xref: /freebsd/crypto/openssh/sandbox-seccomp-filter.c (revision a0ee8cc636cd5c2374ec44ca71226564ea0bca95)
1 /*
2  * Copyright (c) 2012 Will Drewry <wad@dataspill.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 /*
18  * Uncomment the SANDBOX_SECCOMP_FILTER_DEBUG macro below to help diagnose
19  * filter breakage during development. *Do not* use this in production,
20  * as it relies on making library calls that are unsafe in signal context.
21  *
22  * Instead, live systems the auditctl(8) may be used to monitor failures.
23  * E.g.
24  *   auditctl -a task,always -F uid=<privsep uid>
25  */
26 /* #define SANDBOX_SECCOMP_FILTER_DEBUG 1 */
27 
28 /* XXX it should be possible to do logging via the log socket safely */
29 
30 #ifdef SANDBOX_SECCOMP_FILTER_DEBUG
31 /* Use the kernel headers in case of an older toolchain. */
32 # include <asm/siginfo.h>
33 # define __have_siginfo_t 1
34 # define __have_sigval_t 1
35 # define __have_sigevent_t 1
36 #endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
37 
38 #include "includes.h"
39 
40 #ifdef SANDBOX_SECCOMP_FILTER
41 
42 #include <sys/types.h>
43 #include <sys/resource.h>
44 #include <sys/prctl.h>
45 
46 #include <linux/audit.h>
47 #include <linux/filter.h>
48 #include <linux/seccomp.h>
49 #include <elf.h>
50 
51 #include <asm/unistd.h>
52 
53 #include <errno.h>
54 #include <signal.h>
55 #include <stdarg.h>
56 #include <stddef.h>  /* for offsetof */
57 #include <stdio.h>
58 #include <stdlib.h>
59 #include <string.h>
60 #include <unistd.h>
61 
62 #include "log.h"
63 #include "ssh-sandbox.h"
64 #include "xmalloc.h"
65 
66 /* Linux seccomp_filter sandbox */
67 #define SECCOMP_FILTER_FAIL SECCOMP_RET_KILL
68 
69 /* Use a signal handler to emit violations when debugging */
70 #ifdef SANDBOX_SECCOMP_FILTER_DEBUG
71 # undef SECCOMP_FILTER_FAIL
72 # define SECCOMP_FILTER_FAIL SECCOMP_RET_TRAP
73 #endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
74 
75 /* Simple helpers to avoid manual errors (but larger BPF programs). */
76 #define SC_DENY(_nr, _errno) \
77 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 1), \
78 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno))
79 #define SC_ALLOW(_nr) \
80 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_ ## _nr, 0, 1), \
81 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
82 
83 /* Syscall filtering set for preauth. */
84 static const struct sock_filter preauth_insns[] = {
85 	/* Ensure the syscall arch convention is as expected. */
86 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
87 		offsetof(struct seccomp_data, arch)),
88 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SECCOMP_AUDIT_ARCH, 1, 0),
89 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
90 	/* Load the syscall number for checking. */
91 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
92 		offsetof(struct seccomp_data, nr)),
93 	SC_DENY(open, EACCES),
94 	SC_DENY(stat, EACCES),
95 	SC_ALLOW(getpid),
96 	SC_ALLOW(gettimeofday),
97 	SC_ALLOW(clock_gettime),
98 #ifdef __NR_time /* not defined on EABI ARM */
99 	SC_ALLOW(time),
100 #endif
101 	SC_ALLOW(read),
102 	SC_ALLOW(write),
103 	SC_ALLOW(close),
104 #ifdef __NR_shutdown /* not defined on archs that go via socketcall(2) */
105 	SC_ALLOW(shutdown),
106 #endif
107 	SC_ALLOW(brk),
108 	SC_ALLOW(poll),
109 #ifdef __NR__newselect
110 	SC_ALLOW(_newselect),
111 #else
112 	SC_ALLOW(select),
113 #endif
114 	SC_ALLOW(madvise),
115 #ifdef __NR_mmap2 /* EABI ARM only has mmap2() */
116 	SC_ALLOW(mmap2),
117 #endif
118 #ifdef __NR_mmap
119 	SC_ALLOW(mmap),
120 #endif
121 #ifdef __dietlibc__
122 	SC_ALLOW(mremap),
123 	SC_ALLOW(exit),
124 #endif
125 	SC_ALLOW(munmap),
126 	SC_ALLOW(exit_group),
127 #ifdef __NR_rt_sigprocmask
128 	SC_ALLOW(rt_sigprocmask),
129 #else
130 	SC_ALLOW(sigprocmask),
131 #endif
132 	BPF_STMT(BPF_RET+BPF_K, SECCOMP_FILTER_FAIL),
133 };
134 
135 static const struct sock_fprog preauth_program = {
136 	.len = (unsigned short)(sizeof(preauth_insns)/sizeof(preauth_insns[0])),
137 	.filter = (struct sock_filter *)preauth_insns,
138 };
139 
140 struct ssh_sandbox {
141 	pid_t child_pid;
142 };
143 
144 struct ssh_sandbox *
145 ssh_sandbox_init(struct monitor *monitor)
146 {
147 	struct ssh_sandbox *box;
148 
149 	/*
150 	 * Strictly, we don't need to maintain any state here but we need
151 	 * to return non-NULL to satisfy the API.
