op public repos

Blame

Date:: Sun Sep 19 17:08:12 2021 UTC
Message:: landlock the server process Trying to implement some landlock policies (rules?) where possible. The server process is, of course, the most dangerous process so start with that. The following should be equivalent to the unveil(2) call on OpenBSD: allows only to read files and directories inside the vhost roots. I'm assuming seccomp is enabled so I'm not trying to disallow actions such as LANDLOCK_ACCESS_FS_EXECUTE or LANDLOCK_ACCESS_FS_REMOVE_FILE which require syscalls that are already disallowed. I'm only trying to limit the damage that the currently allowed system calls can do. e.g. since write(2) is allowed, gmid could modify *any* file it has access to; this is now forbidden by landlock. There are still too many #ifdefs for my tastes, but it's still better than the seccomp code.
Actions:: History | Blob | Raw File
  1 e29dbd72 2021-01-23 op /*
  2 1a49166d 2021-01-23 op  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
  3 e29dbd72 2021-01-23 op  *
  4 e29dbd72 2021-01-23 op  * Permission to use, copy, modify, and distribute this software for any
  5 e29dbd72 2021-01-23 op  * purpose with or without fee is hereby granted, provided that the above
  6 e29dbd72 2021-01-23 op  * copyright notice and this permission notice appear in all copies.
  7 e29dbd72 2021-01-23 op  *
  8 e29dbd72 2021-01-23 op  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  9 e29dbd72 2021-01-23 op  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 10 e29dbd72 2021-01-23 op  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 11 e29dbd72 2021-01-23 op  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 12 e29dbd72 2021-01-23 op  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 13 e29dbd72 2021-01-23 op  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 14 e29dbd72 2021-01-23 op  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 15 e29dbd72 2021-01-23 op  */
 16 e29dbd72 2021-01-23 op 
 17 dafb57b8 2021-01-15 op #include "gmid.h"
 18 dafb57b8 2021-01-15 op 
 19 8bb8cf2a 2021-07-02 op #if DISABLE_SANDBOX
 20 dafb57b8 2021-01-15 op 
 21 8bb8cf2a 2021-07-02 op #warning "Sandbox disabled! Please report issues upstream instead of disabling the sandbox."
 22 8bb8cf2a 2021-07-02 op 
 23 8bb8cf2a 2021-07-02 op void
 24 8bb8cf2a 2021-07-02 op sandbox_server_process(void)
 25 8bb8cf2a 2021-07-02 op {
 26 8bb8cf2a 2021-07-02 op 	return;
 27 8bb8cf2a 2021-07-02 op }
 28 8bb8cf2a 2021-07-02 op 
 29 8bb8cf2a 2021-07-02 op void
 30 8bb8cf2a 2021-07-02 op sandbox_executor_process(void)
 31 8bb8cf2a 2021-07-02 op {
 32 8bb8cf2a 2021-07-02 op         log_notice(NULL, "Sandbox disabled!  "
 33 8bb8cf2a 2021-07-02 op 	    "Please report issues upstream instead of disabling the sandbox.");
 34 8bb8cf2a 2021-07-02 op }
 35 8bb8cf2a 2021-07-02 op 
 36 8bb8cf2a 2021-07-02 op void
 37 8bb8cf2a 2021-07-02 op sandbox_logger_process(void)
 38 8bb8cf2a 2021-07-02 op {
 39 8bb8cf2a 2021-07-02 op 	return;
 40 8bb8cf2a 2021-07-02 op }
 41 8bb8cf2a 2021-07-02 op 
 42 8bb8cf2a 2021-07-02 op #elif defined(__FreeBSD__)
 43 8bb8cf2a 2021-07-02 op 
 44 dafb57b8 2021-01-15 op #include <sys/capsicum.h>
 45 dafb57b8 2021-01-15 op 
 46 dafb57b8 2021-01-15 op void
 47 62e001b0 2021-03-20 op sandbox_server_process(void)
 48 dafb57b8 2021-01-15 op {
 49 dafb57b8 2021-01-15 op 	if (cap_enter() == -1)
 50 8e56d6ad 2021-02-11 op 		fatal("cap_enter");
 51 dafb57b8 2021-01-15 op }
 52 dafb57b8 2021-01-15 op 
 53 62e001b0 2021-03-20 op void
 54 62e001b0 2021-03-20 op sandbox_executor_process(void)
 55 62e001b0 2021-03-20 op {
 56 a8a1f439 2021-07-07 op 	/*
 57 a8a1f439 2021-07-07 op 	 * We cannot capsicum the executor process because it needs to
 58 a8a1f439 2021-07-07 op 	 * fork(2)+execve(2) cgi scripts
 59 a8a1f439 2021-07-07 op 	 */
 60 62e001b0 2021-03-20 op 	return;
 61 62e001b0 2021-03-20 op }
 62 62e001b0 2021-03-20 op 
 63 62e001b0 2021-03-20 op void
