syscall_parameters_restrictions_unittests.cc 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379
  1. // Copyright 2014 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h"
  5. #include <errno.h>
  6. #include <fcntl.h>
  7. #include <linux/elf.h>
  8. #include <sched.h>
  9. #include <sys/prctl.h>
  10. #include <sys/ptrace.h>
  11. #include <sys/resource.h>
  12. #include <sys/syscall.h>
  13. #include <sys/types.h>
  14. #include <sys/user.h>
  15. #include <time.h>
  16. #include <unistd.h>
  17. #include "base/bind.h"
  18. #include "base/posix/eintr_wrapper.h"
  19. #include "base/synchronization/waitable_event.h"
  20. #include "base/system/sys_info.h"
  21. #include "base/task/single_thread_task_runner.h"
  22. #include "base/threading/thread.h"
  23. #include "base/time/time.h"
  24. #include "build/build_config.h"
  25. #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
  26. #include "sandbox/linux/bpf_dsl/policy.h"
  27. #include "sandbox/linux/seccomp-bpf-helpers/sigsys_handlers.h"
  28. #include "sandbox/linux/seccomp-bpf/bpf_tests.h"
  29. #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
  30. #include "sandbox/linux/seccomp-bpf/syscall.h"
  31. #include "sandbox/linux/services/syscall_wrappers.h"
  32. #include "sandbox/linux/system_headers/linux_ptrace.h"
  33. #include "sandbox/linux/system_headers/linux_syscalls.h"
  34. #include "sandbox/linux/system_headers/linux_time.h"
  35. #include "sandbox/linux/tests/unit_tests.h"
  36. namespace sandbox {
  37. namespace {
  38. // NOTE: most of the parameter restrictions are tested in
  39. // baseline_policy_unittest.cc as a more end-to-end test.
  40. using sandbox::bpf_dsl::Allow;
  41. using sandbox::bpf_dsl::ResultExpr;
  42. class RestrictClockIdPolicy : public bpf_dsl::Policy {
  43. public:
  44. RestrictClockIdPolicy() {}
  45. ~RestrictClockIdPolicy() override {}
  46. ResultExpr EvaluateSyscall(int sysno) const override {
  47. switch (sysno) {
  48. case __NR_clock_gettime:
  49. #if defined(__NR_clock_gettime64)
  50. case __NR_clock_gettime64:
  51. #endif
  52. case __NR_clock_getres:
  53. case __NR_clock_nanosleep:
  54. #if defined(__NR_clock_nanosleep_time64)
  55. case __NR_clock_nanosleep_time64:
  56. #endif
  57. return RestrictClockID();
  58. default:
  59. return Allow();
  60. }
  61. }
  62. };
  63. void CheckClock(clockid_t clockid) {
  64. struct timespec ts;
  65. ts.tv_sec = -1;
  66. ts.tv_nsec = -1;
  67. BPF_ASSERT_EQ(0, clock_getres(clockid, &ts));
  68. BPF_ASSERT_EQ(0, ts.tv_sec);
  69. BPF_ASSERT_LE(0, ts.tv_nsec);
  70. ts.tv_sec = -1;
  71. ts.tv_nsec = -1;
  72. BPF_ASSERT_EQ(0, clock_gettime(clockid, &ts));
  73. BPF_ASSERT_LE(0, ts.tv_sec);
  74. BPF_ASSERT_LE(0, ts.tv_nsec);
  75. }
  76. BPF_TEST_C(ParameterRestrictions,
  77. clock_gettime_allowed,
  78. RestrictClockIdPolicy) {
  79. CheckClock(CLOCK_MONOTONIC);
  80. CheckClock(CLOCK_MONOTONIC_COARSE);
  81. CheckClock(CLOCK_MONOTONIC_RAW);
  82. CheckClock(CLOCK_PROCESS_CPUTIME_ID);
  83. CheckClock(CLOCK_BOOTTIME);
  84. CheckClock(CLOCK_REALTIME);
  85. CheckClock(CLOCK_REALTIME_COARSE);
