2 677d90f7 2021-03-12 op * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3 7be09703 2024-02-12 op * Copyright (c) 2022 Claudio Jeker <claudio@openbsd.org>
5 677d90f7 2021-03-12 op * Permission to use, copy, modify, and distribute this software for any
6 677d90f7 2021-03-12 op * purpose with or without fee is hereby granted, provided that the above
7 677d90f7 2021-03-12 op * copyright notice and this permission notice appear in all copies.
9 677d90f7 2021-03-12 op * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 677d90f7 2021-03-12 op * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 677d90f7 2021-03-12 op * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 677d90f7 2021-03-12 op * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 677d90f7 2021-03-12 op * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 677d90f7 2021-03-12 op * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 677d90f7 2021-03-12 op * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 a9d11f81 2021-10-08 op #include "compat.h"
20 f63b8f73 2022-04-24 op #include <limits.h>
22 4b877649 2021-10-07 op #include "fs.h"
23 754622a2 2021-03-15 op #include "telescope.h"
25 677d90f7 2021-03-12 op #ifdef __OpenBSD__
27 fced318d 2021-10-08 op # include <errno.h>
28 35e1f40a 2021-03-14 op # include <stdlib.h>
29 35e1f40a 2021-03-14 op # include <string.h>
30 2b1f38ab 2021-03-13 op # include <unistd.h>
33 17c10c65 2021-07-12 op sandbox_net_process(void)
35 d35e18b3 2024-02-04 op if (pledge("stdio inet dns recvfd", NULL) == -1)
36 677d90f7 2021-03-12 op err(1, "pledge");
40 b1d4d01b 2021-03-14 op sandbox_ui_process(void)
42 35e1f40a 2021-03-14 op char path[PATH_MAX];
44 de2a69bb 2021-05-17 op if (unveil("/tmp", "rwc") == -1)
45 e9cb759e 2021-10-08 op err(1, "unveil(/tmp)");
47 35e1f40a 2021-03-14 op strlcpy(path, getenv("HOME"), sizeof(path));
48 35e1f40a 2021-03-14 op strlcat(path, "/Downloads", sizeof(path));
49 4380c692 2021-10-08 op if (unveil(path, "rwc") == -1 && errno != ENOENT)
50 fd0beb53 2021-10-07 op err(1, "unveil(%s)", path);
52 4b877649 2021-10-07 op if (unveil(config_path_base, "rwc") == -1)
53 fd0beb53 2021-10-07 op err(1, "unveil(%s)", config_path_base);
55 4b877649 2021-10-07 op if (unveil(data_path_base, "rwc") == -1)
56 fd0beb53 2021-10-07 op err(1, "unveil(%s)", data_path_base);
58 4b877649 2021-10-07 op if (unveil(cache_path_base, "rwc") == -1)
59 fd0beb53 2021-10-07 op err(1, "unveil(%s)", cache_path_base);
61 d35e18b3 2024-02-04 op if (pledge("stdio rpath wpath cpath unix sendfd tty", NULL) == -1)
62 35e1f40a 2021-03-14 op err(1, "pledge");
65 a9d11f81 2021-10-08 op #elif HAVE_LINUX_LANDLOCK_H
67 a9d11f81 2021-10-08 op #include <linux/landlock.h>
69 a9d11f81 2021-10-08 op #include <sys/prctl.h>
70 a9d11f81 2021-10-08 op #include <sys/stat.h>
71 a9d11f81 2021-10-08 op #include <sys/syscall.h>
73 fced318d 2021-10-08 op #include <errno.h>
74 a9d11f81 2021-10-08 op #include <fcntl.h>
75 a9d11f81 2021-10-08 op #include <stdlib.h>
76 a9d11f81 2021-10-08 op #include <string.h>
77 a9d11f81 2021-10-08 op #include <unistd.h>
80 a9d11f81 2021-10-08 op * What's the deal with landlock? While distro with linux >= 5.13
81 a9d11f81 2021-10-08 op * have the struct declarations, libc wrappers are missing. The
82 a9d11f81 2021-10-08 op * sample landlock code provided by the authors includes these "shims"
83 a9d11f81 2021-10-08 op * in their example for the landlock API until libc provides them.
86 a9d11f81 2021-10-08 op #ifndef landlock_create_ruleset
87 a9d11f81 2021-10-08 op static inline int
88 a9d11f81 2021-10-08 op landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size,
91 a9d11f81 2021-10-08 op return syscall(__NR_landlock_create_ruleset, attr, size, flags);
95 a9d11f81 2021-10-08 op #ifndef landlock_add_rule
96 a9d11f81 2021-10-08 op static inline int
97 a9d11f81 2021-10-08 op landlock_add_rule(int ruleset_fd, enum landlock_rule_type type,
98 a9d11f81 2021-10-08 op const void *attr, __u32 flags)
100 a9d11f81 2021-10-08 op return syscall(__NR_landlock_add_rule, ruleset_fd, type, attr, flags);
104 a9d11f81 2021-10-08 op #ifndef landlock_restrict_self
105 a9d11f81 2021-10-08 op static inline int
106 a9d11f81 2021-10-08 op landlock_restrict_self(int ruleset_fd, __u32 flags)
108 a9d11f81 2021-10-08 op return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
113 7be09703 2024-02-12 op * Maybe we should ship with a full copy of the linux headers because
114 7be09703 2024-02-12 op * you never know...
