1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "compat.h"
18 
19 #include <limits.h>
20 
21 #include "fs.h"
22 #include "telescope.h"
23 
24 #ifdef __OpenBSD__
25 
26 # include <errno.h>
27 # include <stdlib.h>
28 # include <string.h>
29 # include <unistd.h>
30 
31 void
32 sandbox_net_process(void)
33 {
34 	if (pledge("stdio inet dns", NULL) == -1)
35 		err(1, "pledge");
36 }
37 
38 void
39 sandbox_ui_process(void)
40 {
41 	char path[PATH_MAX];
42 
43 	if (unveil("/tmp", "rwc") == -1)
44 		err(1, "unveil(/tmp)");
45 
46 	strlcpy(path, getenv("HOME"), sizeof(path));
47 	strlcat(path, "/Downloads", sizeof(path));
48 	if (unveil(path, "rwc") == -1 && errno != ENOENT)
49 		err(1, "unveil(%s)", path);
50 
51 	if (unveil(config_path_base, "rwc") == -1)
52 		err(1, "unveil(%s)", config_path_base);
53 
54 	if (unveil(data_path_base, "rwc") == -1)
55 		err(1, "unveil(%s)", data_path_base);
56 
57 	if (unveil(cache_path_base, "rwc") == -1)
58 		err(1, "unveil(%s)", cache_path_base);
59 
60 	if (pledge("stdio rpath wpath cpath unix tty", NULL) == -1)
61 		err(1, "pledge");
62 }
63 
64 #elif HAVE_LINUX_LANDLOCK_H
65 
66 #include <linux/landlock.h>
67 #include <linux/prctl.h>
68 
69 #include <sys/prctl.h>
70 #include <sys/stat.h>
71 #include <sys/syscall.h>
72 
73 #include <errno.h>
74 #include <fcntl.h>
75 #include <stdlib.h>
76 #include <string.h>
77 #include <unistd.h>
78 
79 /*
80  * What's the deal with landlock?  While distro with linux >= 5.13
81  * have the struct declarations, libc wrappers are missing.  The
82  * sample landlock code provided by the authors includes these "shims"
83  * in their example for the landlock API until libc provides them.
84  *
85  * Linux is such a mess sometimes.  /rant
86  */
87 
88 #ifndef landlock_create_ruleset
89 static inline int
90 landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size,
91     __u32 flags)
92 {
93 	return syscall(__NR_landlock_create_ruleset, attr, size, flags);
94 }
95 #endif
96 
97 #ifndef landlock_add_rule
98 static inline int
99 landlock_add_rule(int ruleset_fd, enum landlock_rule_type type,
100     const void *attr, __u32 flags)
101 {
102 	return syscall(__NR_landlock_add_rule, ruleset_fd, type, attr, flags);
103 }
104 #endif
105 
106 #ifndef landlock_restrict_self
107 static inline int
108 landlock_restrict_self(int ruleset_fd, __u32 flags)
109 {
110 	return syscall(__NR_landlock_restrict_self, ruleset_fd, flags);
111 }
112 #endif
113 
114 static int
115 open_landlock(void)
116 {
117 	int fd;
118 	struct landlock_ruleset_attr attr = {
119 		.handled_access_fs =	LANDLOCK_ACCESS_FS_EXECUTE |
120 					LANDLOCK_ACCESS_FS_READ_FILE |
121 					LANDLOCK_ACCESS_FS_READ_DIR |
122 					LANDLOCK_ACCESS_FS_WRITE_FILE |
123 					LANDLOCK_ACCESS_FS_REMOVE_DIR |
124 					LANDLOCK_ACCESS_FS_REMOVE_FILE |
125 					LANDLOCK_ACCESS_FS_MAKE_CHAR |
126 					LANDLOCK_ACCESS_FS_MAKE_DIR |
127 					LANDLOCK_ACCESS_FS_MAKE_REG |
128 					LANDLOCK_ACCESS_FS_MAKE_SOCK |
129 					LANDLOCK_ACCESS_FS_MAKE_FIFO |
130 					LANDLOCK_ACCESS_FS_MAKE_BLOCK |
131 					LANDLOCK_ACCESS_FS_MAKE_SYM,
132 	};
133 
134 	fd = landlock_create_ruleset(&attr, sizeof(attr), 0);
135 	if (fd == -1) {
136 		switch (errno) {
137 		case ENOSYS:
138 		case EOPNOTSUPP:
139 			return -1;
140 		default:
141 			err(1, "can't create landlock ruleset");
142 		}
143 	}
144 	return fd;
145 }
146 
147 static int
148 landlock_unveil(int landlock_fd, const char *path, int perms)
149 {
150 	struct landlock_path_beneath_attr pb;
151 	int err, saved_errno;
152 
153 	pb.allowed_access = perms;
154 
155 	if ((pb.parent_fd = open(path, O_PATH)) == -1)
156 		return -1;
157 
158 	err = landlock_add_rule(landlock_fd, LANDLOCK_RULE_PATH_BENEATH,
159 	    &pb, 0);
160 	saved_errno = errno;
161 	close(pb.parent_fd);
162 	errno = saved_errno;
163 	return err ? -1 : 0;
164 }
165 
166 static int
167 landlock_apply(int fd)
168 {
169 	int r, saved_errno;
170 
171 	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) == -1)
172 		err(1, "%s: prctl(PR_SET_NO_NEW_PRIVS)", __func__);
173 
174 	r = landlock_restrict_self(fd, 0);
175 	saved_errno = errno;
176 	close(fd);
177 	errno = saved_errno;
178 	return r ? -1 : 0;
179 }
180 
181 static int
182 landlock_no_fs(void)
183 {
184 	int fd;
185 
186 	/*
187 	 * XXX: landlock disabled at runtime, pretend everything's
188 	 * good.
189 	 */
190 	if ((fd = open_landlock()) == -1)
191 		return 0;
192 
193 	return landlock_apply(fd);
194 }
195 
196 void
197 sandbox_net_process(void)
198 {
199 	/*
200 	 * We don't know what paths are required for the TLS stack.
201 	 * Yes, it sucks.
202 	 */
203 	return;
204 }
205 
206 void
207 sandbox_ui_process(void)
208 {
209 	/*
210 	 * Needs to be able to read files *and* execute programs,
211 	 * can't be sandboxed.
212 	 */
213 	return;
214 }
215 
216 #else
217 
218 #warning "No sandbox for this OS"
219 
220 void
221 sandbox_net_process(void)
222 {
223 	return;
224 }
225 
226 void
227 sandbox_ui_process(void)
228 {
229 	return;
230 }
231 
232 #endif