  86. CheckClock(CLOCK_THREAD_CPUTIME_ID);
  87. #if BUILDFLAG(IS_ANDROID)
  88. clockid_t clock_id;
  89. pthread_getcpuclockid(pthread_self(), &clock_id);
  90. CheckClock(clock_id);
  91. #endif
  92. }
  93. void CheckClockNanosleep(clockid_t clockid) {
  94. struct timespec ts;
  95. struct timespec out_ts;
  96. ts.tv_sec = 0;
  97. ts.tv_nsec = 0;
  98. clock_nanosleep(clockid, 0, &ts, &out_ts);
  99. }
  100. BPF_TEST_C(ParameterRestrictions,
  101. clock_nanosleep_allowed,
  102. RestrictClockIdPolicy) {
  103. CheckClockNanosleep(CLOCK_MONOTONIC);
  104. CheckClockNanosleep(CLOCK_MONOTONIC_COARSE);
  105. CheckClockNanosleep(CLOCK_MONOTONIC_RAW);
  106. CheckClockNanosleep(CLOCK_BOOTTIME);
  107. CheckClockNanosleep(CLOCK_REALTIME);
  108. CheckClockNanosleep(CLOCK_REALTIME_COARSE);
  109. }
  110. BPF_DEATH_TEST_C(ParameterRestrictions,
  111. clock_gettime_crash_clock_fd,
  112. DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
  113. RestrictClockIdPolicy) {
  114. struct timespec ts;
  115. syscall(SYS_clock_gettime, (~0) | CLOCKFD, &ts);
  116. }
  117. BPF_DEATH_TEST_C(ParameterRestrictions,
  118. clock_nanosleep_crash_clock_fd,
  119. DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
  120. RestrictClockIdPolicy) {
  121. struct timespec ts;
  122. struct timespec out_ts;
  123. ts.tv_sec = 0;
  124. ts.tv_nsec = 0;
  125. syscall(SYS_clock_nanosleep, (~0) | CLOCKFD, 0, &ts, &out_ts);
  126. }
  127. #if !BUILDFLAG(IS_ANDROID)
  128. BPF_DEATH_TEST_C(ParameterRestrictions,
  129. clock_gettime_crash_cpu_clock,
  130. DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
  131. RestrictClockIdPolicy) {
  132. // We can't use clock_getcpuclockid() because it's not implemented in newlib,
  133. // and it might not work inside the sandbox anyway.
  134. const pid_t kInitPID = 1;
  135. const clockid_t kInitCPUClockID =
  136. MAKE_PROCESS_CPUCLOCK(kInitPID, CPUCLOCK_SCHED);
  137. struct timespec ts;
  138. clock_gettime(kInitCPUClockID, &ts);
  139. }
  140. #endif // !BUILDFLAG(IS_ANDROID)
  141. class RestrictSchedPolicy : public bpf_dsl::Policy {
  142. public:
  143. RestrictSchedPolicy() {}
  144. ~RestrictSchedPolicy() override {}
  145. ResultExpr EvaluateSyscall(int sysno) const override {
  146. switch (sysno) {
  147. case __NR_sched_getparam:
  148. return RestrictSchedTarget(getpid(), sysno);
  149. default:
  150. return Allow();
  151. }
  152. }
  153. };
  154. void CheckSchedGetParam(pid_t pid, struct sched_param* param) {
  155. BPF_ASSERT_EQ(0, sched_getparam(pid, param));
  156. }
  157. void SchedGetParamThread(base::WaitableEvent* thread_run) {
  158. const pid_t pid = getpid();
  159. const pid_t tid = sys_gettid();
  160. BPF_ASSERT_NE(pid, tid);
  161. struct sched_param current_pid_param;
  162. CheckSchedGetParam(pid, &current_pid_param);
  163. struct sched_param zero_param;
  164. CheckSchedGetParam(0, &zero_param);
  165. struct sched_param tid_param;
  166. CheckSchedGetParam(tid, &tid_param);
  167. BPF_ASSERT_EQ(zero_param.sched_priority, tid_param.sched_priority);
  168. // Verify that the SIGSYS handler sets errno properly.