 64 62e001b0 2021-03-20 op sandbox_logger_process(void)
 65 62e001b0 2021-03-20 op {
 66 62e001b0 2021-03-20 op 	if (cap_enter() == -1)
 67 62e001b0 2021-03-20 op 		fatal("cap_enter");
 68 62e001b0 2021-03-20 op }
 69 62e001b0 2021-03-20 op 
 70 dafb57b8 2021-01-15 op #elif defined(__linux__)
 71 dafb57b8 2021-01-15 op 
 72 71b7eb2f 2021-01-17 op #include <sys/prctl.h>
 73 71b7eb2f 2021-01-17 op #include <sys/syscall.h>
 74 71b7eb2f 2021-01-17 op #include <sys/syscall.h>
 75 71b7eb2f 2021-01-17 op #include <sys/types.h>
 76 71b7eb2f 2021-01-17 op 
 77 71b7eb2f 2021-01-17 op #include <linux/audit.h>
 78 71b7eb2f 2021-01-17 op #include <linux/filter.h>
 79 71b7eb2f 2021-01-17 op #include <linux/seccomp.h>
 80 71b7eb2f 2021-01-17 op 
 81 71b7eb2f 2021-01-17 op #include <errno.h>
 82 3c0375e4 2021-01-20 op #include <fcntl.h>
 83 71b7eb2f 2021-01-17 op #include <stddef.h>
 84 71b7eb2f 2021-01-17 op #include <stdio.h>
 85 71b7eb2f 2021-01-17 op #include <string.h>
 86 3499ce5a 2021-09-19 op 
 87 3499ce5a 2021-09-19 op #if HAVE_LANDLOCK
 88 3499ce5a 2021-09-19 op # include "landlock_shim.h"
 89 3499ce5a 2021-09-19 op #endif
 90 71b7eb2f 2021-01-17 op 
 91 137def5f 2021-07-02 op /* uncomment to enable debugging.  ONLY FOR DEVELOPMENT */
 92 137def5f 2021-07-02 op /* #define SC_DEBUG */
 93 137def5f 2021-07-02 op 
 94 137def5f 2021-07-02 op #ifdef SC_DEBUG
 95 137def5f 2021-07-02 op # define SC_FAIL SECCOMP_RET_TRAP
 96 137def5f 2021-07-02 op #else
 97 137def5f 2021-07-02 op # define SC_FAIL SECCOMP_RET_KILL
 98 137def5f 2021-07-02 op #endif
 99 137def5f 2021-07-02 op 
100 137def5f 2021-07-02 op #if (BYTE_ORDER == LITTLE_ENDIAN)
101 137def5f 2021-07-02 op # define SC_ARG_LO	0
102 137def5f 2021-07-02 op # define SC_ARG_HI	sizeof(uint32_t)
103 137def5f 2021-07-02 op #elif (BYTE_ORDER == BIG_ENDIAN)
104 137def5f 2021-07-02 op # define SC_ARG_LO	sizeof(uint32_t)
105 137def5f 2021-07-02 op # define SC_ARG_HI	0
106 137def5f 2021-07-02 op #else
107 137def5f 2021-07-02 op # error "Uknown endian"
108 137def5f 2021-07-02 op #endif
109 137def5f 2021-07-02 op 
110 137def5f 2021-07-02 op /* make the filter more readable */
111 137def5f 2021-07-02 op #define SC_ALLOW(nr)						\
112 137def5f 2021-07-02 op 	BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_##nr, 0, 1),	\
113 137def5f 2021-07-02 op 	BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW)
114 137def5f 2021-07-02 op 
115 137def5f 2021-07-02 op /*
116 137def5f 2021-07-02 op  * SC_ALLOW_ARG and the SECCOMP_AUDIT_ARCH below are courtesy of
117 137def5f 2021-07-02 op  * https://roy.marples.name/git/dhcpcd/blob/HEAD:/src/privsep-linux.c
118 137def5f 2021-07-02 op  */
119 137def5f 2021-07-02 op #define SC_ALLOW_ARG(_nr, _arg, _val)						\
120 137def5f 2021-07-02 op 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, (_nr), 0, 6),			\
121 137def5f 2021-07-02 op 	BPF_STMT(BPF_LD + BPF_W + BPF_ABS,					\
122 137def5f 2021-07-02 op 	    offsetof(struct seccomp_data, args[(_arg)]) + SC_ARG_LO),		\
123 137def5f 2021-07-02 op 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,					\
124 137def5f 2021-07-02 op 	    ((_val) & 0xffffffff), 0, 3),					\
125 137def5f 2021-07-02 op 	BPF_STMT(BPF_LD + BPF_W + BPF_ABS,					\
126 137def5f 2021-07-02 op 	    offsetof(struct seccomp_data, args[(_arg)]) + SC_ARG_HI),		\
127 137def5f 2021-07-02 op 	BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,					\
128 137def5f 2021-07-02 op 	    (((uint32_t)((uint64_t)(_val) >> 32)) & 0xffffffff), 0, 1),		\
129 137def5f 2021-07-02 op 	BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),				\
130 137def5f 2021-07-02 op 	BPF_STMT(BPF_LD + BPF_W + BPF_ABS,					\
131 137def5f 2021-07-02 op 	    offsetof(struct seccomp_data, nr))
132 137def5f 2021-07-02 op 
133 137def5f 2021-07-02 op /*
134 137def5f 2021-07-02 op  * I personally find this quite nutty.  Why can a system header not
135 137def5f 2021-07-02 op  * define a default for this?
