commit e0b2cd061bd62fc790d434b2da7ecc51ed100904 Merge: dffc5c3 7cf1b9c Author: Nick Mathewson nickm@torproject.org Date: Fri Sep 13 12:31:41 2013 -0400

Merge remote-tracking branch 'ctoader/gsoc-cap-stage2'

Conflicts: src/common/sandbox.c

configure.ac | 8 +- src/common/address.c | 3 +- src/common/compat.c | 2 + src/common/crypto.c | 3 +- src/common/sandbox.c | 1500 +++++++++++++++++++++++++++++++++++++++++++++----- src/common/sandbox.h | 201 ++++++- src/common/util.c | 8 +- src/common/util.h | 2 + src/or/config.c | 3 +- src/or/dns.c | 15 +- src/or/main.c | 99 +++- src/or/routerlist.c | 2 +- 12 files changed, 1684 insertions(+), 162 deletions(-)

diff --cc src/common/sandbox.c index dbb1657,b9ec99e..33ffd33 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@@ -9,139 -9,1247 +9,1250 @@@ * \brief Code to enable sandboxing. **/

++#include "orconfig.h" ++ ++#ifndef _LARGEFILE64_SOURCE + /** + * Temporarily required for O_LARGEFILE flag. Needs to be removed + * with the libevent fix. + */ + #define _LARGEFILE64_SOURCE ++#endif + + /** Malloc mprotect limit in bytes. */ + #define MALLOC_MP_LIM 1048576 + #include <stdio.h> #include <string.h> #include <stdlib.h>

