1 //===-- ChrootChecker.cpp - chroot usage checks ---------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines chroot checker, which checks improper use of chroot. 10 // 11 //===----------------------------------------------------------------------===// 12 13 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 14 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 15 #include "clang/StaticAnalyzer/Core/Checker.h" 16 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 17 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h" 18 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 20 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 21 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 22 #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" 23 24 using namespace clang; 25 using namespace ento; 26 27 namespace { 28 29 // enum value that represent the jail state 30 enum Kind { NO_CHROOT, ROOT_CHANGED, JAIL_ENTERED }; 31 32 bool isRootChanged(intptr_t k) { return k == ROOT_CHANGED; } 33 //bool isJailEntered(intptr_t k) { return k == JAIL_ENTERED; } 34 35 // This checker checks improper use of chroot. 36 // The state transition: 37 // NO_CHROOT ---chroot(path)--> ROOT_CHANGED ---chdir(/) --> JAIL_ENTERED 38 // | | 39 // ROOT_CHANGED<--chdir(..)-- JAIL_ENTERED<--chdir(..)-- 40 // | | 41 // bug<--foo()-- JAIL_ENTERED<--foo()-- 42 class ChrootChecker : public Checker<eval::Call, check::PreCall> { 43 // This bug refers to possibly break out of a chroot() jail. 44 const BugType BT_BreakJail{this, "Break out of jail"}; 45 46 const CallDescription Chroot{CDM::CLibrary, {"chroot"}, 1}, 47 Chdir{CDM::CLibrary, {"chdir"}, 1}; 48 49 public: 50 ChrootChecker() {} 51 52 static void *getTag() { 53 static int x; 54 return &x; 55 } 56 57 bool evalCall(const CallEvent &Call, CheckerContext &C) const; 58 void checkPreCall(const CallEvent &Call, CheckerContext &C) const; 59 60 private: 61 void evalChroot(const CallEvent &Call, CheckerContext &C) const; 62 void evalChdir(const CallEvent &Call, CheckerContext &C) const; 63 }; 64 65 } // end anonymous namespace 66 67 bool ChrootChecker::evalCall(const CallEvent &Call, CheckerContext &C) const { 68 if (Chroot.matches(Call)) { 69 evalChroot(Call, C); 70 return true; 71 } 72 if (Chdir.matches(Call)) { 73 evalChdir(Call, C); 74 return true; 75 } 76 77 return false; 78 } 79 80 void ChrootChecker::evalChroot(const CallEvent &Call, CheckerContext &C) const { 81 ProgramStateRef state = C.getState(); 82 ProgramStateManager &Mgr = state->getStateManager(); 83 84 // Once encouter a chroot(), set the enum value ROOT_CHANGED directly in 85 // the GDM. 86 state = Mgr.addGDM(state, ChrootChecker::getTag(), (void*) ROOT_CHANGED); 87 C.addTransition(state); 88 } 89 90 void ChrootChecker::evalChdir(const CallEvent &Call, CheckerContext &C) const { 91 ProgramStateRef state = C.getState(); 92 ProgramStateManager &Mgr = state->getStateManager(); 93 94 // If there are no jail state in the GDM, just return. 95 const void *k = state->FindGDM(ChrootChecker::getTag()); 96 if (!k) 97 return; 98 99 // After chdir("/"), enter the jail, set the enum value JAIL_ENTERED. 100 const Expr *ArgExpr = Call.getArgExpr(0); 101 SVal ArgVal = C.getSVal(ArgExpr); 102 103 if (const MemRegion *R = ArgVal.getAsRegion()) { 104 R = R->StripCasts(); 105 if (const StringRegion* StrRegion= dyn_cast<StringRegion>(R)) { 106 const StringLiteral* Str = StrRegion->getStringLiteral(); 107 if (Str->getString() == "/") 108 state = Mgr.addGDM(state, ChrootChecker::getTag(), 109 (void*) JAIL_ENTERED); 110 } 111 } 112 113 C.addTransition(state); 114 } 115 116 // Check the jail state before any function call except chroot and chdir(). 117 void ChrootChecker::checkPreCall(const CallEvent &Call, 118 CheckerContext &C) const { 119 // Ignore chroot and chdir. 120 if (matchesAny(Call, Chroot, Chdir)) 121 return; 122 123 // If jail state is ROOT_CHANGED, generate BugReport. 124 void *const* k = C.getState()->FindGDM(ChrootChecker::getTag()); 125 if (k) 126 if (isRootChanged((intptr_t) *k)) 127 if (ExplodedNode *N = C.generateNonFatalErrorNode()) { 128 constexpr llvm::StringLiteral Msg = 129 "No call of chdir(\"/\") immediately after chroot"; 130 C.emitReport( 131 std::make_unique<PathSensitiveBugReport>(BT_BreakJail, Msg, N)); 132 } 133 } 134 135 void ento::registerChrootChecker(CheckerManager &mgr) { 136 mgr.registerChecker<ChrootChecker>(); 137 } 138 139 bool ento::shouldRegisterChrootChecker(const CheckerManager &mgr) { 140 return true; 141 } 142