117 7be09703 2024-02-12 op #ifndef LANDLOCK_ACCESS_FS_REFER
118 7be09703 2024-02-12 op #define LANDLOCK_ACCESS_FS_REFER (1ULL << 13)
121 7be09703 2024-02-12 op #ifndef LANDLOCK_ACCESS_FS_TRUNCATE
122 7be09703 2024-02-12 op #define LANDLOCK_ACCESS_FS_TRUNCATE (1ULL << 14)
125 7be09703 2024-02-12 op static int landlock_state;
126 7be09703 2024-02-12 op static int landlock_fd;
129 7be09703 2024-02-12 op * Initialize landlock, which is stupidly complicated.
132 7be09703 2024-02-12 op landlock_init(void)
134 7be09703 2024-02-12 op struct landlock_ruleset_attr rattr = {
136 7be09703 2024-02-12 op * List all capabilities currently defined by landlock.
137 7be09703 2024-02-12 op * Failure in doing so will implicitly allow those actions
138 7be09703 2024-02-12 op * (i.e. omitting READ_FILE will allow to read _any_ file.)
140 7be09703 2024-02-12 op .handled_access_fs =
141 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_EXECUTE |
142 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_READ_FILE |
143 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_READ_DIR |
144 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_WRITE_FILE |
145 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_REMOVE_DIR |
146 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_REMOVE_FILE |
147 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_MAKE_CHAR |
148 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_MAKE_DIR |
149 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_MAKE_REG |
150 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_MAKE_SOCK |
151 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_MAKE_FIFO |
152 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_MAKE_BLOCK |
153 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_MAKE_SYM |
154 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_REFER |
155 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_TRUNCATE,
159 7be09703 2024-02-12 op if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
162 7be09703 2024-02-12 op abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
163 7be09703 2024-02-12 op if (abi == -1)
166 7be09703 2024-02-12 op rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER;
168 7be09703 2024-02-12 op rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
170 7be09703 2024-02-12 op landlock_state = 1;
171 7be09703 2024-02-12 op return landlock_create_ruleset(&rattr, sizeof(rattr), 0);
175 7be09703 2024-02-12 op landlock_lock(void)
177 7be09703 2024-02-12 op int saved_errno;
179 7be09703 2024-02-12 op if (landlock_restrict_self(landlock_fd, 0)) {
180 7be09703 2024-02-12 op saved_errno = errno;
181 7be09703 2024-02-12 op close(landlock_fd);
182 7be09703 2024-02-12 op errno = saved_errno;
183 7be09703 2024-02-12 op landlock_state = -1;
187 7be09703 2024-02-12 op landlock_state = 2;
188 7be09703 2024-02-12 op close(landlock_fd);
192 7be09703 2024-02-12 op landlock_unveil(const char *path, const char *permissions)
194 7be09703 2024-02-12 op struct landlock_path_beneath_attr lpba;
195 7be09703 2024-02-12 op int fd, saved_errno;
197 7be09703 2024-02-12 op if (landlock_state == 0) {
198 7be09703 2024-02-12 op if ((landlock_fd = landlock_init()) == -1) {
199 7be09703 2024-02-12 op landlock_state = -1;
200 7be09703 2024-02-12 op /* this kernel doesn't have landlock built in */
201 7be09703 2024-02-12 op if (errno == ENOSYS || errno == EOPNOTSUPP)
207 7be09703 2024-02-12 op /* no landlock available */
208 7be09703 2024-02-12 op if (landlock_state == -1)
211 7be09703 2024-02-12 op if (path == NULL && permissions == NULL)
212 7be09703 2024-02-12 op return landlock_lock();
214 7be09703 2024-02-12 op if (path == NULL || permissions == NULL || landlock_state != 1) {
215 7be09703 2024-02-12 op errno = EINVAL;
219 7be09703 2024-02-12 op if (!strcmp(permissions, "r")) {
220 7be09703 2024-02-12 op fd = open(path, O_PATH | O_CLOEXEC);
221 7be09703 2024-02-12 op if (fd == -1)
223 7be09703 2024-02-12 op lpba = (struct landlock_path_beneath_attr){
224 7be09703 2024-02-12 op .allowed_access =
225 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_READ_FILE |
226 7be09703 2024-02-12 op LANDLOCK_ACCESS_FS_READ_DIR,
227 7be09703 2024-02-12 op .parent_fd = fd,
229 7be09703 2024-02-12 op if (landlock_add_rule(landlock_fd, LANDLOCK_RULE_PATH_BENEATH,
230 7be09703 2024-02-12 op &lpba, 0) == -1) {
231 7be09703 2024-02-12 op saved_errno = errno;
233 7be09703 2024-02-12 op errno = saved_errno;
243 a9d11f81 2021-10-08 op sandbox_net_process(void)
246 7be09703 2024-02-12 op * We don't know what paths are required for the TLS stack and
247 7be09703 2024-02-12 op * DNS, so allow accessing read-only the whole system.
248 ed1d237e 2021-11-27 op * Yes, it sucks.
251 7be09703 2024-02-12 op if (landlock_unveil("/", "r") == -1)
252 7be09703 2024-02-12 op err(1, "landlock_unveil(/, r)");
253 7be09703 2024-02-12 op if (landlock_unveil(NULL, NULL) == -1)
254 7be09703 2024-02-12 op err(1, "landlock_unveil(NULL, NULL)");
258 a9d11f81 2021-10-08 op sandbox_ui_process(void)
261 f63b8f73 2022-04-24 op * Needs to be able to read files *and* execute programs,
262 f63b8f73 2022-04-24 op * can't be sandboxed.
270 17c10c65 2021-07-12 op sandbox_net_process(void)
276 35e1f40a 2021-03-14 op sandbox_ui_process(void)