1 // Copyright 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 // Implementation file for the sandbox2::sanitizer namespace.
16
17 #include "sandboxed_api/sandbox2/sanitizer.h"
18
19 #include <fcntl.h>
20 #include <sys/prctl.h>
21 #include <syscall.h>
22 #include <unistd.h>
23
24 #include <cerrno>
25 #include <csignal>
26 #include <string>
27 #include <vector>
28
29 #include "absl/container/flat_hash_set.h"
30 #include "absl/status/status.h"
31 #include "absl/status/statusor.h"
32 #include "absl/strings/numbers.h"
33 #include "absl/strings/str_cat.h"
34 #include "sandboxed_api/sandbox2/util.h"
35 #include "sandboxed_api/util/fileops.h"
36 #include "sandboxed_api/util/raw_logging.h"
37 #include "sandboxed_api/util/status_macros.h"
38
39 #if defined(ABSL_HAVE_ADDRESS_SANITIZER) || \
40 defined(ABSL_HAVE_HWADDRESS_SANITIZER) || \
41 defined(ABSL_HAVE_LEAK_SANITIZER) || \
42 defined(ABSL_HAVE_MEMORY_SANITIZER) || defined(ABSL_HAVE_THREAD_SANITIZER)
43 #include <sanitizer/common_interface_defs.h>
44 #endif
45
46 namespace sandbox2::sanitizer {
47 namespace {
48
49 namespace file_util = ::sapi::file_util;
50
51 constexpr char kProcSelfFd[] = "/proc/self/fd";
52
53 // Reads filenames inside the directory and converts them to numerical values.
ListNumericalDirectoryEntries(const std::string & directory)54 absl::StatusOr<absl::flat_hash_set<int>> ListNumericalDirectoryEntries(
55 const std::string& directory) {
56 absl::flat_hash_set<int> result;
57 std::vector<std::string> entries;
58 std::string error;
59 if (!file_util::fileops::ListDirectoryEntries(directory, &entries, &error)) {
60 return absl::InternalError(absl::StrCat("List directory entries for '",
61 directory, "' failed: ", error));
62 }
63 result.reserve(entries.size());
64 for (const auto& entry : entries) {
65 int num;
66 if (!absl::SimpleAtoi(entry, &num)) {
67 return absl::InternalError(
68 absl::StrCat("Cannot convert ", entry, " to a number"));
69 }
70 result.insert(num);
71 }
72 return result;
73 }
74
75 } // namespace
76
GetListOfFDs()77 absl::StatusOr<absl::flat_hash_set<int>> GetListOfFDs() {
78 SAPI_ASSIGN_OR_RETURN(absl::flat_hash_set<int> fds,
79 ListNumericalDirectoryEntries(kProcSelfFd));
80
81 // Exclude the dirfd which was opened in ListDirectoryEntries.
82 for (auto it = fds.begin(), end = fds.end(); it != end; ++it) {
83 if (access(absl::StrCat(kProcSelfFd, "/", *it).c_str(), F_OK) != 0) {
84 fds.erase(it);
85 break;
86 }
87 }
88 return fds;
89 }
90
GetListOfTasks(int pid)91 absl::StatusOr<absl::flat_hash_set<int>> GetListOfTasks(int pid) {
92 const std::string task_dir = absl::StrCat("/proc/", pid, "/task");
93 return ListNumericalDirectoryEntries(task_dir);
94 }
95
CloseAllFDsExcept(const absl::flat_hash_set<int> & fd_exceptions)96 absl::Status CloseAllFDsExcept(const absl::flat_hash_set<int>& fd_exceptions) {
97 SAPI_ASSIGN_OR_RETURN(absl::flat_hash_set<int> fds, GetListOfFDs());
98
99 for (const auto& fd : fds) {
100 if (fd_exceptions.find(fd) != fd_exceptions.end()) {
101 continue;
102 }
103 SAPI_RAW_VLOG(2, "Closing FD:%d", fd);
104 close(fd);
105 }
106 return absl::OkStatus();
107 }
108
MarkAllFDsAsCOEExcept(const absl::flat_hash_set<int> & fd_exceptions)109 absl::Status MarkAllFDsAsCOEExcept(
110 const absl::flat_hash_set<int>& fd_exceptions) {
111 SAPI_ASSIGN_OR_RETURN(absl::flat_hash_set<int> fds, GetListOfFDs());
112
113 for (const auto& fd : fds) {
114 if (fd_exceptions.find(fd) != fd_exceptions.end()) {
115 continue;
116 }
117
118 SAPI_RAW_VLOG(2, "Marking FD:%d as close-on-exec", fd);
119
120 int flags = fcntl(fd, F_GETFD);
121 if (flags == -1) {
122 return absl::ErrnoToStatus(
123 errno, absl::StrCat("fcntl(", fd, ", F_GETFD) failed"));
124 }
125 if (fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1) {
126 return absl::ErrnoToStatus(
127 errno, absl::StrCat("fcntl(", fd, ", F_SETFD, ", flags,
128 " | FD_CLOEXEC) failed"));
129 }
130 }
131
132 return absl::OkStatus();
133 }
134
GetNumberOfThreads(int pid)135 int GetNumberOfThreads(int pid) {
136 std::string thread_str = util::GetProcStatusLine(pid, "Threads");
137 if (thread_str.empty()) {
138 return -1;
139 }
140 int threads;
141 if (!absl::SimpleAtoi(thread_str, &threads)) {
142 SAPI_RAW_LOG(ERROR, "Couldn't convert '%s' to a number",
143 thread_str.c_str());
144 return -1;
145 }
146 SAPI_RAW_VLOG(1, "Found %d threads in pid: %d", threads, pid);
147 return threads;
148 }
149
WaitForSanitizer()150 void WaitForSanitizer() {
151 #if defined(ABSL_HAVE_ADDRESS_SANITIZER) || \
152 defined(ABSL_HAVE_HWADDRESS_SANITIZER) || \
153 defined(ABSL_HAVE_LEAK_SANITIZER) || \
154 defined(ABSL_HAVE_MEMORY_SANITIZER) || defined(ABSL_HAVE_THREAD_SANITIZER)
155 static bool ABSL_ATTRIBUTE_UNUSED dummy_once = []() {
156 __sanitizer_sandbox_on_notify(nullptr);
157 return true;
158 }();
159 const pid_t pid = getpid();
160 int threads;
161 for (int retry = 0; retry < 10; ++retry) {
162 threads = GetNumberOfThreads(pid);
163 if (threads == -1 || threads == 1) {
164 break;
165 }
166 absl::SleepFor(absl::Milliseconds(100));
167 }
168 #endif
169 }
170
SanitizeCurrentProcess(const absl::flat_hash_set<int> & fd_exceptions,bool close_fds)171 absl::Status SanitizeCurrentProcess(
172 const absl::flat_hash_set<int>& fd_exceptions, bool close_fds) {
173 SAPI_RAW_VLOG(1, "Sanitizing PID: %zu, close_fds: %d", syscall(__NR_getpid),
174 close_fds);
175
176 // Put process in a separate session (and a new process group).
177 setsid();
178
179 // If the parent goes down, so should we.
180 if (prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0) != 0) {
181 return absl::ErrnoToStatus(errno,
182 "prctl(PR_SET_PDEATHSIG, SIGKILL) failed");
183 }
184
185 // Close or mark as close-on-exec open file descriptors.
186 return close_fds ? CloseAllFDsExcept(fd_exceptions)
187 : MarkAllFDsAsCOEExcept(fd_exceptions);
188 }
189
190 } // namespace sandbox2::sanitizer
191