1 /*
2  * Copyright (c) 2021, 2023 Omar Polo <op@omarpolo.com>
3  * Copyright (c) 2022 Claudio Jeker <claudio@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include "gmid.h"
19 #include "log.h"
20 
21 #if defined(__OpenBSD__)
22 
23 #include <unistd.h>
24 
25 void
26 sandbox_main_process(void)
27 {
28 	if (pledge("stdio rpath wpath cpath inet dns sendfd", NULL) == -1)
29 		fatal("pledge");
30 }
31 
32 void
33 sandbox_server_process(void)
34 {
35 	if (pledge("stdio rpath inet unix dns recvfd", NULL) == -1)
36 		fatal("pledge");
37 }
38 
39 void
40 sandbox_crypto_process(void)
41 {
42 	if (pledge("stdio recvfd", NULL) == -1)
43 		fatal("pledge");
44 }
45 
46 void
47 sandbox_logger_process(void)
48 {
49 	if (pledge("stdio recvfd", NULL) == -1)
50 		fatal("pledge");
51 }
52 
53 #elif HAVE_LANDLOCK
54 
55 #include <linux/landlock.h>
56 
57 #include <sys/prctl.h>
58 #include <sys/syscall.h>
59 #include <sys/types.h>
60 
61 #include <errno.h>
62 
63 /*
64  * What's the deal with landlock?  While distro with linux >= 5.13
65  * have the struct declarations, libc wrappers are missing.  The
66  * sample landlock code provided by the authors includes these "shims"
67  * in their example for the landlock API until libc provides them.
68  */
69 
70 #ifndef landlock_create_ruleset
71 static inline int
72 landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size,
73     __u32 flags)
74 {
75 	return syscall(__NR_landlock_create_ruleset, attr, size, flags);
76 }
77 #endif
78 
79 #ifndef landlock_add_rule
80 static inline int
81 landlock_add_rule(int ruleset_fd, enum landlock_rule_type type,
82     const void *attr, __u32 flags)
83 {
84 	return syscall(__NR_landlock_add_rule, ruleset_fd, type, attr, flags);
85 }
86 #endif
87 
88 #ifndef landlock_restrict_self
89 static inline int
90 landlock_restrict_self(int ruleset_fd, __u32 flags)
91 {
92 	return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
93 }
94 #endif
95 
96 /*
97  * Maybe we should ship with a full copy of the linux headers because
98  * you never know...
99  */
100 
101 #ifndef LANDLOCK_ACCESS_FS_REFER
102 #define LANDLOCK_ACCESS_FS_REFER	(1ULL << 13)
103 #endif
104 
105 #ifndef LANDLOCK_ACCESS_FS_TRUNCATE
106 #define LANDLOCK_ACCESS_FS_TRUNCATE	(1ULL << 14)
107 #endif
108 
109 static int landlock_state;
110 static int landlock_fd;
111 
112 /*
113  * Initialize landlock, which is stupidly complicated.
114  */
115 static int
116 landlock_init(void)
117 {
118 	struct landlock_ruleset_attr rattr = {
119 		/*
120 		 * List all capabilities currently defined by landlock.
121 		 * Failure in doing so will implicitly allow those actions
122 		 * (i.e. omitting READ_FILE will allow to read _any_ file.)