136 137def5f 2021-07-02 op  */
137 71b7eb2f 2021-01-17 op #if defined(__i386__)
138 71b7eb2f 2021-01-17 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_I386
139 71b7eb2f 2021-01-17 op #elif defined(__x86_64__)
140 71b7eb2f 2021-01-17 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64
141 137def5f 2021-07-02 op #elif defined(__arc__)
142 137def5f 2021-07-02 op #  if defined(__A7__)
143 137def5f 2021-07-02 op #    if (BYTE_ORDER == LITTLE_ENDIAN)
144 137def5f 2021-07-02 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARCOMPACT
145 137def5f 2021-07-02 op #    else
146 137def5f 2021-07-02 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARCOMPACTBE
147 137def5f 2021-07-02 op #    endif
148 137def5f 2021-07-02 op #  elif defined(__HS__)
149 137def5f 2021-07-02 op #    if (BYTE_ORDER == LITTLE_ENDIAN)
150 137def5f 2021-07-02 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARCV2
151 137def5f 2021-07-02 op #    else
152 137def5f 2021-07-02 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARCV2BE
153 137def5f 2021-07-02 op #    endif
154 137def5f 2021-07-02 op #  else
155 137def5f 2021-07-02 op #    error "Platform does not support seccomp filter yet"
156 137def5f 2021-07-02 op #  endif
157 71b7eb2f 2021-01-17 op #elif defined(__arm__)
158 137def5f 2021-07-02 op #  ifndef EM_ARM
159 137def5f 2021-07-02 op #    define EM_ARM 40
160 137def5f 2021-07-02 op #  endif
161 137def5f 2021-07-02 op #  if (BYTE_ORDER == LITTLE_ENDIAN)
162 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARM
163 137def5f 2021-07-02 op #  else
164 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ARMEB
165 137def5f 2021-07-02 op #  endif
166 71b7eb2f 2021-01-17 op #elif defined(__aarch64__)
167 71b7eb2f 2021-01-17 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_AARCH64
168 137def5f 2021-07-02 op #elif defined(__alpha__)
169 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_ALPHA
170 137def5f 2021-07-02 op #elif defined(__hppa__)
171 137def5f 2021-07-02 op #  if defined(__LP64__)
172 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_PARISC64
173 137def5f 2021-07-02 op #  else
174 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_PARISC
175 137def5f 2021-07-02 op #  endif
176 137def5f 2021-07-02 op #elif defined(__ia64__)
177 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_IA64
178 137def5f 2021-07-02 op #elif defined(__microblaze__)
179 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MICROBLAZE
180 137def5f 2021-07-02 op #elif defined(__m68k__)
181 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_M68K
182 71b7eb2f 2021-01-17 op #elif defined(__mips__)
183 137def5f 2021-07-02 op #  if defined(__MIPSEL__)
184 137def5f 2021-07-02 op #    if defined(__LP64__)
185 71b7eb2f 2021-01-17 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPSEL64
186 137def5f 2021-07-02 op #    else
187 137def5f 2021-07-02 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPSEL
188 71b7eb2f 2021-01-17 op #    endif
189 137def5f 2021-07-02 op #  elif defined(__LP64__)
190 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPS64
191 71b7eb2f 2021-01-17 op #  else
192 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_MIPS
193 137def5f 2021-07-02 op #  endif
194 137def5f 2021-07-02 op #elif defined(__nds32__)
195 137def5f 2021-07-02 op #  if (BYTE_ORDER == LITTLE_ENDIAN)
196 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_NDS32
197 137def5f 2021-07-02 op #else
198 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_NDS32BE
199 137def5f 2021-07-02 op #endif
200 137def5f 2021-07-02 op #elif defined(__nios2__)
201 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_NIOS2
202 137def5f 2021-07-02 op #elif defined(__or1k__)
203 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_OPENRISC
204 137def5f 2021-07-02 op #elif defined(__powerpc64__)
205 b24021d4 2021-07-03 op #  if (BYTE_ORDER == LITTLE_ENDIAN)
206 b24021d4 2021-07-03 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_PPC64LE
207 b24021d4 2021-07-03 op #  else
208 b24021d4 2021-07-03 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_PPC64
209 b24021d4 2021-07-03 op #  endif
210 137def5f 2021-07-02 op #elif defined(__powerpc__)
211 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_PPC
212 137def5f 2021-07-02 op #elif defined(__riscv)