152 	 */
153 	debug3("%s: preparing seccomp filter sandbox", __func__);
154 	box = xcalloc(1, sizeof(*box));
155 	box->child_pid = 0;
156 
157 	return box;
158 }
159 
160 #ifdef SANDBOX_SECCOMP_FILTER_DEBUG
161 extern struct monitor *pmonitor;
162 void mm_log_handler(LogLevel level, const char *msg, void *ctx);
163 
164 static void
165 ssh_sandbox_violation(int signum, siginfo_t *info, void *void_context)
166 {
167 	char msg[256];
168 
169 	snprintf(msg, sizeof(msg),
170 	    "%s: unexpected system call (arch:0x%x,syscall:%d @ %p)",
171 	    __func__, info->si_arch, info->si_syscall, info->si_call_addr);
172 	mm_log_handler(SYSLOG_LEVEL_FATAL, msg, pmonitor);
173 	_exit(1);
174 }
175 
176 static void
177 ssh_sandbox_child_debugging(void)
178 {
179 	struct sigaction act;
180 	sigset_t mask;
181 
182 	debug3("%s: installing SIGSYS handler", __func__);
183 	memset(&act, 0, sizeof(act));
184 	sigemptyset(&mask);
185 	sigaddset(&mask, SIGSYS);
186 
187 	act.sa_sigaction = &ssh_sandbox_violation;
188 	act.sa_flags = SA_SIGINFO;
189 	if (sigaction(SIGSYS, &act, NULL) == -1)
190 		fatal("%s: sigaction(SIGSYS): %s", __func__, strerror(errno));
191 	if (sigprocmask(SIG_UNBLOCK, &mask, NULL) == -1)
192 		fatal("%s: sigprocmask(SIGSYS): %s",
193 		      __func__, strerror(errno));
194 }
195 #endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
196 
197 void
198 ssh_sandbox_child(struct ssh_sandbox *box)
199 {
200 	struct rlimit rl_zero;
201 	int nnp_failed = 0;
202 
203 	/* Set rlimits for completeness if possible. */
204 	rl_zero.rlim_cur = rl_zero.rlim_max = 0;
205 	if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
206 		fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
207 			__func__, strerror(errno));
208 	if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
209 		fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
210 			__func__, strerror(errno));
211 	if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
212 		fatal("%s: setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",
213 			__func__, strerror(errno));
214 
215 #ifdef SANDBOX_SECCOMP_FILTER_DEBUG
216 	ssh_sandbox_child_debugging();
217 #endif /* SANDBOX_SECCOMP_FILTER_DEBUG */
218 
219 	debug3("%s: setting PR_SET_NO_NEW_PRIVS", __func__);
220 	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1) {
221 		debug("%s: prctl(PR_SET_NO_NEW_PRIVS): %s",
222 		      __func__, strerror(errno));
223 		nnp_failed = 1;
224 	}
225 	debug3("%s: attaching seccomp filter program", __func__);
226 	if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &preauth_program) == -1)
227 		debug("%s: prctl(PR_SET_SECCOMP): %s",
228 		      __func__, strerror(errno));
229 	else if (nnp_failed)
230 		fatal("%s: SECCOMP_MODE_FILTER activated but "
231 		    "PR_SET_NO_NEW_PRIVS failed", __func__);
232 }
233 
234 void
235 ssh_sandbox_parent_finish(struct ssh_sandbox *box)
236 {
237 	free(box);
238 	debug3("%s: finished", __func__);
239 }
240 
241 void
242 ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid)
243 {
244 	box->child_pid = child_pid;
245 }
246 
247 #endif /* SANDBOX_SECCOMP_FILTER */
248