- #include "orconfig.h" - #include "sandbox.h" - #include "torlog.h" - #include "util.h" + #include "sandbox.h" + #include "torlog.h" -#include "orconfig.h" + #include "torint.h" + #include "util.h" + #include "tor_queue.h" + + #define DEBUGGING_CLOSE + + #if defined(USE_LIBSECCOMP) + + #define _GNU_SOURCE + + #include <sys/mman.h> + #include <sys/syscall.h> + #include <sys/types.h> + #include <sys/stat.h> + #include <sys/epoll.h> + #include <sys/prctl.h> + #include <linux/futex.h> + #include <bits/signum.h> + #include <event2/event.h> + + #include <stdarg.h> + #include <seccomp.h> + #include <signal.h> + #include <unistd.h> + #include <fcntl.h> + #include <time.h> + #include <poll.h> + + /**Determines if at least one sandbox is active.*/ + static int sandbox_active = 0; + /** Holds the parameter list configuration for the sandbox.*/ + static sandbox_cfg_t *filter_dynamic = NULL; + /** Holds a list of pre-recorded results from getaddrinfo().*/ + static sb_addr_info_t *sb_addr_info = NULL; + + #undef SCMP_CMP + #define SCMP_CMP(a,b,c) ((struct scmp_arg_cmp){(a),(b),(c),0}) + + /** Variable used for storing all syscall numbers that will be allowed with the + * stage 1 general Tor sandbox. + */ + static int filter_nopar_gen[] = { + SCMP_SYS(access), + SCMP_SYS(brk), + SCMP_SYS(clock_gettime), + SCMP_SYS(close), + SCMP_SYS(clone), + SCMP_SYS(epoll_create), + SCMP_SYS(epoll_wait), + SCMP_SYS(fcntl), + SCMP_SYS(fstat), + #ifdef __NR_fstat64 + SCMP_SYS(fstat64), + #endif + SCMP_SYS(getdents64), + SCMP_SYS(getegid), + #ifdef __NR_getegid32 + SCMP_SYS(getegid32), + #endif + SCMP_SYS(geteuid), + #ifdef __NR_geteuid32 + SCMP_SYS(geteuid32), + #endif + SCMP_SYS(getgid), + #ifdef __NR_getgid32 + SCMP_SYS(getgid32), + #endif + SCMP_SYS(getrlimit), + SCMP_SYS(gettimeofday), + SCMP_SYS(getuid), + #ifdef __NR_getuid32 + SCMP_SYS(getuid32), + #endif + SCMP_SYS(lseek), + #ifdef __NR__llseek + SCMP_SYS(_llseek), + #endif + SCMP_SYS(mkdir), + SCMP_SYS(mlockall), + SCMP_SYS(mmap), + SCMP_SYS(munmap), + SCMP_SYS(read), + SCMP_SYS(rename), + SCMP_SYS(rt_sigreturn), + SCMP_SYS(set_robust_list), + #ifdef __NR_sigreturn + SCMP_SYS(sigreturn), + #endif + SCMP_SYS(stat), + SCMP_SYS(uname), + SCMP_SYS(write), + SCMP_SYS(exit_group), + SCMP_SYS(exit), + + SCMP_SYS(madvise), + #ifdef __NR_stat64 + // getaddrinfo uses this.. + SCMP_SYS(stat64), + #endif + + /* + * These socket syscalls are not required on x86_64 and not supported with + * some libseccomp versions (eg: 1.0.1) + */ + #if defined(__i386) + SCMP_SYS(recv), + SCMP_SYS(send), + #endif + + // socket syscalls + SCMP_SYS(bind), + SCMP_SYS(connect), + SCMP_SYS(getsockname), + SCMP_SYS(recvmsg), + SCMP_SYS(recvfrom), + SCMP_SYS(sendto), + SCMP_SYS(unlink) + }; + + /** + * Function responsible for setting up the rt_sigaction syscall for + * the seccomp filter sandbox. + */ + static int + sb_rt_sigaction(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + unsigned i; + int rc; + int param[] = { SIGINT, SIGTERM, SIGPIPE, SIGUSR1, SIGUSR2, SIGHUP, SIGCHLD, + #ifdef SIGXFSZ + SIGXFSZ + #endif + }; + (void) filter; + + for (i = 0; i < ARRAY_LENGTH(param); i++) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigaction), 1, + SCMP_CMP(0, SCMP_CMP_EQ, param[i])); + if (rc) + break; + } + + return rc; + } + + /** + * Function responsible for setting up the execve syscall for + * the seccomp filter sandbox. + */ + static int + sb_execve(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc; + sandbox_cfg_t *elem = NULL; + + // for each dynamic parameter filters + for (elem = filter; elem != NULL; elem = elem->next) { + smp_param_t *param = (smp_param_t*) elem->param; + + if (param != NULL && param->prot == 1 && param->syscall + == SCMP_SYS(execve)) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(execve), 1, + SCMP_CMP(0, SCMP_CMP_EQ, param->value)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add execve syscall, received " + "libseccomp error %d", rc); + return rc; + } + } + } + + return 0; + } + + /** + * Function responsible for setting up the time syscall for + * the seccomp filter sandbox. + */ + static int + sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + (void) filter; + return seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time), 1, + SCMP_CMP(0, SCMP_CMP_EQ, 0)); + } + + /** + * Function responsible for setting up the accept4 syscall for + * the seccomp filter sandbox. + */ + static int + sb_accept4(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void)filter; + + #ifdef __i386__ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketcall), 1, + SCMP_CMP(0, SCMP_CMP_EQ, 18)); + if (rc) { + return rc; + } + #endif + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(accept4), 1, + SCMP_CMP(3, SCMP_CMP_EQ, SOCK_CLOEXEC)); + if (rc) { + return rc; + } + + return 0; + } + + #ifdef __NR_mmap2 + /** + * Function responsible for setting up the mmap2 syscall for + * the seccomp filter sandbox. + */ + static int + sb_mmap2(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ), + SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE)); + if (rc) { + return rc; + } + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_NONE), + SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE)); + if (rc) { + return rc; + } + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE), + SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_ANONYMOUS)); + if (rc) { + return rc; + } + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE), + SCMP_CMP(3, SCMP_CMP_EQ,MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK)); + if (rc) { + return rc; + } + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE), + SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE)); + if (rc) { + return rc; + } + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE), + SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS)); + if (rc) { + return rc; + } + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap2), 2, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_EXEC), + SCMP_CMP(3, SCMP_CMP_EQ, MAP_PRIVATE|MAP_DENYWRITE)); + if (rc) { + return rc; + } + + return 0; + } + #endif + + /** + * Function responsible for setting up the open syscall for + * the seccomp filter sandbox. + */ + static int + sb_open(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc; + sandbox_cfg_t *elem = NULL; + + // for each dynamic parameter filters + for (elem = filter; elem != NULL; elem = elem->next) { + smp_param_t *param = elem->param; + + if (param != NULL && param->prot == 1 && param->syscall + == SCMP_SYS(open)) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open), 1, + SCMP_CMP(0, SCMP_CMP_EQ, param->value)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add open syscall, received " + "libseccomp error %d", rc); + return rc; + } + } + } + + rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(-1), SCMP_SYS(open), 1, + SCMP_CMP(1, SCMP_CMP_EQ, O_RDONLY|O_CLOEXEC)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add open syscall, received libseccomp " + "error %d", rc); + return rc; + } + + return 0; + } + + /** + * Function responsible for setting up the openat syscall for + * the seccomp filter sandbox. + */ + static int + sb_openat(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc; + sandbox_cfg_t *elem = NULL; + + // for each dynamic parameter filters + for (elem = filter; elem != NULL; elem = elem->next) { + smp_param_t *param = elem->param; + + if (param != NULL && param->prot == 1 && param->syscall + == SCMP_SYS(openat)) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat), 1, + SCMP_CMP(0, SCMP_CMP_EQ, AT_FDCWD), + SCMP_CMP(1, SCMP_CMP_EQ, param->value), + SCMP_CMP(2, SCMP_CMP_EQ, O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY| + O_CLOEXEC)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add openat syscall, received " + "libseccomp error %d", rc); + return rc; + } + } + } + + return 0; + } + + /** + * Function responsible for setting up the socket syscall for + * the seccomp filter sandbox. + */ + static int + sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + #ifdef __i386__ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 0); + if (rc) + return rc; + #endif + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, + SCMP_CMP(0, SCMP_CMP_EQ, PF_FILE), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK), + SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, + SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC), + SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_TCP)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, + SCMP_CMP(0, SCMP_CMP_EQ, PF_INET), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK), + SCMP_CMP(2, SCMP_CMP_EQ, IPPROTO_IP)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), 3, + SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_RAW), + SCMP_CMP(2, SCMP_CMP_EQ, 