2 1a49166d 2021-01-23 op * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
4 e29dbd72 2021-01-23 op * Permission to use, copy, modify, and distribute this software for any
5 e29dbd72 2021-01-23 op * purpose with or without fee is hereby granted, provided that the above
6 e29dbd72 2021-01-23 op * copyright notice and this permission notice appear in all copies.
8 e29dbd72 2021-01-23 op * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 e29dbd72 2021-01-23 op * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 e29dbd72 2021-01-23 op * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 e29dbd72 2021-01-23 op * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 e29dbd72 2021-01-23 op * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 e29dbd72 2021-01-23 op * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 e29dbd72 2021-01-23 op * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 dafb57b8 2021-01-15 op #include "gmid.h"
19 dafb57b8 2021-01-15 op #if defined(__FreeBSD__)
21 dafb57b8 2021-01-15 op #include <sys/capsicum.h>
24 62e001b0 2021-03-20 op sandbox_server_process(void)
26 dafb57b8 2021-01-15 op if (cap_enter() == -1)
27 8e56d6ad 2021-02-11 op fatal("cap_enter");
31 62e001b0 2021-03-20 op sandbox_executor_process(void)
33 62e001b0 2021-03-20 op /* We cannot capsicum the executor process because it needs
34 62e001b0 2021-03-20 op * to fork(2)+execve(2) cgi scripts */
39 62e001b0 2021-03-20 op sandbox_logger_process(void)
41 62e001b0 2021-03-20 op if (cap_enter() == -1)
42 62e001b0 2021-03-20 op fatal("cap_enter");
45 dafb57b8 2021-01-15 op #elif defined(__linux__)
47 71b7eb2f 2021-01-17 op #include <sys/prctl.h>
48 71b7eb2f 2021-01-17 op #include <sys/syscall.h>
49 71b7eb2f 2021-01-17 op #include <sys/syscall.h>
50 71b7eb2f 2021-01-17 op #include <sys/types.h>
52 71b7eb2f 2021-01-17 op #include <linux/audit.h>
53 71b7eb2f 2021-01-17 op #include <linux/filter.h>
54 71b7eb2f 2021-01-17 op #include <linux/seccomp.h>
56 71b7eb2f 2021-01-17 op #include <errno.h>
57 3c0375e4 2021-01-20 op #include <fcntl.h>
58 71b7eb2f 2021-01-17 op #include <stddef.h>
59 71b7eb2f 2021-01-17 op #include <stdio.h>
60 71b7eb2f 2021-01-17 op #include <string.h>
62 71b7eb2f 2021-01-17 op /* thanks chromium' src/seccomp.c */
63 71b7eb2f 2021-01-17 op #if defined(__i386__)
64 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_I386
65 71b7eb2f 2021-01-17 op #elif defined(__x86_64__)
66 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64
67 71b7eb2f 2021-01-17 op #elif defined(__arm__)
68 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARM
69 71b7eb2f 2021-01-17 op #elif defined(__aarch64__)
70 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_AARCH64
71 71b7eb2f 2021-01-17 op #elif defined(__mips__)
72 71b7eb2f 2021-01-17 op # if defined(__mips64)
73 71b7eb2f 2021-01-17 op # if defined(__MIPSEB__)
74 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPS64
76 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPSEL64
79 71b7eb2f 2021-01-17 op # if defined(__MIPSEB__)
80 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPS
82 71b7eb2f 2021-01-17 op # define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPSEL
86 71b7eb2f 2021-01-17 op # error "Platform does not support seccomp filter yet"