213 137def5f 2021-07-02 op #  if defined(__LP64__)
214 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_RISCV64
215 137def5f 2021-07-02 op #  else
216 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_RISCV32
217 137def5f 2021-07-02 op #  endif
218 137def5f 2021-07-02 op #elif defined(__s390x__)
219 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_S390X
220 137def5f 2021-07-02 op #elif defined(__s390__)
221 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_S390
222 137def5f 2021-07-02 op #elif defined(__sh__)
223 137def5f 2021-07-02 op #  if defined(__LP64__)
224 137def5f 2021-07-02 op #    if (BYTE_ORDER == LITTLE_ENDIAN)
225 137def5f 2021-07-02 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_SHEL64
226 71b7eb2f 2021-01-17 op #    else
227 137def5f 2021-07-02 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_SH64
228 71b7eb2f 2021-01-17 op #    endif
229 137def5f 2021-07-02 op #  else
230 137def5f 2021-07-02 op #    if (BYTE_ORDER == LITTLE_ENDIAN)
231 137def5f 2021-07-02 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_SHEL
232 137def5f 2021-07-02 op #    else
233 137def5f 2021-07-02 op #      define SECCOMP_AUDIT_ARCH AUDIT_ARCH_SH
234 137def5f 2021-07-02 op #    endif
235 71b7eb2f 2021-01-17 op #  endif
236 137def5f 2021-07-02 op #elif defined(__sparc__)
237 137def5f 2021-07-02 op #  if defined(__arch64__)
238 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_SPARC64
239 137def5f 2021-07-02 op #  else
240 137def5f 2021-07-02 op #    define SECCOMP_AUDIT_ARCH AUDIT_ARCH_SPARC
241 137def5f 2021-07-02 op #  endif
242 137def5f 2021-07-02 op #elif defined(__xtensa__)
243 137def5f 2021-07-02 op #  define SECCOMP_AUDIT_ARCH AUDIT_ARCH_XTENSA
244 71b7eb2f 2021-01-17 op #else
245 71b7eb2f 2021-01-17 op #  error "Platform does not support seccomp filter yet"
246 71b7eb2f 2021-01-17 op #endif
247 71b7eb2f 2021-01-17 op 
248 137def5f 2021-07-02 op static struct sock_filter filter[] = {
249 137def5f 2021-07-02 op 	/* load the *current* architecture */
250 137def5f 2021-07-02 op 	BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
251 137def5f 2021-07-02 op 	    (offsetof(struct seccomp_data, arch))),
252 137def5f 2021-07-02 op 	/* ensure it's the same that we've been compiled on */
253 137def5f 2021-07-02 op 	BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,
254 137def5f 2021-07-02 op 	    SECCOMP_AUDIT_ARCH, 1, 0),
255 137def5f 2021-07-02 op 	/* if not, kill the program */
256 137def5f 2021-07-02 op 	BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
257 71b7eb2f 2021-01-17 op 
258 137def5f 2021-07-02 op 	/* load the syscall number */
259 137def5f 2021-07-02 op 	BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
260 137def5f 2021-07-02 op 	    (offsetof(struct seccomp_data, nr))),
261 137def5f 2021-07-02 op 
262 137def5f 2021-07-02 op #ifdef __NR_accept
263 137def5f 2021-07-02 op 	SC_ALLOW(accept),
264 137def5f 2021-07-02 op #endif
265 137def5f 2021-07-02 op #ifdef __NR_accept4
266 137def5f 2021-07-02 op 	SC_ALLOW(accept4),
267 137def5f 2021-07-02 op #endif
268 137def5f 2021-07-02 op #ifdef __NR_brk
269 137def5f 2021-07-02 op 	SC_ALLOW(brk),
270 137def5f 2021-07-02 op #endif
271 137def5f 2021-07-02 op #ifdef __NR_clock_gettime
272 137def5f 2021-07-02 op 	SC_ALLOW(clock_gettime),
273 137def5f 2021-07-02 op #endif
274 137def5f 2021-07-02 op #if defined(__x86_64__) && defined(__ILP32__) && defined(__X32_SYSCALL_BIT)
275 137def5f 2021-07-02 op 	SECCOMP_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT),
276 137def5f 2021-07-02 op #endif
277 137def5f 2021-07-02 op #ifdef __NR_clock_gettime64
278 137def5f 2021-07-02 op 	SC_ALLOW(clock_gettime64),
279 137def5f 2021-07-02 op #endif
280 137def5f 2021-07-02 op #ifdef __NR_close
281 137def5f 2021-07-02 op 	SC_ALLOW(close),
282 137def5f 2021-07-02 op #endif
283 137def5f 2021-07-02 op #ifdef __NR_epoll_ctl
284 137def5f 2021-07-02 op 	SC_ALLOW(epoll_ctl),
285 137def5f 2021-07-02 op #endif
286 137def5f 2021-07-02 op #ifdef __NR_epoll_pwait
287 137def5f 2021-07-02 op 	SC_ALLOW(epoll_pwait),
288 137def5f 2021-07-02 op #endif
289 137def5f 2021-07-02 op #ifdef __NR_epoll_wait
290 137def5f 2021-07-02 op 	SC_ALLOW(epoll_wait),
291 71b7eb2f 2021-01-17 op #endif
292 137def5f 2021-07-02 op #ifdef __NR_exit
