_filter> {
49         return {
50             ARG_32(2),  // prot
51             JNE32(PROT_READ | PROT_WRITE, JUMP(&labels, cf_webrtc_mmap_end)),
52             ARG_32(3),  // flags
53             JEQ32(MAP_SHARED, ALLOW),
54             LABEL(&labels, cf_webrtc_mmap_end),
55         };
56       })
57       .AddPolicyOnSyscall(
58           __NR_getsockopt,
59           [](bpf_labels& labels) -> std::vector<sock_filter> {
60             return {
61                 ARG_32(1),  // level
62                 JNE32(SOL_SOCKET, JUMP(&labels, cf_webrtc_getsockopt_end)),
63                 ARG_32(2),  // optname
64                 JEQ32(SO_ERROR, ALLOW),
65                 JEQ32(SO_PEERCRED, ALLOW),
66                 LABEL(&labels, cf_webrtc_getsockopt_end),
67             };
68           })
69       .AddPolicyOnSyscall(__NR_ioctl, {ARG_32(1), JEQ32(SIOCGSTAMP, ALLOW),
70                                        JEQ32(FIONREAD, ALLOW)})
71       .AddPolicyOnSyscall(__NR_madvise,
72                           {ARG_32(2), JEQ32(MADV_WIPEONFORK, ALLOW),
73                            JEQ32(MADV_DONTNEED, ALLOW),
74                            // TODO: schuffelen - find out what this is
75                            JEQ32(0xffffffff, ALLOW)})
76       .AddPolicyOnSyscall(__NR_prctl,
77                           {ARG_32(0), JEQ32(PR_CAPBSET_READ, ALLOW)})
78       .AddPolicyOnSyscall(
79           __NR_setsockopt,
80           [](bpf_labels& labels) -> std::vector<sock_filter> {
81             return {
82                 ARG_32(1),  // level
83                 JEQ32(SOL_IP, JUMP(&labels, cf_webrtc_setsockopt_ip)),
84                 JEQ32(SOL_IPV6, JUMP(&labels, cf_webrtc_setsockopt_ipv6)),
85                 JEQ32(SOL_SOCKET, JUMP(&labels, cf_webrtc_setsockopt_sol)),
86                 JNE32(IPPROTO_TCP, JUMP(&labels, cf_webrtc_setsockopt_end)),
87                 // IPPROTO_TCP
88                 ARG_32(2),  // optname
89                 JEQ32(TCP_NODELAY, ALLOW),
90                 JUMP(&labels, cf_webrtc_setsockopt_end),
91                 // SOL_IP
92                 LABEL(&labels, cf_webrtc_setsockopt_ip),
93                 ARG_32(2),  // optname
94                 JEQ32(IP_RECVERR, ALLOW),
95                 JEQ32(IP_TOS, ALLOW),
96                 JEQ32(IP_RETOPTS, ALLOW),
97                 JEQ32(IP_PKTINFO, ALLOW),
98                 JUMP(&labels, cf_webrtc_setsockopt_end),
99                 // SOL_IPV6
100                 LABEL(&labels, cf_webrtc_setsockopt_ipv6),
101                 ARG_32(2),  // optname
102                 JEQ32(IPV6_TCLASS, ALLOW),
103                 JUMP(&labels, cf_webrtc_setsockopt_end),
104                 // SOL_SOCKET
105                 LABEL(&labels, cf_webrtc_setsockopt_sol),
106                 ARG_32(2),  // optname
107                 JEQ32(SO_REUSEADDR, ALLOW),
108                 JEQ32(SO_SNDBUF, ALLOW),
109                 JEQ32(SO_RCVBUF, ALLOW),
110                 LABEL(&labels, cf_webrtc_setsockopt_end),
111             };
112           })
113       .AddPolicyOnSyscall(
114           __NR_socket, {ARG_32(0), JEQ32(AF_INET, ALLOW), JEQ32(AF_UNIX, ALLOW),
115                         JEQ32(AF_INET6, ALLOW),
116                         // webrtc/rtc_base/ifaddrs_android.cc
117                         JEQ32(AF_NETLINK, ALLOW), JEQ32(AF_VSOCK, ALLOW)})
118       .Allow(sandbox2::UnrestrictedNetworking())
119       .AllowEpoll()
120       .AllowEpollWait()
121       .AllowEventFd()
122       .AllowGetIDs()
123       .AllowHandleSignals()
124       .AllowPipe()
125       .AllowPrctlSetName()
126       .AllowSafeFcntl()
127       .AllowSelect()
128       .AllowSleep()
129       .AllowSyscall(__NR_accept)
130       .AllowSyscall(__NR_accept4)
131       .AllowSyscall(__NR_bind)
132       .AllowSyscall(__NR_clone)  // Multithreading
133       .AllowSyscall(__NR_connect)
134       .AllowSyscall(__NR_ftruncate)
135       .AllowSyscall(__NR_getpeername)
136       .AllowSyscall(__NR_getsockname)
137       .AllowSyscall(__NR_listen)
138       .AllowSyscall(__NR_memfd_create)
139       .AllowSyscall(__NR_recvfrom)
140       .AllowSyscall(__NR_recvmsg)
141       .AllowSyscall(__NR_sched_get_priority_max)
142       .AllowSyscall(__NR_sched_get_priority_min)
143       .AllowSyscall(__NR_sched_getparam)
144       .AllowSyscall(__NR_sched_getscheduler)
145       .AllowSyscall(__NR_sched_setscheduler)
146       .AllowSyscall(__NR_sched_yield)
147       .AllowSyscall(__NR_sendmsg)
148       .AllowSyscall(__NR_sendmmsg)
149       .AllowSyscall(__NR_sendto)
150       .AllowSyscall(__NR_shutdown)
151       .AllowSyscall(__NR_socketpair)
152       .AllowTCGETS();
153 }
154 
155 }  // namespace cuttlefish::process_sandboxer
156