89 71b7eb2f 2021-01-17 op /* uncomment to enable debugging. ONLY FOR DEVELOPMENT */
90 71b7eb2f 2021-01-17 op /* #define SC_DEBUG */
92 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
93 71b7eb2f 2021-01-17 op # define SC_FAIL SECCOMP_RET_TRAP
95 71b7eb2f 2021-01-17 op # define SC_FAIL SECCOMP_RET_KILL
98 71b7eb2f 2021-01-17 op /* make the filter more readable */
99 71b7eb2f 2021-01-17 op #define SC_ALLOW(nr) \
100 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_##nr, 0, 1), \
101 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
103 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
105 71b7eb2f 2021-01-17 op #include <signal.h>
106 71b7eb2f 2021-01-17 op #include <unistd.h>
109 71b7eb2f 2021-01-17 op sandbox_seccomp_violation(int signum, siginfo_t *info, void *ctx)
111 71b7eb2f 2021-01-17 op (void)signum;
114 71b7eb2f 2021-01-17 op fprintf(stderr, "%s: unexpected system call (arch:0x%x,syscall:%d @ %p)\n",
115 71b7eb2f 2021-01-17 op __func__, info->si_arch, info->si_syscall, info->si_call_addr);
120 71b7eb2f 2021-01-17 op sandbox_seccomp_catch_sigsys(void)
122 71b7eb2f 2021-01-17 op struct sigaction act;
123 71b7eb2f 2021-01-17 op sigset_t mask;
125 71b7eb2f 2021-01-17 op memset(&act, 0, sizeof(act));
126 71b7eb2f 2021-01-17 op sigemptyset(&mask);
127 71b7eb2f 2021-01-17 op sigaddset(&mask, SIGSYS);
129 71b7eb2f 2021-01-17 op act.sa_sigaction = &sandbox_seccomp_violation;
130 71b7eb2f 2021-01-17 op act.sa_flags = SA_SIGINFO;
131 8e56d6ad 2021-02-11 op if (sigaction(SIGSYS, &act, NULL) == -1)
132 8e56d6ad 2021-02-11 op fatal("%s: sigaction(SIGSYS): %s",
133 71b7eb2f 2021-01-17 op __func__, strerror(errno));
135 8e56d6ad 2021-02-11 op if (sigprocmask(SIG_UNBLOCK, &mask, NULL) == -1)
136 8e56d6ad 2021-02-11 op fatal("%s: sigprocmask(SIGSYS): %s\n",
137 71b7eb2f 2021-01-17 op __func__, strerror(errno));
139 71b7eb2f 2021-01-17 op #endif /* SC_DEBUG */
142 62e001b0 2021-03-20 op sandbox_server_process(void)
144 71b7eb2f 2021-01-17 op struct sock_filter filter[] = {
145 71b7eb2f 2021-01-17 op /* load the *current* architecture */
146 71b7eb2f 2021-01-17 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
147 71b7eb2f 2021-01-17 op (offsetof(struct seccomp_data, arch))),
148 71b7eb2f 2021-01-17 op /* ensure it's the same that we've been compiled on */
149 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,
150 71b7eb2f 2021-01-17 op SECCOMP_AUDIT_ARCH, 1, 0),
151 71b7eb2f 2021-01-17 op /* if not, kill the program */
152 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
154 71b7eb2f 2021-01-17 op /* load the syscall number */
155 71b7eb2f 2021-01-17 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
156 71b7eb2f 2021-01-17 op (offsetof(struct seccomp_data, nr))),
158 71b7eb2f 2021-01-17 op /* allow logging on stdout */
159 71b7eb2f 2021-01-17 op SC_ALLOW(write),
160 71b7eb2f 2021-01-17 op SC_ALLOW(writev),
161 71b7eb2f 2021-01-17 op SC_ALLOW(readv),
163 71b7eb2f 2021-01-17 op /* these are used to serve the files. note how we
164 71b7eb2f 2021-01-17 op * allow openat but not open. */
165 4c857c0a 2021-02-10 op #ifdef __NR_epoll_wait
166 4c857c0a 2021-02-10 op /* epoll_wait(2) isn't present on aarch64, at least */
167 f6b9a079 2021-02-10 op SC_ALLOW(epoll_wait),