0)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the socketpair syscall for + * the seccomp filter sandbox. + */ + static int + sb_socketpair(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + #ifdef __i386__ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketpair), 0); + if (rc) + return rc; + #endif + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socketpair), 2, + SCMP_CMP(0, SCMP_CMP_EQ, PF_FILE), + SCMP_CMP(1, SCMP_CMP_EQ, SOCK_STREAM|SOCK_CLOEXEC)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the setsockopt syscall for + * the seccomp filter sandbox. + */ + static int + sb_setsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + #ifdef __i386__ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 0); + if (rc) + return rc; + #endif + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(setsockopt), 2, + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_REUSEADDR)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the getsockopt syscall for + * the seccomp filter sandbox. + */ + static int + sb_getsockopt(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + #ifdef __i386__ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), 0); + if (rc) + return rc; + #endif + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(getsockopt), 2, + SCMP_CMP(1, SCMP_CMP_EQ, SOL_SOCKET), + SCMP_CMP(2, SCMP_CMP_EQ, SO_ERROR)); + if (rc) + return rc; + + return 0; + } + + #ifdef __NR_fcntl64 + /** + * Function responsible for setting up the fcntl64 syscall for + * the seccomp filter sandbox. + */ + static int + sb_fcntl64(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64), 1, + SCMP_CMP(1, SCMP_CMP_EQ, F_GETFL)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64), 2, + SCMP_CMP(1, SCMP_CMP_EQ, F_SETFL), + SCMP_CMP(2, SCMP_CMP_EQ, O_RDWR|O_NONBLOCK)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64), 1, + SCMP_CMP(1, SCMP_CMP_EQ, F_GETFD)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(fcntl64), 2, + SCMP_CMP(1, SCMP_CMP_EQ, F_SETFD), + SCMP_CMP(2, SCMP_CMP_EQ, FD_CLOEXEC)); + if (rc) + return rc; + + return 0; + } + #endif + + /** + * Function responsible for setting up the epoll_ctl syscall for + * the seccomp filter sandbox. + * + * Note: basically allows everything but will keep for now.. + */ + static int + sb_epoll_ctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl), 1, + SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_ADD)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl), 1, + SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_MOD)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(epoll_ctl), 1, + SCMP_CMP(1, SCMP_CMP_EQ, EPOLL_CTL_DEL)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the fcntl64 syscall for + * the seccomp filter sandbox. + * + * NOTE: if multiple filters need to be added, the PR_SECCOMP parameter needs + * to be whitelisted in this function. + */ + static int + sb_prctl(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(prctl), 1, + SCMP_CMP(0, SCMP_CMP_EQ, PR_SET_DUMPABLE)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the fcntl64 syscall for + * the seccomp filter sandbox. + * + * NOTE: does not NEED to be here.. currently only occurs before filter; will + * keep just in case for the future. + */ + static int + sb_mprotect(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 1, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 1, + SCMP_CMP(2, SCMP_CMP_EQ, PROT_NONE)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the rt_sigprocmask syscall for + * the seccomp filter sandbox. + */ + static int + sb_rt_sigprocmask(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask), 1, + SCMP_CMP(0, SCMP_CMP_EQ, SIG_UNBLOCK)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask), 1, + SCMP_CMP(0, SCMP_CMP_EQ, SIG_SETMASK)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the flock syscall for + * the seccomp filter sandbox. + * + * NOTE: does not need to be here, occurs before filter is applied. + */ + static int + sb_flock(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(flock), 1, + SCMP_CMP(1, SCMP_CMP_EQ, LOCK_EX|LOCK_NB)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(flock), 1, + SCMP_CMP(1, SCMP_CMP_EQ, LOCK_UN)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the futex syscall for + * the seccomp filter sandbox. + */ + static int + sb_futex(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + // can remove + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(futex), 1, + SCMP_CMP(1, SCMP_CMP_EQ, + FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(futex), 1, + SCMP_CMP(1, SCMP_CMP_EQ, FUTEX_WAKE_PRIVATE)); + if (rc) + return rc; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(futex), 1, + SCMP_CMP(1, SCMP_CMP_EQ, FUTEX_WAIT_PRIVATE)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the mremap syscall for + * the seccomp filter sandbox. + * + * NOTE: so far only occurs before filter is applied. + */ + static int + sb_mremap(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mremap), 1, + SCMP_CMP(3, SCMP_CMP_EQ, MREMAP_MAYMOVE)); + if (rc) + return rc; + + return 0; + } + + /** + * Function responsible for setting up the poll syscall for + * the seccomp filter sandbox. + */ + static int + sb_poll(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + (void) filter; + + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(poll), 2, + SCMP_CMP(1, SCMP_CMP_EQ, 1), + SCMP_CMP(2, SCMP_CMP_EQ, 10)); + if (rc) + return rc; + + return 0; + } + + #ifdef __NR_stat64 + /** + * Function responsible for setting up the stat64 syscall for + * the seccomp filter sandbox. + */ + static int + sb_stat64(scmp_filter_ctx ctx, sandbox_cfg_t *filter) + { + int rc = 0; + sandbox_cfg_t *elem = NULL; + + // for each dynamic parameter filters + for (elem = filter; elem != NULL; elem = elem->next) { + smp_param_t *param = elem->param; + + if (param != NULL && param->prot == 1 && (param->syscall == SCMP_SYS(open) + || param->syscall == SCMP_SYS(stat64))) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(stat64), 1, + SCMP_CMP(0, SCMP_CMP_EQ, param->value)); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add open syscall, received " + "libseccomp error %d", rc); + return rc; + } + } + } + + return 0; + } + #endif + + /** + * Array of function pointers responsible for filtering different syscalls at + * a parameter level. + */ + static sandbox_filter_func_t filter_func[] = { + sb_rt_sigaction, + sb_rt_sigprocmask, + sb_execve, + sb_time, + sb_accept4, + #ifdef __NR_mmap2 + sb_mmap2, + #endif + sb_open, + sb_openat, + #ifdef __NR_fcntl64 + sb_fcntl64, + #endif + sb_epoll_ctl, + sb_prctl, + sb_mprotect, + sb_flock, + sb_futex, + sb_mremap, + sb_poll, + #ifdef __NR_stat64 + sb_stat64, + #endif + + sb_socket, + sb_setsockopt, + sb_getsockopt, + sb_socketpair + }; + + const char* + sandbox_intern_string(const char *str) + { + sandbox_cfg_t *elem; + + if (str == NULL) + return NULL; + + for (elem = filter_dynamic; elem != NULL; elem = elem->next) { + smp_param_t *param = elem->param; + + if (param->prot && !strcmp(str, (char*)(param->value))) { + return (char*)(param->value); + } + } + + log_info(LD_GENERAL, "(Sandbox) Parameter %s not found", str); + return str; + } + + /** + * Protects all the strings in the sandbox's parameter list configuration. It + * works by calculating the total amount of memory required by the parameter + * list, allocating the memory using mmap, and protecting it from writes with + * mprotect(). + */ + static int + prot_strings(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) + { + int ret = 0; + size_t pr_mem_size = 0, pr_mem_left = 0; + char *pr_mem_next = NULL, *pr_mem_base; + sandbox_cfg_t *el = NULL; + + // get total number of bytes required to mmap + for (el = cfg; el != NULL; el = el->next) { + pr_mem_size += strlen((char*) ((smp_param_t*)el->param)->value) + 1; + } + + // allocate protected memory with MALLOC_MP_LIM canary + pr_mem_base = (char*) mmap(NULL, MALLOC_MP_LIM + pr_mem_size, + PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); + if (pr_mem_base == MAP_FAILED) { + log_err(LD_BUG,"(Sandbox) failed allocate protected memory! mmap: %s", + strerror(errno)); + ret = -1; + goto out; + } + + pr_mem_next = pr_mem_base + MALLOC_MP_LIM; + pr_mem_left = pr_mem_size; + + // change el value pointer to protected + for (el = cfg; el != NULL; el = el->next) { + char *param_val = (char*)((smp_param_t *)el->param)->value; + size_t param_size = strlen(param_val) + 1; + + if (pr_mem_left >= param_size) { + // copy to protected + memcpy(pr_mem_next, param_val, param_size); + + // re-point el parameter to protected + { + void *old_val = (void *) ((smp_param_t*)el->param)->value; + tor_free(old_val); + } + ((smp_param_t*)el->param)->value = (intptr_t) pr_mem_next; + ((smp_param_t*)el->param)->prot = 1; + + // move next available protected memory + pr_mem_next += param_size; + pr_mem_left -= param_size; + } else { + log_err(LD_BUG,"(Sandbox) insufficient protected memory!"); + ret = -2; + goto out; + } + } + + // protecting from writes + if (mprotect(pr_mem_base, MALLOC_MP_LIM + pr_mem_size, PROT_READ)) { + log_err(LD_BUG,"(Sandbox) failed to protect memory! mprotect: %s", + strerror(errno)); + ret = -3; + goto out; + } + + /* + * Setting sandbox restrictions so the string memory cannot be tampered with + */ + // no mremap of the protected base address + ret = seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(mremap), 1, + SCMP_CMP(0, SCMP_CMP_EQ, (intptr_t) pr_mem_base)); + if (ret) { + log_err(LD_BUG,"(Sandbox) mremap protected memory filter fail!"); + return ret; + } + + // no munmap of the protected base address + ret = seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(munmap), 1, + SCMP_CMP(0, SCMP_CMP_EQ, (intptr_t) pr_mem_base)); + if (ret) { + log_err(LD_BUG,"(Sandbox) munmap protected memory filter fail!"); + return ret; + } + + /* + * Allow mprotect with PROT_READ|PROT_WRITE because openssl uses it, but + * never over the memory region used by the protected strings. + * + * PROT_READ|PROT_WRITE was originally fully allowed in sb_mprotect(), but + * had to be removed due to limitation of libseccomp regarding intervals. + * + * There is a restriction on how much you can mprotect with R|W up to the + * size of the canary. + */ + ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 2, + SCMP_CMP(0, SCMP_CMP_LT, (intptr_t) pr_mem_base), + SCMP_CMP(1, SCMP_CMP_LE, MALLOC_MP_LIM), + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE)); + if (ret) { + log_err(LD_BUG,"(Sandbox) mprotect protected memory filter fail (LT)!"); + return ret; + } + + ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 2, + SCMP_CMP(0, SCMP_CMP_GT, (intptr_t) pr_mem_base + pr_mem_size + + MALLOC_MP_LIM), + SCMP_CMP(1, SCMP_CMP_LE, MALLOC_MP_LIM), + SCMP_CMP(2, SCMP_CMP_EQ, PROT_READ|PROT_WRITE)); + if (ret) { + log_err(LD_BUG,"(Sandbox) mprotect protected memory filter fail (GT)!"); + return ret; + } + + out: + return ret; + } + + /** + * Auxiliary function used in order to allocate a sandbox_cfg_t element and set + * it's values according the the parameter list. All elements are initialised + * with the 'prot' field set to false, as the pointer is not protected at this + * point. + */ + static sandbox_cfg_t* + new_element(int syscall, int index, intptr_t value) + { + smp_param_t *param = NULL; + + sandbox_cfg_t *elem = (sandbox_cfg_t*) tor_malloc(sizeof(sandbox_cfg_t)); + if (!elem) + return NULL; + + elem->param = (smp_param_t*) tor_malloc(sizeof(smp_param_t)); + if (!elem->param) { + tor_free(elem); + return NULL; + } + + param = elem->param; + param->syscall = syscall; + param->pindex = index; + param->value = value; + param->prot = 0; + + return elem; + } + + #ifdef __NR_stat64 + #define SCMP_stat SCMP_SYS(stat64) + #else + #define SCMP_stat SCMP_SYS(stat) + #endif + + int + sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file, int fr) + { + sandbox_cfg_t *elem = NULL; + + elem = new_element(SCMP_stat, 0, (intptr_t)(void*) tor_strdup(file)); + if (!elem) { + log_err(LD_BUG,"(Sandbox) failed to register parameter!"); + return -1; + } + + elem->next = *cfg; + *cfg = elem; + + if (fr) tor_free(file); + return 0; + } + + int + sandbox_cfg_allow_stat_filename_array(sandbox_cfg_t **cfg, ...) + { + int rc = 0; + char *fn = NULL; + + va_list ap; + va_start(ap, cfg); + + while ((fn = va_arg(ap, char*)) != NULL) { + int fr = va_arg(ap, int); + + rc = sandbox_cfg_allow_stat_filename(cfg, fn, fr); + if (rc) { + log_err(LD_BUG,"(Sandbox) sandbox_cfg_allow_stat_filename_array fail"); + goto end; + } + } + + end: + va_end(ap); + return 0; + } + + int + sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file, int fr) + { + sandbox_cfg_t *elem = NULL; + + elem = new_element(SCMP_SYS(open), 0, (intptr_t)(void *)tor_strdup(file)); + if (!elem) { + log_err(LD_BUG,"(Sandbox) failed to register parameter!"); + return -1; + } + + elem->next = *cfg; + *cfg = elem; + + if (fr) tor_free(file); + + return 0; + } + + int + sandbox_cfg_allow_open_filename_array(sandbox_cfg_t **cfg, ...) + { + int rc = 0; + char *fn = NULL; + + va_list ap; + va_start(ap, cfg); + + while ((fn = va_arg(ap, char*)) != NULL) { + int fr = va_arg(ap, int);