293 137def5f 2021-07-02 op 	SC_ALLOW(exit),
294 137def5f 2021-07-02 op #endif
295 137def5f 2021-07-02 op #ifdef __NR_exit_group
296 137def5f 2021-07-02 op 	SC_ALLOW(exit_group),
297 137def5f 2021-07-02 op #endif
298 137def5f 2021-07-02 op #ifdef __NR_fcntl
299 137def5f 2021-07-02 op 	SC_ALLOW(fcntl),
300 137def5f 2021-07-02 op #endif
301 137def5f 2021-07-02 op #ifdef __NR_fcntl64
302 137def5f 2021-07-02 op 	SC_ALLOW(fcntl64),
303 137def5f 2021-07-02 op #endif
304 137def5f 2021-07-02 op #ifdef __NR_fstat
305 137def5f 2021-07-02 op 	SC_ALLOW(fstat),
306 137def5f 2021-07-02 op #endif
307 21f7d246 2021-07-23 op #ifdef __NR_fstat64
308 21f7d246 2021-07-23 op 	SC_ALLOW(fstat64),
309 21f7d246 2021-07-23 op #endif
310 137def5f 2021-07-02 op #ifdef __NR_getdents64
311 137def5f 2021-07-02 op 	SC_ALLOW(getdents64),
312 137def5f 2021-07-02 op #endif
313 137def5f 2021-07-02 op #ifdef __NR_getpid
314 137def5f 2021-07-02 op 	SC_ALLOW(getpid),
315 137def5f 2021-07-02 op #endif
316 137def5f 2021-07-02 op #ifdef __NR_getrandom
317 137def5f 2021-07-02 op 	SC_ALLOW(getrandom),
318 137def5f 2021-07-02 op #endif
319 137def5f 2021-07-02 op #ifdef __NR_gettimeofday
320 137def5f 2021-07-02 op 	SC_ALLOW(gettimeofday),
321 137def5f 2021-07-02 op #endif
322 137def5f 2021-07-02 op #ifdef __NR_ioctl
323 137def5f 2021-07-02 op 	/* allow ioctl only on fd 1, glibc doing stuff? */
324 137def5f 2021-07-02 op         SC_ALLOW_ARG(__NR_ioctl, 0, 1),
325 137def5f 2021-07-02 op #endif
326 137def5f 2021-07-02 op #ifdef __NR_lseek
327 137def5f 2021-07-02 op 	SC_ALLOW(lseek),
328 137def5f 2021-07-02 op #endif
329 137def5f 2021-07-02 op #ifdef __NR_madvise
330 137def5f 2021-07-02 op 	SC_ALLOW(madvise),
331 137def5f 2021-07-02 op #endif
332 137def5f 2021-07-02 op #ifdef __NR_mmap
333 137def5f 2021-07-02 op 	SC_ALLOW(mmap),
334 137def5f 2021-07-02 op #endif
335 137def5f 2021-07-02 op #ifdef __NR_mmap2
336 137def5f 2021-07-02 op 	SC_ALLOW(mmap2),
337 137def5f 2021-07-02 op #endif
338 137def5f 2021-07-02 op #ifdef __NR_munmap
339 137def5f 2021-07-02 op 	SC_ALLOW(munmap),
340 137def5f 2021-07-02 op #endif
341 137def5f 2021-07-02 op #ifdef __NR_newfstatat
342 137def5f 2021-07-02 op 	SC_ALLOW(newfstatat),
343 137def5f 2021-07-02 op #endif
344 137def5f 2021-07-02 op #ifdef __NR_oldfstat
345 137def5f 2021-07-02 op 	SC_ALLOW(oldfstat),
346 137def5f 2021-07-02 op #endif
347 137def5f 2021-07-02 op #ifdef __NR_openat
348 137def5f 2021-07-02 op 	SC_ALLOW(openat),
349 137def5f 2021-07-02 op #endif
350 137def5f 2021-07-02 op #ifdef __NR_prlimit64
351 137def5f 2021-07-02 op 	SC_ALLOW(prlimit64),
352 137def5f 2021-07-02 op #endif
353 137def5f 2021-07-02 op #ifdef __NR_read
354 137def5f 2021-07-02 op 	SC_ALLOW(read),
355 137def5f 2021-07-02 op #endif
356 137def5f 2021-07-02 op #ifdef __NR_recvmsg
357 137def5f 2021-07-02 op 	SC_ALLOW(recvmsg),
358 137def5f 2021-07-02 op #endif
359 a8e1e8d7 2021-07-23 op #ifdef __NR_readv
360 a8e1e8d7 2021-07-23 op 	SC_ALLOW(readv),
361 137def5f 2021-07-02 op #endif
362 137def5f 2021-07-02 op #ifdef __NR_rt_sigaction
363 137def5f 2021-07-02 op 	SC_ALLOW(rt_sigaction),
364 137def5f 2021-07-02 op #endif
365 137def5f 2021-07-02 op #ifdef __NR_rt_sigreturn
366 137def5f 2021-07-02 op 	SC_ALLOW(rt_sigreturn),
367 137def5f 2021-07-02 op #endif
368 137def5f 2021-07-02 op #ifdef __NR_sendmsg
369 137def5f 2021-07-02 op 	SC_ALLOW(sendmsg),
370 137def5f 2021-07-02 op #endif
371 137def5f 2021-07-02 op #ifdef __NR_statx
372 137def5f 2021-07-02 op 	SC_ALLOW(statx),
373 137def5f 2021-07-02 op #endif
374 137def5f 2021-07-02 op #ifdef __NR_write
375 137def5f 2021-07-02 op 	SC_ALLOW(write),
376 137def5f 2021-07-02 op #endif
377 137def5f 2021-07-02 op #ifdef __NR_writev
378 137def5f 2021-07-02 op 	SC_ALLOW(writev),
379 137def5f 2021-07-02 op #endif
380 71b7eb2f 2021-01-17 op 
381 4aa1dd55 2021-07-03 op 	/* disallow everything else */
382 137def5f 2021-07-02 op 	BPF_STMT(BPF_RET | BPF_K, SC_FAIL),
383 137def5f 2021-07-02 op };
384 71b7eb2f 2021-01-17 op 
385 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
386 71b7eb2f 2021-01-17 op 
387 71b7eb2f 2021-01-17 op #include <signal.h>
388 71b7eb2f 2021-01-17 op #include <unistd.h>
389 71b7eb2f 2021-01-17 op 
390 71b7eb2f 2021-01-17 op static void
391 71b7eb2f 2021-01-17 op sandbox_seccomp_violation(int signum, siginfo_t *info, void *ctx)