169 df58efff 2021-02-08 op SC_ALLOW(epoll_pwait),
170 df58efff 2021-02-08 op SC_ALLOW(epoll_ctl),
171 3cb3dd4d 2021-02-12 op SC_ALLOW(accept),
172 df58efff 2021-02-08 op SC_ALLOW(accept4),
173 71b7eb2f 2021-01-17 op SC_ALLOW(read),
174 71b7eb2f 2021-01-17 op SC_ALLOW(openat),
175 71b7eb2f 2021-01-17 op SC_ALLOW(fstat),
176 6827d278 2021-02-10 op SC_ALLOW(newfstatat),
177 71b7eb2f 2021-01-17 op SC_ALLOW(close),
178 71b7eb2f 2021-01-17 op SC_ALLOW(lseek),
179 71b7eb2f 2021-01-17 op SC_ALLOW(brk),
180 71b7eb2f 2021-01-17 op SC_ALLOW(mmap),
181 71b7eb2f 2021-01-17 op SC_ALLOW(munmap),
183 9899a837 2021-02-23 op /* for imsg */
184 9899a837 2021-02-23 op SC_ALLOW(sendmsg),
185 e3d81f49 2021-03-20 op SC_ALLOW(prlimit64),
187 c214d1ab 2021-02-08 op /* needed for signal handling */
188 c214d1ab 2021-02-08 op SC_ALLOW(rt_sigreturn),
189 c214d1ab 2021-02-08 op SC_ALLOW(rt_sigaction),
191 71b7eb2f 2021-01-17 op /* we need recvmsg to receive fd */
192 71b7eb2f 2021-01-17 op SC_ALLOW(recvmsg),
194 71b7eb2f 2021-01-17 op /* XXX: ??? */
195 71b7eb2f 2021-01-17 op SC_ALLOW(getpid),
197 df58efff 2021-02-08 op /* alpine on amd64 */
198 f2b3a519 2021-01-20 op SC_ALLOW(clock_gettime),
199 df58efff 2021-02-08 op SC_ALLOW(madvise),
201 2d3f837a 2021-01-25 op /* void on aarch64 does a gettrandom */
202 2d3f837a 2021-01-25 op SC_ALLOW(getrandom),
204 6827d278 2021-02-10 op /* arch on amd64 */
205 6827d278 2021-02-10 op SC_ALLOW(gettimeofday),
207 f88311e5 2021-01-24 op /* for directory listing */
208 f88311e5 2021-01-24 op SC_ALLOW(getdents64),
210 71b7eb2f 2021-01-17 op SC_ALLOW(exit),
211 71b7eb2f 2021-01-17 op SC_ALLOW(exit_group),
213 c214d1ab 2021-02-08 op /* allow only F_GETFL, F_SETFL & F_SETFD fcntl */
214 f88311e5 2021-01-24 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_fcntl, 0, 8),
215 de4f7131 2021-01-20 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
216 3c0375e4 2021-01-20 op (offsetof(struct seccomp_data, args[1]))),
217 3c0375e4 2021-01-20 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_GETFL, 0, 1),
218 3c0375e4 2021-01-20 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
219 3c0375e4 2021-01-20 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETFL, 0, 1),
220 3c0375e4 2021-01-20 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
221 f88311e5 2021-01-24 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, F_SETFD, 0, 1),
222 f88311e5 2021-01-24 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
223 3c0375e4 2021-01-20 op BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
225 f2b3a519 2021-01-20 op /* re-load the syscall number */
226 de4f7131 2021-01-20 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
227 de4f7131 2021-01-20 op (offsetof(struct seccomp_data, nr))),
229 71b7eb2f 2021-01-17 op /* allow ioctl but only on fd 1, glibc doing stuff? */
230 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_ioctl, 0, 3),
231 71b7eb2f 2021-01-17 op BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
232 71b7eb2f 2021-01-17 op (offsetof(struct seccomp_data, args[0]))),
233 71b7eb2f 2021-01-17 op BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 1, 0, 1),
234 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
236 71b7eb2f 2021-01-17 op /* disallow enything else */
