From 211b3b7ce352c99c74212d294fe3b4cc1a25ca0f Mon Sep 17 00:00:00 2001 From: Stephen Gregoratto Date: Sat, 16 Jul 2022 16:02:30 +1000 Subject: [PATCH] Polyfill OpenBSD unveil for Linux. --- libc/calls/calls.h | 1 + libc/calls/landlock.h | 2 + libc/calls/syscall-sysv.internal.h | 1 + libc/mem/unveil.c | 144 +++++++++++++++++++++++++++++ libc/sysv/calls/sys_unveil.s | 2 + libc/sysv/syscalls.sh | 1 + tool/build/unveil.c | 107 +++++++++++++++++++++ 7 files changed, 258 insertions(+) create mode 100644 libc/mem/unveil.c create mode 100644 libc/sysv/calls/sys_unveil.s create mode 100644 tool/build/unveil.c diff --git a/libc/calls/calls.h b/libc/calls/calls.h index 24f5db396..5f13611b6 100644 --- a/libc/calls/calls.h +++ b/libc/calls/calls.h @@ -181,6 +181,7 @@ int umask(int); int unlink(const char *); int unlink_s(const char **); int unlinkat(int, const char *, int); +int unveil(const char *, const char *); int vfork(void) returnstwice; int wait(int *); int waitpid(int, int *, int); diff --git a/libc/calls/landlock.h b/libc/calls/landlock.h index cfaf7f06c..0f4f460bb 100644 --- a/libc/calls/landlock.h +++ b/libc/calls/landlock.h @@ -1,6 +1,8 @@ #ifndef COSMOPOLITAN_LIBC_CALLS_LANDLOCK_H_ #define COSMOPOLITAN_LIBC_CALLS_LANDLOCK_H_ +#define LANDLOCK_CREATE_RULESET_VERSION 0x0001ul + #define LANDLOCK_ACCESS_FS_EXECUTE 0x0001ul #define LANDLOCK_ACCESS_FS_WRITE_FILE 0x0002ul #define LANDLOCK_ACCESS_FS_READ_FILE 0x0004ul diff --git a/libc/calls/syscall-sysv.internal.h b/libc/calls/syscall-sysv.internal.h index 04472309b..9561ac9cd 100644 --- a/libc/calls/syscall-sysv.internal.h +++ b/libc/calls/syscall-sysv.internal.h @@ -111,6 +111,7 @@ u32 sys_geteuid(void) hidden; u32 sys_getgid(void) hidden; u32 sys_getuid(void) hidden; u32 sys_umask(u32) hidden; +i32 sys_unveil(const char *, const char *) hidden; void *__sys_mmap(void *, u64, u32, u32, i64, i64, i64) hidden; void *sys_mremap(void *, u64, u64, i32, void *) hidden; void sys_exit(int) hidden; diff --git a/libc/mem/unveil.c b/libc/mem/unveil.c new file mode 100644 index 000000000..ed7cdf7b7 --- /dev/null +++ b/libc/mem/unveil.c @@ -0,0 +1,144 @@ +/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│ +│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8 :vi│ +╞══════════════════════════════════════════════════════════════════════════════╡ +│ Copyright 2020 Justine Alexandra Roberts Tunney │ +│ │ +│ Permission to use, copy, modify, and/or distribute this software for │ +│ any purpose with or without fee is hereby granted, provided that the │ +│ above copyright notice and this permission notice appear in all copies. │ +│ │ +│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL │ +│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED │ +│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE │ +│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL │ +│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR │ +│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER │ +│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │ +│ PERFORMANCE OF THIS SOFTWARE. │ +╚─────────────────────────────────────────────────────────────────────────────*/ +#include "libc/assert.h" +#include "libc/calls/calls.h" +#include "libc/calls/landlock.h" +#include "libc/calls/strace.internal.h" +#include "libc/calls/struct/stat.h" +#include "libc/calls/syscall-sysv.internal.h" +#include "libc/calls/syscall_support-sysv.internal.h" +#include "libc/errno.h" +#include "libc/mem/mem.h" +#include "libc/str/str.h" +#include "libc/sysv/consts/o.h" +#include "libc/sysv/consts/pr.h" +#include "libc/sysv/consts/s.h" +#include "libc/sysv/errfuns.h" + +#define FILE_BITS \ + (LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_WRITE_FILE | \ + LANDLOCK_ACCESS_FS_EXECUTE) + +/* + * Long living state for landlock calls. + * The bits are set at runtime to handle future API additions. + * As of 5.19, the latest abi is v2. + * + * TODO: + * - Documentation for sys_unveil. + * - Integrate with pledge and remove the file access? + * - Stuff state into the .protected section? + */ +static struct { + int abi; + int fd; + uint64_t read; + uint64_t write; + uint64_t exec; + uint64_t create; +} State = { + .abi = 2, + .fd = 0, + .read = LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | + LANDLOCK_ACCESS_FS_REFER, + .write = LANDLOCK_ACCESS_FS_WRITE_FILE, + .exec = LANDLOCK_ACCESS_FS_EXECUTE, + .create = LANDLOCK_ACCESS_FS_REMOVE_DIR | LANDLOCK_ACCESS_FS_MAKE_CHAR | + LANDLOCK_ACCESS_FS_MAKE_DIR | LANDLOCK_ACCESS_FS_MAKE_REG | + LANDLOCK_ACCESS_FS_MAKE_SOCK | LANDLOCK_ACCESS_FS_MAKE_FIFO | + LANDLOCK_ACCESS_FS_MAKE_BLOCK | LANDLOCK_ACCESS_FS_MAKE_SYM, +}; + +forceinline int unveil_final(void) { + int rc; + if (State.fd == -1) return 0; + assert(State.fd > 0); + if ((rc = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) != -1 && + (rc = landlock_restrict_self(State.fd, 0)) != -1 && + (rc = close(State.fd)) != -1) + State.fd = -1; + return rc; +} + +forceinline int unveil_init(void) { + int rc; + if ((rc = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION)) < + 0) + return -1; + State.abi = rc; + if (State.abi < 2) State.read &= ~LANDLOCK_ACCESS_FS_REFER; + const struct landlock_ruleset_attr attr = { + .handled_access_fs = State.read | State.write | State.exec | State.create, + }; + if ((rc = landlock_create_ruleset(&attr, sizeof(attr), 0)) < 0) return -1; + State.fd = rc; + return 0; +} + +forceinline int err_close(int rc, int fd) { + int serrno = errno; + close(fd); + errno = serrno; + return rc; +} + +static int sys_unveil_linux(const char *path, const char *permissions) { + int rc; + if (State.fd == 0 && (rc = unveil_init()) == -1) return rc; + if (path == NULL && permissions == NULL) return unveil_final(); + struct landlock_path_beneath_attr pb = {0}; + for (const char *c = permissions; *c != '\0'; c++) { + switch (*c) { + case 'r': + pb.allowed_access |= State.read; + break; + case 'w': + pb.allowed_access |= State.write; + break; + case 'x': + pb.allowed_access |= State.exec; + break; + case 'c': + pb.allowed_access |= State.create; + break; + default: + return einval(); + } + } + if ((rc = open(path, O_RDONLY | O_PATH | O_CLOEXEC)) == -1) return rc; + pb.parent_fd = rc; + struct stat st; + if ((rc = fstat(pb.parent_fd, &st)) == -1) return err_close(rc, pb.parent_fd); + if (!S_ISDIR(st.st_mode)) pb.allowed_access &= FILE_BITS; + if ((rc = landlock_add_rule(State.fd, LANDLOCK_RULE_PATH_BENEATH, &pb, 0))) + return err_close(rc, pb.parent_fd); + close(pb.parent_fd); + return rc; +} + +int unveil(const char *path, const char *permissions) { + int rc; + if (IsLinux()) { + rc = sys_unveil_linux(path, permissions); + } else { + rc = sys_unveil(path, permissions); + } + STRACE("unveil(%#s, %#s) → %d% m", path, permissions, rc); + return rc; +} diff --git a/libc/sysv/calls/sys_unveil.s b/libc/sysv/calls/sys_unveil.s new file mode 100644 index 000000000..937d8bf64 --- /dev/null +++ b/libc/sysv/calls/sys_unveil.s @@ -0,0 +1,2 @@ +.include "o/libc/sysv/macros.internal.inc" +.scall sys_unveil,0xfff072ffffffffff,globl