392 71b7eb2f 2021-01-17 op {
393 71b7eb2f 2021-01-17 op 	(void)signum;
394 71b7eb2f 2021-01-17 op 	(void)ctx;
395 71b7eb2f 2021-01-17 op 
396 71b7eb2f 2021-01-17 op 	fprintf(stderr, "%s: unexpected system call (arch:0x%x,syscall:%d @ %p)\n",
397 71b7eb2f 2021-01-17 op 	    __func__, info->si_arch, info->si_syscall, info->si_call_addr);
398 71b7eb2f 2021-01-17 op 	_exit(1);
399 71b7eb2f 2021-01-17 op }
400 71b7eb2f 2021-01-17 op 
401 71b7eb2f 2021-01-17 op static void
402 71b7eb2f 2021-01-17 op sandbox_seccomp_catch_sigsys(void)
403 71b7eb2f 2021-01-17 op {
404 71b7eb2f 2021-01-17 op 	struct sigaction act;
405 71b7eb2f 2021-01-17 op 	sigset_t mask;
406 71b7eb2f 2021-01-17 op 
407 71b7eb2f 2021-01-17 op 	memset(&act, 0, sizeof(act));
408 71b7eb2f 2021-01-17 op 	sigemptyset(&mask);
409 71b7eb2f 2021-01-17 op 	sigaddset(&mask, SIGSYS);
410 71b7eb2f 2021-01-17 op 
411 71b7eb2f 2021-01-17 op 	act.sa_sigaction = &sandbox_seccomp_violation;
412 71b7eb2f 2021-01-17 op 	act.sa_flags = SA_SIGINFO;
413 8e56d6ad 2021-02-11 op 	if (sigaction(SIGSYS, &act, NULL) == -1)
414 8e56d6ad 2021-02-11 op 		fatal("%s: sigaction(SIGSYS): %s",
415 71b7eb2f 2021-01-17 op 		    __func__, strerror(errno));
416 8e56d6ad 2021-02-11 op 
417 8e56d6ad 2021-02-11 op 	if (sigprocmask(SIG_UNBLOCK, &mask, NULL) == -1)
418 8e56d6ad 2021-02-11 op 		fatal("%s: sigprocmask(SIGSYS): %s\n",
419 71b7eb2f 2021-01-17 op 		    __func__, strerror(errno));
420 71b7eb2f 2021-01-17 op }
421 71b7eb2f 2021-01-17 op #endif	/* SC_DEBUG */
422 3499ce5a 2021-09-19 op 
423 3499ce5a 2021-09-19 op #if HAVE_LANDLOCK
424 3499ce5a 2021-09-19 op static int
425 3499ce5a 2021-09-19 op server_landlock(void)
426 3499ce5a 2021-09-19 op {
427 3499ce5a 2021-09-19 op 	int		 fd, err;
428 3499ce5a 2021-09-19 op 	struct vhost	*h;
429 3499ce5a 2021-09-19 op 	struct location	*l;
430 71b7eb2f 2021-01-17 op 
431 3499ce5a 2021-09-19 op 	/*
432 3499ce5a 2021-09-19 op 	 * These are all the actions that we want to either allow or
433 3499ce5a 2021-09-19 op 	 * disallow.  Things like LANDLOCK_ACCESS_FS_EXECUTE are
434 3499ce5a 2021-09-19 op 	 * omitted because are already handled by seccomp.
435 3499ce5a 2021-09-19 op 	 */
436 3499ce5a 2021-09-19 op 	struct landlock_ruleset_attr ruleset_attr = {
437 3499ce5a 2021-09-19 op 		.handled_access_fs =	LANDLOCK_ACCESS_FS_WRITE_FILE	|
438 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_READ_FILE	|
439 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_READ_DIR	|
440 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_MAKE_CHAR	|
441 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_MAKE_DIR	|
442 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_MAKE_REG	|
443 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_MAKE_SOCK	|
444 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_MAKE_FIFO	|
445 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_MAKE_BLOCK	|
446 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_MAKE_SYM,
447 3499ce5a 2021-09-19 op 	};
448 3499ce5a 2021-09-19 op 
449 3499ce5a 2021-09-19 op 	/*
450 3499ce5a 2021-09-19 op 	 * These are all the actions allowed for the root directories
451 3499ce5a 2021-09-19 op 	 * of the vhosts.  All the other rules mentioned in
452 3499ce5a 2021-09-19 op 	 * ruleset_attr and omitted here are implicitly disallowed.
453 3499ce5a 2021-09-19 op 	 */
454 3499ce5a 2021-09-19 op 	struct landlock_path_beneath_attr path_beneath = {
455 3499ce5a 2021-09-19 op 		.allowed_access =	LANDLOCK_ACCESS_FS_READ_FILE |
456 3499ce5a 2021-09-19 op 					LANDLOCK_ACCESS_FS_READ_DIR,
457 3499ce5a 2021-09-19 op 	};
458 3499ce5a 2021-09-19 op 
459 3499ce5a 2021-09-19 op 	fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
460 3499ce5a 2021-09-19 op 	if (fd == -1) {
461 3499ce5a 2021-09-19 op 		switch (errno) {
462 3499ce5a 2021-09-19 op 		case ENOSYS:
463 3499ce5a 2021-09-19 op 			fatal("%s: failed to create ruleset.  "
464 3499ce5a 2021-09-19 op 			    "Landlock doesn't seem to be supported by the "
465 3499ce5a 2021-09-19 op 			    "current kernel.", __func__);
466 3499ce5a 2021-09-19 op 		case EOPNOTSUPP:
467 3499ce5a 2021-09-19 op 			log_warn(NULL, "%s: failed to create ruleset.  "
468 3499ce5a 2021-09-19 op 			    "Landlock seems to be currently disabled; "