237 71b7eb2f 2021-01-17 op BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
240 71b7eb2f 2021-01-17 op struct sock_fprog prog = {
241 71b7eb2f 2021-01-17 op .len = (unsigned short) (sizeof(filter) / sizeof(filter[0])),
242 71b7eb2f 2021-01-17 op .filter = filter,
245 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
246 71b7eb2f 2021-01-17 op sandbox_seccomp_catch_sigsys();
249 8e56d6ad 2021-02-11 op if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
250 8e56d6ad 2021-02-11 op fatal("%s: prctl(PR_SET_NO_NEW_PRIVS): %s",
251 71b7eb2f 2021-01-17 op __func__, strerror(errno));
253 8e56d6ad 2021-02-11 op if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) == -1)
254 8e56d6ad 2021-02-11 op fatal("%s: prctl(PR_SET_SECCOMP): %s\n",
255 71b7eb2f 2021-01-17 op __func__, strerror(errno));
259 62e001b0 2021-03-20 op sandbox_executor_process(void)
261 62e001b0 2021-03-20 op /* We cannot use seccomp for the executor process because we
262 62e001b0 2021-03-20 op * don't know what the child will do. Also, our filter will
263 62e001b0 2021-03-20 op * be inherited so the child cannot set its own seccomp
269 62e001b0 2021-03-20 op sandbox_logger_process(void)
271 62e001b0 2021-03-20 op /* To be honest, here we could use a seccomp policy to only
272 62e001b0 2021-03-20 op * allow writev(2) and memory allocations. */
276 dafb57b8 2021-01-15 op #elif defined(__OpenBSD__)
278 dafb57b8 2021-01-15 op #include <unistd.h>
281 62e001b0 2021-03-20 op sandbox_server_process(void)
283 fdea6aa0 2021-04-30 op struct vhost *h;
284 fdea6aa0 2021-04-30 op struct location *l;
286 b8e64ccd 2021-03-31 op TAILQ_FOREACH(h, &hosts, vhosts) {
287 fdea6aa0 2021-04-30 op TAILQ_FOREACH(l, &h->locations, locations) {
288 fdea6aa0 2021-04-30 op if (l->dir == NULL)
291 fdea6aa0 2021-04-30 op if (unveil(l->dir, "r") == -1)
292 fdea6aa0 2021-04-30 op fatal("unveil %s for domain %s",
298 881a9dd9 2021-01-16 op if (pledge("stdio recvfd rpath inet", NULL) == -1)
299 8e56d6ad 2021-02-11 op fatal("pledge");
303 62e001b0 2021-03-20 op sandbox_executor_process(void)
305 b8e64ccd 2021-03-31 op struct vhost *h;
306 fdea6aa0 2021-04-30 op struct location *l;
308 b8e64ccd 2021-03-31 op TAILQ_FOREACH(h, &hosts, vhosts) {
309 fdea6aa0 2021-04-30 op TAILQ_FOREACH(l, &h->locations, locations) {
310 fdea6aa0 2021-04-30 op if (l->dir == NULL)
313 fdea6aa0 2021-04-30 op /* r so we can chdir into the correct directory */
314 fdea6aa0 2021-04-30 op if (unveil(l->dir, "rx") == -1)
315 fdea6aa0 2021-04-30 op fatal("unveil %s for domain %s",
316 fdea6aa0 2021-04-30 op l->dir, h->domain);
320 62e001b0 2021-03-20 op /* rpath to chdir into the correct directory */
321 62e001b0 2021-03-20 op if (pledge("stdio rpath sendfd proc exec", NULL))
322 62e001b0 2021-03-20 op err(1, "pledge");
326 62e001b0 2021-03-20 op sandbox_logger_process(void)
328 62e001b0 2021-03-20 op if (pledge("stdio", NULL) == -1)
329 62e001b0 2021-03-20 op err(1, "pledge");
334 62e001b0 2021-03-20 op #warning "No sandbox method known for this OS"
337 62e001b0 2021-03-20 op sandbox_server_process(void)
343 62e001b0 2021-03-20 op sandbox_executor_process(void)
345 2a911637 2021-02-11 op log_notice(NULL, "no sandbox method known for this OS");
349 62e001b0 2021-03-20 op sandbox_logger_process(void)