  169. errno = 0;
  170. BPF_ASSERT_EQ(-1, sched_getparam(tid, NULL));
  171. BPF_ASSERT_EQ(EINVAL, errno);
  172. thread_run->Signal();
  173. }
  174. BPF_TEST_C(ParameterRestrictions,
  175. sched_getparam_allowed,
  176. RestrictSchedPolicy) {
  177. base::WaitableEvent thread_run(
  178. base::WaitableEvent::ResetPolicy::MANUAL,
  179. base::WaitableEvent::InitialState::NOT_SIGNALED);
  180. // Run the actual test in a new thread so that the current pid and tid are
  181. // different.
  182. base::Thread getparam_thread("sched_getparam_thread");
  183. BPF_ASSERT(getparam_thread.Start());
  184. getparam_thread.task_runner()->PostTask(
  185. FROM_HERE, base::BindOnce(&SchedGetParamThread, &thread_run));
  186. BPF_ASSERT(thread_run.TimedWait(base::Milliseconds(5000)));
  187. getparam_thread.Stop();
  188. }
  189. BPF_DEATH_TEST_C(ParameterRestrictions,
  190. sched_getparam_crash_non_zero,
  191. DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
  192. RestrictSchedPolicy) {
  193. const pid_t kInitPID = 1;
  194. struct sched_param param;
  195. sched_getparam(kInitPID, &param);
  196. }
  197. class RestrictPrlimit64Policy : public bpf_dsl::Policy {
  198. public:
  199. RestrictPrlimit64Policy() {}
  200. ~RestrictPrlimit64Policy() override {}
  201. ResultExpr EvaluateSyscall(int sysno) const override {
  202. switch (sysno) {
  203. case __NR_prlimit64:
  204. return RestrictPrlimit64(getpid());
  205. default:
  206. return Allow();
  207. }
  208. }
  209. };
  210. BPF_TEST_C(ParameterRestrictions, prlimit64_allowed, RestrictPrlimit64Policy) {
  211. BPF_ASSERT_EQ(0, sys_prlimit64(0, RLIMIT_AS, NULL, NULL));
  212. BPF_ASSERT_EQ(0, sys_prlimit64(getpid(), RLIMIT_AS, NULL, NULL));
  213. }
  214. BPF_DEATH_TEST_C(ParameterRestrictions,
  215. prlimit64_crash_not_self,
  216. DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
  217. RestrictPrlimit64Policy) {
  218. const pid_t kInitPID = 1;
  219. BPF_ASSERT_NE(kInitPID, getpid());
  220. sys_prlimit64(kInitPID, RLIMIT_AS, NULL, NULL);
  221. }
  222. class RestrictGetrusagePolicy : public bpf_dsl::Policy {
  223. public:
  224. RestrictGetrusagePolicy() {}
  225. ~RestrictGetrusagePolicy() override {}
  226. ResultExpr EvaluateSyscall(int sysno) const override {
  227. switch (sysno) {
  228. case __NR_getrusage:
  229. return RestrictGetrusage();
  230. default:
  231. return Allow();
  232. }
  233. }
  234. };
  235. BPF_TEST_C(ParameterRestrictions, getrusage_allowed, RestrictGetrusagePolicy) {
  236. struct rusage usage;
  237. BPF_ASSERT_EQ(0, getrusage(RUSAGE_SELF, &usage));
  238. }
  239. BPF_DEATH_TEST_C(ParameterRestrictions,
  240. getrusage_crash_not_self,
  241. DEATH_SEGV_MESSAGE(sandbox::GetErrorMessageContentForTests()),
  242. RestrictGetrusagePolicy) {
  243. struct rusage usage;
  244. getrusage(RUSAGE_CHILDREN, &usage);
  245. }
  246. // The following ptrace() tests do not actually set up a tracer/tracee
  247. // relationship, so allowed operations return ESRCH errors. Blocked operations
  248. // are tested with death tests.