469 3499ce5a 2021-09-19 op 			    "continuing without it.", __func__);
470 3499ce5a 2021-09-19 op 			return -1;
471 3499ce5a 2021-09-19 op 		default:
472 3499ce5a 2021-09-19 op 			fatal("%s: failed to create ruleset: %s",
473 3499ce5a 2021-09-19 op 			    __func__, strerror(errno));
474 3499ce5a 2021-09-19 op 		}
475 3499ce5a 2021-09-19 op 	}
476 3499ce5a 2021-09-19 op 
477 3499ce5a 2021-09-19 op 	TAILQ_FOREACH(h, &hosts, vhosts) {
478 3499ce5a 2021-09-19 op 		TAILQ_FOREACH(l, &h->locations, locations) {
479 3499ce5a 2021-09-19 op 			if (l->dir == NULL)
480 3499ce5a 2021-09-19 op 				continue;
481 3499ce5a 2021-09-19 op 
482 3499ce5a 2021-09-19 op 			path_beneath.parent_fd = open(l->dir, O_PATH);
483 3499ce5a 2021-09-19 op 			if (path_beneath.parent_fd == -1)
484 3499ce5a 2021-09-19 op 				fatal("%s: can't open %s for landlock: %s",
485 3499ce5a 2021-09-19 op 				    __func__, l->dir, strerror(errno));
486 3499ce5a 2021-09-19 op 
487 3499ce5a 2021-09-19 op 			err = landlock_add_rule(fd, LANDLOCK_RULE_PATH_BENEATH,
488 3499ce5a 2021-09-19 op 			    &path_beneath, 0);
489 3499ce5a 2021-09-19 op 			if (err)
490 3499ce5a 2021-09-19 op 				fatal("%s: landlock_add_rule(%s) failed: %s",
491 3499ce5a 2021-09-19 op 				    __func__, l->dir, strerror(errno));
492 3499ce5a 2021-09-19 op 
493 3499ce5a 2021-09-19 op 			close(path_beneath.parent_fd);
494 3499ce5a 2021-09-19 op 		}
495 3499ce5a 2021-09-19 op 	}
496 3499ce5a 2021-09-19 op 
497 3499ce5a 2021-09-19 op 	return fd;
498 3499ce5a 2021-09-19 op }
499 3499ce5a 2021-09-19 op #endif
500 3499ce5a 2021-09-19 op 
501 dafb57b8 2021-01-15 op void
502 62e001b0 2021-03-20 op sandbox_server_process(void)
503 dafb57b8 2021-01-15 op {
504 3499ce5a 2021-09-19 op 	int fd;
505 71b7eb2f 2021-01-17 op 	struct sock_fprog prog = {
506 71b7eb2f 2021-01-17 op 		.len = (unsigned short) (sizeof(filter) / sizeof(filter[0])),
507 71b7eb2f 2021-01-17 op 		.filter = filter,
508 71b7eb2f 2021-01-17 op 	};
509 71b7eb2f 2021-01-17 op 
510 71b7eb2f 2021-01-17 op #ifdef SC_DEBUG
511 71b7eb2f 2021-01-17 op 	sandbox_seccomp_catch_sigsys();
512 71b7eb2f 2021-01-17 op #endif
513 71b7eb2f 2021-01-17 op 
514 3499ce5a 2021-09-19 op #if HAVE_LANDLOCK
515 3499ce5a 2021-09-19 op 	log_warn(NULL, "loading landlock...");
516 3499ce5a 2021-09-19 op 	fd = server_landlock();
517 3499ce5a 2021-09-19 op #else
518 3499ce5a 2021-09-19 op 	(void)fd;		/* avoid unused var warning */
519 3499ce5a 2021-09-19 op #endif
520 3499ce5a 2021-09-19 op 
521 8e56d6ad 2021-02-11 op 	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
522 8e56d6ad 2021-02-11 op 		fatal("%s: prctl(PR_SET_NO_NEW_PRIVS): %s",
523 71b7eb2f 2021-01-17 op 		    __func__, strerror(errno));
524 71b7eb2f 2021-01-17 op 
525 3499ce5a 2021-09-19 op #if HAVE_LANDLOCK
526 3499ce5a 2021-09-19 op 	if (fd != -1) {
527 3499ce5a 2021-09-19 op 		if (landlock_restrict_self(fd, 0))
528 3499ce5a 2021-09-19 op 			fatal("%s: landlock_restrict_self: %s",
529 3499ce5a 2021-09-19 op 			    __func__, strerror(errno));
530 3499ce5a 2021-09-19 op 		close(fd);
531 3499ce5a 2021-09-19 op 	}
532 3499ce5a 2021-09-19 op #endif
533 3499ce5a 2021-09-19 op 
534 8e56d6ad 2021-02-11 op 	if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) == -1)
535 8e56d6ad 2021-02-11 op 		fatal("%s: prctl(PR_SET_SECCOMP): %s\n",
536 71b7eb2f 2021-01-17 op 		    __func__, strerror(errno));
537 dafb57b8 2021-01-15 op }
538 dafb57b8 2021-01-15 op 
539 62e001b0 2021-03-20 op void
540 62e001b0 2021-03-20 op sandbox_executor_process(void)
541 62e001b0 2021-03-20 op {
542 a8a1f439 2021-07-07 op 	/*
543 a8a1f439 2021-07-07 op 	 * We cannot use seccomp for the executor process because we
544 62e001b0 2021-03-20 op 	 * don't know what the child will do.  Also, our filter will
545 62e001b0 2021-03-20 op 	 * be inherited so the child cannot set its own seccomp
546 a8a1f439 2021-07-07 op 	 * policy.
547 a8a1f439 2021-07-07 op 	 */
548 62e001b0 2021-03-20 op 	return;
549 62e001b0 2021-03-20 op }
550 62e001b0 2021-03-20 op 
551 62e001b0 2021-03-20 op void
552 62e001b0 2021-03-20 op sandbox_logger_process(void)
553 62e001b0 2021-03-20 op {
554 a8a1f439 2021-07-07 op 	/*
555 a8a1f439 2021-07-07 op 	 * To be honest, here we could use a seccomp policy to only
556 a8a1f439 2021-07-07 op 	 * allow writev(2) and memory allocations.