- #if defined(HAVE_SECCOMP_H) && defined(__linux__) - #define USE_LIBSECCOMP - #endif + rc = sandbox_cfg_allow_open_filename(cfg, fn, fr); + if (rc) { + log_err(LD_BUG,"(Sandbox) sandbox_cfg_allow_open_filename_array fail"); + goto end; + } + }

- #define DEBUGGING_CLOSE + end: + va_end(ap); + return 0; + }

- #if defined(USE_LIBSECCOMP) + int + sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file, int fr) + { + sandbox_cfg_t *elem = NULL;

- #include <sys/syscall.h> - #include <seccomp.h> - #include <signal.h> - #include <unistd.h> + elem = new_element(SCMP_SYS(openat), 1, (intptr_t)(void *)tor_strdup(file)); + if (!elem) { + log_err(LD_BUG,"(Sandbox) failed to register parameter!"); + return -1; + }

- /** Variable used for storing all syscall numbers that will be allowed with the - * stage 1 general Tor sandbox. + elem->next = *cfg; + *cfg = elem; + + if (fr) tor_free(file); + + return 0; + } + + int + sandbox_cfg_allow_openat_filename_array(sandbox_cfg_t **cfg, ...) + { + int rc = 0; + char *fn = NULL; + + va_list ap; + va_start(ap, cfg); + + while ((fn = va_arg(ap, char*)) != NULL) { + int fr = va_arg(ap, int); + + rc = sandbox_cfg_allow_openat_filename(cfg, fn, fr); + if (rc) { + log_err(LD_BUG,"(Sandbox) sandbox_cfg_allow_openat_filename_array fail"); + goto end; + } + } + + end: + va_end(ap); + return 0; + } + + int + sandbox_cfg_allow_execve(sandbox_cfg_t **cfg, const char *com) + { + sandbox_cfg_t *elem = NULL; + + elem = new_element(SCMP_SYS(execve), 1, (intptr_t)(void *)tor_strdup(com)); + if (!elem) { + log_err(LD_BUG,"(Sandbox) failed to register parameter!"); + return -1; + } + + elem->next = *cfg; + *cfg = elem; + + return 0; + } + + int + sandbox_cfg_allow_execve_array(sandbox_cfg_t **cfg, ...) + { + int rc = 0; + char *fn = NULL; + + va_list ap; + va_start(ap, cfg); + + while ((fn = va_arg(ap, char*)) != NULL) { + + rc = sandbox_cfg_allow_execve(cfg, fn); + if (rc) { + log_err(LD_BUG,"(Sandbox) sandbox_cfg_allow_execve_array failed"); + goto end; + } + } + + end: + va_end(ap); + return 0; + } + + int + sandbox_getaddrinfo(const char *name, const char *servname, + const struct addrinfo *hints, + struct addrinfo **res) + { + sb_addr_info_t *el; + + if (servname != NULL) + return -1; + + *res = NULL; + + for (el = sb_addr_info; el; el = el->next) { + if (!strcmp(el->name, name)) { + *res = (struct addrinfo *) tor_malloc(sizeof(struct addrinfo)); + if (!res) { + return -2; + } + + memcpy(*res, el->info, sizeof(struct addrinfo)); + return 0; + } + } + + if (!sandbox_active) { + if (getaddrinfo(name, NULL, hints, res)) { + log_err(LD_BUG,"(Sandbox) getaddrinfo failed!"); + return -1; + } + + return 0; + } + + // getting here means something went wrong + log_err(LD_BUG,"(Sandbox) failed to get address %s!", name); + if (*res) { + tor_free(*res); + res = NULL; + } + return -1; + } + + int + sandbox_add_addrinfo(const char* name) + { + int ret; + struct addrinfo hints; + sb_addr_info_t *el = NULL; + + el = (sb_addr_info_t*) tor_malloc(sizeof(sb_addr_info_t)); + if (!el) { + log_err(LD_BUG,"(Sandbox) failed to allocate addr info!"); + ret = -2; + goto out; + } + + memset(&hints, 0, sizeof(hints)); + hints.ai_family = AF_INET; + hints.ai_socktype = SOCK_STREAM; + + ret = getaddrinfo(name, NULL, &hints, &(el->info)); + if (ret) { + log_err(LD_BUG,"(Sandbox) failed to getaddrinfo"); + ret = -2; + goto out; + } + + el->name = tor_strdup(name); + el->next = sb_addr_info; + sb_addr_info = el; + + out: + return ret; + } + + /** + * Function responsible for going through the parameter syscall filters and + * call each function pointer in the list. */ - static int general_filter[] = { - SCMP_SYS(access), - SCMP_SYS(brk), - SCMP_SYS(clock_gettime), - SCMP_SYS(close), - SCMP_SYS(clone), - SCMP_SYS(epoll_create), - SCMP_SYS(epoll_ctl), - SCMP_SYS(epoll_wait), - SCMP_SYS(execve), - SCMP_SYS(fcntl), - #ifdef __NR_fcntl64 - /* Older libseccomp versions don't define PNR entries for all of these, - * so we need to ifdef them here.*/ - SCMP_SYS(fcntl64), - #endif - SCMP_SYS(flock), - SCMP_SYS(fstat), - #ifdef __NR_fstat64 - SCMP_SYS(fstat64), - #endif - SCMP_SYS(futex), - SCMP_SYS(getdents64), - SCMP_SYS(getegid), - #ifdef __NR_getegid32 - SCMP_SYS(getegid32), - #endif - SCMP_SYS(geteuid), - #ifdef __NR_geteuid32 - SCMP_SYS(geteuid32), - #endif - SCMP_SYS(getgid), - #ifdef __NR_getgid32 - SCMP_SYS(getgid32), - #endif - SCMP_SYS(getrlimit), - SCMP_SYS(gettimeofday), - SCMP_SYS(getuid), - #ifdef __NR_getuid32 - SCMP_SYS(getuid32), - #endif - SCMP_SYS(lseek), - #ifdef __NR__llseek - SCMP_SYS(_llseek), - #endif - SCMP_SYS(mkdir), - SCMP_SYS(mlockall), - SCMP_SYS(mmap), - #ifdef __NR_mmap2 - SCMP_SYS(mmap2), - #endif - SCMP_SYS(mprotect), - SCMP_SYS(mremap), - SCMP_SYS(munmap), - SCMP_SYS(open), - SCMP_SYS(openat), - SCMP_SYS(poll), - SCMP_SYS(prctl), - SCMP_SYS(read), - SCMP_SYS(rename), - SCMP_SYS(rt_sigaction), - SCMP_SYS(rt_sigprocmask), - SCMP_SYS(rt_sigreturn), - #ifdef __NR_sigreturn - SCMP_SYS(sigreturn), - #endif - SCMP_SYS(set_robust_list), - SCMP_SYS(set_thread_area), - SCMP_SYS(set_tid_address), - SCMP_SYS(stat), - #ifdef __NR_stat64 - SCMP_SYS(stat64), - #endif - SCMP_SYS(time), - SCMP_SYS(uname), - SCMP_SYS(write), - SCMP_SYS(exit_group), - SCMP_SYS(exit), + static int + add_param_filter(scmp_filter_ctx ctx, sandbox_cfg_t* cfg) + { + unsigned i; + int rc = 0;