  249. class RestrictPtracePolicy : public bpf_dsl::Policy {
  250. public:
  251. RestrictPtracePolicy() = default;
  252. ~RestrictPtracePolicy() override = default;
  253. ResultExpr EvaluateSyscall(int sysno) const override {
  254. switch (sysno) {
  255. case __NR_ptrace:
  256. return RestrictPtrace();
  257. default:
  258. return Allow();
  259. }
  260. }
  261. };
  262. BPF_TEST_C(ParameterRestrictions,
  263. ptrace_getregs_allowed,
  264. RestrictPtracePolicy) {
  265. #if defined(__arm__)
  266. user_regs regs;
  267. #else
  268. user_regs_struct regs;
  269. #endif
  270. iovec iov;
  271. iov.iov_base = &regs;
  272. iov.iov_len = sizeof(regs);
  273. errno = 0;
  274. int rv = ptrace(PTRACE_GETREGSET, getpid(),
  275. reinterpret_cast<void*>(NT_PRSTATUS), &iov);
  276. BPF_ASSERT_EQ(-1, rv);
  277. BPF_ASSERT_EQ(ESRCH, errno);
  278. }
  279. BPF_DEATH_TEST_C(
  280. ParameterRestrictions,
  281. ptrace_syscall_blocked,
  282. DEATH_SEGV_MESSAGE(sandbox::GetPtraceErrorMessageContentForTests()),
  283. RestrictPtracePolicy) {
  284. ptrace(PTRACE_SYSCALL, getpid(), nullptr, nullptr);
  285. }
  286. BPF_DEATH_TEST_C(
  287. ParameterRestrictions,
  288. ptrace_setregs_blocked,
  289. DEATH_SEGV_MESSAGE(sandbox::GetPtraceErrorMessageContentForTests()),
  290. RestrictPtracePolicy) {
  291. #if defined(__arm__)
  292. user_regs regs{};
  293. #else
  294. user_regs_struct regs{};
  295. #endif
  296. iovec iov;
  297. iov.iov_base = &regs;
  298. iov.iov_len = sizeof(regs);
  299. errno = 0;
  300. ptrace(PTRACE_SETREGSET, getpid(), reinterpret_cast<void*>(NT_PRSTATUS),
  301. &iov);
  302. }
  303. #if defined(__aarch64__)
  304. BPF_DEATH_TEST_C(
  305. ParameterRestrictions,
  306. ptrace_getregs_nt_arm_paca_keys_blocked,
  307. DEATH_SEGV_MESSAGE(sandbox::GetPtraceErrorMessageContentForTests()),
  308. RestrictPtracePolicy) {
  309. user_regs_struct regs{};
  310. iovec iov;
  311. iov.iov_base = &regs;
  312. iov.iov_len = sizeof(regs);
  313. errno = 0;
  314. ptrace(PTRACE_GETREGSET, getpid(), reinterpret_cast<void*>(NT_ARM_PACA_KEYS),
  315. &iov);
  316. }
  317. BPF_DEATH_TEST_C(
  318. ParameterRestrictions,
  319. ptrace_getregs_nt_arm_pacg_keys_blocked,
  320. DEATH_SEGV_MESSAGE(sandbox::GetPtraceErrorMessageContentForTests()),
  321. RestrictPtracePolicy) {
  322. user_regs_struct regs{};
  323. iovec iov;
  324. iov.iov_base = &regs;
  325. iov.iov_len = sizeof(regs);
  326. errno = 0;
  327. ptrace(PTRACE_GETREGSET, getpid(), reinterpret_cast<void*>(NT_ARM_PACG_KEYS),
  328. &iov);
  329. }
  330. #endif
  331. } // namespace
  332. } // namespace sandbox