123 		 */
124 		.handled_access_fs =
125 		LANDLOCK_ACCESS_FS_EXECUTE |
126 		LANDLOCK_ACCESS_FS_READ_FILE |
127 		LANDLOCK_ACCESS_FS_READ_DIR |
128 		LANDLOCK_ACCESS_FS_WRITE_FILE |
129 		LANDLOCK_ACCESS_FS_REMOVE_DIR |
130 		LANDLOCK_ACCESS_FS_REMOVE_FILE |
131 		LANDLOCK_ACCESS_FS_MAKE_CHAR |
132 		LANDLOCK_ACCESS_FS_MAKE_DIR |
133 		LANDLOCK_ACCESS_FS_MAKE_REG |
134 		LANDLOCK_ACCESS_FS_MAKE_SOCK |
135 		LANDLOCK_ACCESS_FS_MAKE_FIFO |
136 		LANDLOCK_ACCESS_FS_MAKE_BLOCK |
137 		LANDLOCK_ACCESS_FS_MAKE_SYM |
138 		LANDLOCK_ACCESS_FS_REFER |
139 		LANDLOCK_ACCESS_FS_TRUNCATE,
140 	};
141 	int fd, abi, saved_errno;
142 
143 	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
144 		return -1;
145 
146 	abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
147 	if (abi == -1)
148 		return -1;
149 	if (abi < 2)
150 		rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER;
151 	if (abi < 3)
152 		rattr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;
153 
154 	landlock_state = 1;
155 	return landlock_create_ruleset(&rattr, sizeof(rattr), 0);
156 }
157 
158 static int
159 landlock_lock(void)
160 {
161 	int saved_errno;
162 
163 	if (landlock_restrict_self(landlock_fd, 0)) {
164 		saved_errno = errno;
165 		close(landlock_fd);
166 		errno = saved_errno;
167 		landlock_state = -1;
168 		return -1;
169 	}
170 
171 	landlock_state = 2;
172 	close(landlock_fd);
173 	return 0;
174 }
175 
176 static int
177 landlock_unveil(const char *path, const char *permissions)
178 {
179 	struct landlock_path_beneath_attr lpba;
180 	int fd, saved_errno;
181 
182 	if (landlock_state == 0) {
183 		if ((landlock_fd = landlock_init()) == -1) {
184 			landlock_state = -1;
185 			/* this kernel doesn't have landlock built in */
186 			if (errno == ENOSYS || errno == EOPNOTSUPP)
187 				return 0;
188 			return -1;
189 		}
190 	}
191 
192 	/* no landlock available */
193 	if (landlock_state == -1)
194 		return 0;
195 
196 	if (path == NULL && permissions == NULL)
197 		return landlock_lock();
198 
199 	if (path == NULL || permissions == NULL || landlock_state != 1) {
200 		errno = EINVAL;
201 		return -1;
202 	}
203 
204 	if (!strcmp(permissions, "r")) {
205 		fd = open(path, O_PATH | O_CLOEXEC);
206 		if (fd == -1)
207 			return -1;
208 		lpba = (struct landlock_path_beneath_attr){
209 			.allowed_access =
210 			    LANDLOCK_ACCESS_FS_READ_FILE |
211 			    LANDLOCK_ACCESS_FS_READ_DIR,
212 			.parent_fd = fd,
213 		};
214 		if (landlock_add_rule(landlock_fd, LANDLOCK_RULE_PATH_BENEATH,
215 		    &lpba, 0) == -1) {
216 			saved_errno = errno;
217 			close(fd);
218 			errno = saved_errno;
219 			return -1;
220 		}
221 		close(fd);
222 	}
223 
224 	return 0;
225 }
226 
227 void
228 sandbox_main_process(void)
229 {
230 	return;
231 }
232 
233 void
234 sandbox_server_process(void)
235 {
236 	if (landlock_unveil("/", "r") == -1)
237 		fatal("landlock_unveil(/)");
238 
239 	if (landlock_unveil(NULL, NULL) == -1)
240 		fatal("landlock_unveil(NULL, NULL)");
241 }
242 
243 void
244 sandbox_crypto_process(void)
245 {
246 	/* contrary to unveil(2), this removes all fs access. */
247 	if (landlock_unveil(NULL, NULL) == -1)
248 		fatal("landlock_unveil(NULL, NULL)");
249 }
250 
251 void
252 sandbox_logger_process(void)
253 {
254 	/* contrary to unveil(2), this removes all fs access. */
255 	if (landlock_unveil(NULL, NULL) == -1)
256 		fatal("landlock_unveil(NULL, NULL)");
257 }
258 
259 #else
260 
261 void
262 sandbox_main_process(void)
263 {
264 	return;
265 }
266 
267 void
268 sandbox_server_process(void)
269 {
270 	return;
271 }
272 
273 void
274 sandbox_crypto_process(void)
275 {
276 	return;
277 }
278 
279 void
280 sandbox_logger_process(void)
281 {
282 	return;
283 }
284 
285 #endif