- // socket syscalls - SCMP_SYS(accept4), - SCMP_SYS(bind), - SCMP_SYS(connect), - SCMP_SYS(getsockname), - SCMP_SYS(getsockopt), - SCMP_SYS(listen), - #if __NR_recv >= 0 - /* This is a kludge; It's necessary on 64-bit with libseccomp 1.0.0; I - * don't know if other 64-bit or other versions require it. */ - SCMP_SYS(recv), - #endif - SCMP_SYS(recvmsg), - #if __NR_send >= 0 - SCMP_SYS(send), - #endif - SCMP_SYS(sendto), - SCMP_SYS(setsockopt), - SCMP_SYS(socket), - SCMP_SYS(socketpair), + // function pointer + for (i = 0; i < ARRAY_LENGTH(filter_func); i++) { + if ((filter_func[i])(ctx, cfg)) { + log_err(LD_BUG,"(Sandbox) failed to add syscall %d, received libseccomp " + "error %d", i, rc); + return rc; + } + }

- // TODO: remove when accept4 is fixed - #ifdef __NR_socketcall - SCMP_SYS(socketcall), - #endif + return 0; + }

- SCMP_SYS(recvfrom), - SCMP_SYS(unlink) - }; + /** + * Function responsible of loading the libseccomp syscall filters which do not + * have parameter filtering. + */ + static int + add_noparam_filter(scmp_filter_ctx ctx) + { + unsigned i; + int rc = 0; + + // add general filters + for (i = 0; i < ARRAY_LENGTH(filter_nopar_gen); i++) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, filter_nopar_gen[i], 0); + if (rc != 0) { + log_err(LD_BUG,"(Sandbox) failed to add syscall index %d (NR=%d), " + "received libseccomp error %d", i, filter_nopar_gen[i], rc); + return rc; + } + } + + return 0; + }

/** * Function responsible for setting up and enabling a global syscall filter. diff --cc src/common/util.h index 090243e,fc4ca29..fdd8c13 --- a/src/common/util.h +++ b/src/common/util.h @@@ -538,9 -531,9 +538,11 @@@ STATIC int format_helper_exit_status(un 1 + sizeof(int) * 2 + 1) #endif

+#endif + const char *libor_get_digests(void);

+ #define ARRAY_LENGTH(x) (sizeof(x)) / sizeof(x[0]) + #endif