557 a8a1f439 2021-07-07 op 	 */
558 62e001b0 2021-03-20 op 	return;
559 62e001b0 2021-03-20 op }
560 62e001b0 2021-03-20 op 
561 dafb57b8 2021-01-15 op #elif defined(__OpenBSD__)
562 dafb57b8 2021-01-15 op 
563 dafb57b8 2021-01-15 op #include <unistd.h>
564 dafb57b8 2021-01-15 op 
565 dafb57b8 2021-01-15 op void
566 62e001b0 2021-03-20 op sandbox_server_process(void)
567 dafb57b8 2021-01-15 op {
568 fdea6aa0 2021-04-30 op 	struct vhost	*h;
569 fdea6aa0 2021-04-30 op 	struct location	*l;
570 dafb57b8 2021-01-15 op 
571 b8e64ccd 2021-03-31 op 	TAILQ_FOREACH(h, &hosts, vhosts) {
572 fdea6aa0 2021-04-30 op 		TAILQ_FOREACH(l, &h->locations, locations) {
573 fdea6aa0 2021-04-30 op 			if (l->dir == NULL)
574 fdea6aa0 2021-04-30 op 				continue;
575 fdea6aa0 2021-04-30 op 
576 fdea6aa0 2021-04-30 op 			if (unveil(l->dir, "r") == -1)
577 fdea6aa0 2021-04-30 op 				fatal("unveil %s for domain %s",
578 fdea6aa0 2021-04-30 op 				    l->dir,
579 fdea6aa0 2021-04-30 op 				    h->domain);
580 fdea6aa0 2021-04-30 op 		}
581 dafb57b8 2021-01-15 op 	}
582 dafb57b8 2021-01-15 op 
583 881a9dd9 2021-01-16 op 	if (pledge("stdio recvfd rpath inet", NULL) == -1)
584 8e56d6ad 2021-02-11 op 		fatal("pledge");
585 dafb57b8 2021-01-15 op }
586 dafb57b8 2021-01-15 op 
587 dafb57b8 2021-01-15 op void
588 62e001b0 2021-03-20 op sandbox_executor_process(void)
589 dafb57b8 2021-01-15 op {
590 b8e64ccd 2021-03-31 op 	struct vhost	*h;
591 fdea6aa0 2021-04-30 op 	struct location	*l;
592 8ad1c570 2021-05-09 op 	struct fcgi	*f;
593 8ad1c570 2021-05-09 op 	size_t		 i;
594 62e001b0 2021-03-20 op 
595 b8e64ccd 2021-03-31 op 	TAILQ_FOREACH(h, &hosts, vhosts) {
596 fdea6aa0 2021-04-30 op 		TAILQ_FOREACH(l, &h->locations, locations) {
597 fdea6aa0 2021-04-30 op 			if (l->dir == NULL)
598 fdea6aa0 2021-04-30 op 				continue;
599 fdea6aa0 2021-04-30 op 
600 a5d822e5 2021-07-09 op 			/* r so we can chdir into the directory */
601 fdea6aa0 2021-04-30 op 			if (unveil(l->dir, "rx") == -1)
602 fdea6aa0 2021-04-30 op 				fatal("unveil %s for domain %s",
603 fdea6aa0 2021-04-30 op 				    l->dir, h->domain);
604 fdea6aa0 2021-04-30 op 		}
605 62e001b0 2021-03-20 op 	}
606 62e001b0 2021-03-20 op 
607 8ad1c570 2021-05-09 op 	for (i = 0; i < FCGI_MAX; i++) {
608 8ad1c570 2021-05-09 op                 f = &fcgi[i];
609 8ad1c570 2021-05-09 op 		if (f->path != NULL) {
610 8ad1c570 2021-05-09 op 			if (unveil(f->path, "rw") == -1)
611 8ad1c570 2021-05-09 op 				fatal("unveil %s", f->path);
612 8ad1c570 2021-05-09 op 		}
613 8ad1c570 2021-05-09 op 
614 8ad1c570 2021-05-09 op 		if (f->prog != NULL) {
615 8ad1c570 2021-05-09 op 			if (unveil(f->prog, "rx") == -1)
616 8ad1c570 2021-05-09 op 				fatal("unveil %s", f->prog);
617 8ad1c570 2021-05-09 op 		}
618 8ad1c570 2021-05-09 op 	}
619 8ad1c570 2021-05-09 op 
620 8ad1c570 2021-05-09 op 	/*
621 8ad1c570 2021-05-09 op 	 * rpath: to chdir into the correct directory
622 8ad1c570 2021-05-09 op 	 * proc exec: CGI
623 8ad1c570 2021-05-09 op 	 * dns inet unix: FastCGI
624 8ad1c570 2021-05-09 op 	 */
625 8ad1c570 2021-05-09 op 	if (pledge("stdio rpath sendfd proc exec dns inet unix", NULL))
626 62e001b0 2021-03-20 op 		err(1, "pledge");
627 62e001b0 2021-03-20 op }
628 62e001b0 2021-03-20 op 
629 62e001b0 2021-03-20 op void
630 62e001b0 2021-03-20 op sandbox_logger_process(void)
631 62e001b0 2021-03-20 op {
632 e952c505 2021-06-15 op 	if (pledge("stdio recvfd", NULL) == -1)
633 62e001b0 2021-03-20 op 		err(1, "pledge");
634 62e001b0 2021-03-20 op }
635 62e001b0 2021-03-20 op 
636 62e001b0 2021-03-20 op #else
637 62e001b0 2021-03-20 op 
638 62e001b0 2021-03-20 op #warning "No sandbox method known for this OS"
639 62e001b0 2021-03-20 op 
640 62e001b0 2021-03-20 op void
641 62e001b0 2021-03-20 op sandbox_server_process(void)
642 62e001b0 2021-03-20 op {
643 62e001b0 2021-03-20 op 	return;
644 62e001b0 2021-03-20 op }
645 62e001b0 2021-03-20 op 
646 62e001b0 2021-03-20 op void
647 62e001b0 2021-03-20 op sandbox_executor_process(void)
648 62e001b0 2021-03-20 op {
649 2a911637 2021-02-11 op 	log_notice(NULL, "no sandbox method known for this OS");
650 dafb57b8 2021-01-15 op }
651 dafb57b8 2021-01-15 op 
652 62e001b0 2021-03-20 op void
653 62e001b0 2021-03-20 op sandbox_logger_process(void)
654 62e001b0 2021-03-20 op {
655 62e001b0 2021-03-20 op 	return;
656 62e001b0 2021-03-20 op }
657 62e001b0 2021-03-20 op 
658 dafb57b8 2021-01-15 op #endif