1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "compat.h"
18 
19 #include "fs.h"
20 #include "telescope.h"
21 
22 #ifdef __OpenBSD__
23 
24 # include <limits.h>
25 # include <stdlib.h>
26 # include <string.h>
27 # include <unistd.h>
28 
29 void
30 sandbox_net_process(void)
31 {
32 	if (pledge("stdio inet dns", NULL) == -1)
33 		err(1, "pledge");
34 }
35 
36 void
37 sandbox_ui_process(void)
38 {
39 	if (pledge("stdio tty recvfd", NULL) == -1)
40 		err(1, "pledge");
41 }
42 
43 void
44 sandbox_fs_process(void)
45 {
46 	char path[PATH_MAX];
47 
48 	if (unveil("/tmp", "rwc") == -1)
49 		err(1, "unveil");
50 
51 	strlcpy(path, getenv("HOME"), sizeof(path));
52 	strlcat(path, "/Downloads", sizeof(path));
53 	if (unveil(path, "rwc") == -1)
54 		err(1, "unveil(%s)", path);
55 
56 	if (unveil(config_path_base, "rwc") == -1)
57 		err(1, "unveil(%s)", config_path_base);
58 
59 	if (unveil(data_path_base, "rwc") == -1)
60 		err(1, "unveil(%s)", data_path_base);
61 
62 	if (unveil(cache_path_base, "rwc") == -1)
63 		err(1, "unveil(%s)", cache_path_base);
64 
65 	if (pledge("stdio rpath wpath cpath sendfd", NULL) == -1)
66 		err(1, "pledge");
67 }
68 
69 #elif HAVE_LINUX_LANDLOCK_H
70 
71 #include <linux/landlock.h>
72 #include <linux/prctl.h>
73 
74 #include <sys/prctl.h>
75 #include <sys/stat.h>
76 #include <sys/syscall.h>
77 
78 #include <fcntl.h>
79 #include <stdlib.h>
80 #include <string.h>
81 #include <unistd.h>
82 
83 /*
84  * What's the deal with landlock?  While distro with linux >= 5.13
85  * have the struct declarations, libc wrappers are missing.  The
86  * sample landlock code provided by the authors includes these "shims"
87  * in their example for the landlock API until libc provides them.
88  *
89  * Linux is such a mess sometimes.  /rant
90  */
91 
92 #ifndef landlock_create_ruleset
93 static inline int
94 landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size,
95     __u32 flags)
96 {
97 	return syscall(__NR_landlock_create_ruleset, attr, size, flags);
98 }
99 #endif
100 
101 #ifndef landlock_add_rule
102 static inline int
103 landlock_add_rule(int ruleset_fd, enum landlock_rule_type type,
104     const void *attr, __u32 flags)
105 {
106 	return syscall(__NR_landlock_add_rule, ruleset_fd, type, attr, flags);
107 }
108 #endif
109 
110 #ifndef landlock_restrict_self
111 static inline int
112 landlock_restrict_self(int ruleset_fd, __u32 flags)
113 {
114 	return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
115 }
116 #endif
117 
118 static int
119 open_landlock(void)
120 {
121 	struct landlock_ruleset_attr attr = {
122 		.handled_access_fs =	LANDLOCK_ACCESS_FS_READ_FILE	|
123 					LANDLOCK_ACCESS_FS_READ_DIR	|
124 					LANDLOCK_ACCESS_FS_WRITE_FILE	|
125 					LANDLOCK_ACCESS_FS_MAKE_DIR	|
126 					LANDLOCK_ACCESS_FS_MAKE_REG,
127 	};
128 
129 	return landlock_create_ruleset(&attr, sizeof(attr), 0);
130 }
131 
132 static int
133 landlock_unveil(int landlock_fd, const char *path, int perms)
134 {
135 	struct landlock_path_beneath_attr pb;
136 	int err, saved_errno;
137 
138 	pb.allowed_access = perms;
139 
140 	if ((pb.parent_fd = open(path, O_PATH)) == -1)
141 		return -1;
142 
143 	err = landlock_add_rule(landlock_fd, LANDLOCK_RULE_PATH_BENEATH,
144 	    &pb, 0);
145 	saved_errno = errno;
146 	close(pb.parent_fd);
147 	errno = saved_errno;
148 	return err ? -1 : 0;
149 }
150 
151 static int
152 landlock_apply(int fd)
153 {
154 	int r, saved_errno;
155 
156 	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
157 		err(1, "%s: prctl(PR_SET_NO_NEW_PRIVS)", __func__);
158 
159 	r = landlock_restrict_self(fd, 0);
160 	saved_errno = errno;
161 	close(fd);
162 	errno = saved_errno;
163 	return r ? -1 : 0;
164 }
165 
166 static int
167 landlock_no_fs(void)
168 {
169 	int fd;
170 
171 	if ((fd = open_landlock()) == -1)
172 		return -1;
173 
174 	return landlock_apply(fd);
175 }
176 
177 void
178 sandbox_net_process(void)
179 {
180 	return;
181 }
182 
183 void
184 sandbox_ui_process(void)
185 {
186 	if (landlock_no_fs() == -1)
187 		err(1, "landlock");
188 }
189 
190 void
191 sandbox_fs_process(void)
192 {
193 	int fd, rwc;
194         char path[PATH_MAX];
195 
196 	if ((fd = open_landlock()) == -1)
197 		err(1, "can't create landlock ruleset");
198 
199 	rwc =	LANDLOCK_ACCESS_FS_READ_FILE	|
200 		LANDLOCK_ACCESS_FS_READ_DIR	|
201 		LANDLOCK_ACCESS_FS_WRITE_FILE	|
202 		LANDLOCK_ACCESS_FS_MAKE_DIR	|
203 		LANDLOCK_ACCESS_FS_MAKE_REG;
204 
205 	if (landlock_unveil(fd, "/tmp", rwc) == -1)
206 		err(1, "landlock_unveil(/tmp)");
207 
208 	strlcpy(path, getenv("HOME"), sizeof(path));
209 	strlcat(path, "/Downloads", sizeof(path));
210 	if (landlock_unveil(fd, path, rwc) == -1)
211 		err(1, "landlock_unveil(%s)", path);
212 
213 	if (landlock_unveil(fd, config_path_base, rwc) == -1)
214 		err(1, "landlock_unveil(%s)", config_path_base);
215 
216 	if (landlock_unveil(fd, data_path_base, rwc) == -1)
217 		err(1, "landlock_unveil(%s)", data_path_base);
218 
219 	if (landlock_unveil(fd, cache_path_base, rwc) == -1)
220 		err(1, "landlock_unveil(%s)", cache_path_base);
221 }
222 
223 #else
224 
225 #warning "No sandbox for this OS"
226 
227 void
228 sandbox_net_process(void)
229 {
230 	return;
231 }
232 
233 void
234 sandbox_ui_process(void)
235 {
236 	return;
237 }
238 
239 void
240 sandbox_fs_process(void)
241 {
242 	return;
243 }
244 
245 #endif