diff --git a/libc/sysv/syscalls.sh b/libc/sysv/syscalls.sh index f7ee4a9e3..b8f7af124 100755 --- a/libc/sysv/syscalls.sh +++ b/libc/sysv/syscalls.sh @@ -399,6 +399,7 @@ scall memfd_secret 0xfffffffffffff1bf globl scall process_mrelease 0xfffffffffffff1c0 globl scall futex_waitv 0xfffffffffffff1c1 globl scall set_mempolicy_home_node 0xfffffffffffff1c2 globl +scall sys_unveil 0xfff072ffffffffff globl # The Fifth Bell System Interface, Community Edition # » besiyata dishmaya diff --git a/tool/build/unveil.c b/tool/build/unveil.c new file mode 100644 index 000000000..dc7343433 --- /dev/null +++ b/tool/build/unveil.c @@ -0,0 +1,107 @@ +/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│ +│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8 :vi│ +╞══════════════════════════════════════════════════════════════════════════════╡ +│ Copyright 2022 Justine Alexandra Roberts Tunney │ +│ │ +│ Permission to use, copy, modify, and/or distribute this software for │ +│ any purpose with or without fee is hereby granted, provided that the │ +│ above copyright notice and this permission notice appear in all copies. │ +│ │ +│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL │ +│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED │ +│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE │ +│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL │ +│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR │ +│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER │ +│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │ +│ PERFORMANCE OF THIS SOFTWARE. │ +╚─────────────────────────────────────────────────────────────────────────────*/ +#include "libc/calls/calls.h" +#include "libc/calls/syscall-sysv.internal.h" +#include "libc/intrin/kprintf.h" +#include "libc/log/bsd.h" +#include "libc/runtime/runtime.h" +#include "libc/stdio/stdio.h" +#include "libc/str/str.h" +#include "third_party/getopt/getopt.h" + +#define USAGE \ + "\ +usage: pledge.com [-h] PROG ARGS...\n\ + -h show help\n\ +\n\ +unveil.com v1.o\n\ +copyright 2022 justine alexandra roberts tunney\n\ +https://twitter.com/justinetunney\n\ +https://linkedin.com/in/jtunney\n\ +https://justine.lol/pledge/\n\ +https://github.com/jart\n\ +\n\ +this program lets you launch linux commands in a filesystem sandbox\n\ +inspired by the design of openbsd's unveil() system call. Visit\n\ +the https://justine.lol/pledge/ page for online documentation.\n\ +\n\ +" + +wontreturn void usage(void) { + write(2, USAGE, sizeof(USAGE) - 1); + exit(1); +} + +int main(int argc, char *argv[]) { + const char *prog; + char pathbuf[PATH_MAX]; + char *line = NULL; + size_t size = 0; + size_t count = 0; + ssize_t len; + int opt; + const char *fields[2]; + + if (!(IsLinux() || IsOpenbsd())) + errx(1, "this program is only intended for Linux and OpenBSD"); + + // parse flags + while ((opt = getopt(argc, argv, "h")) != -1) { + switch (opt) { + case 'h': + case '?': + default: + usage(); + } + } + if (optind == argc) { + warnx("No command provided"); + usage(); + } + if (!(prog = commandv(argv[optind], pathbuf, sizeof(pathbuf)))) + err(1, "command not found: %s", argv[optind]); + + while ((len = getline(&line, &size, stdin)) != -1) { + count++; + _chomp(line); + + char *tok = line; + const char *p; + size_t i = 0; + while ((p = strsep(&tok, " \t")) != NULL) { + if (*p == '\0') { + p++; + continue; + } + if (i > 1) errx(1, ":%zu - too many fields", count); + fields[i++] = p; + } + if (i != 2) errx(1, ":%zu - malformed line", count); + + if (unveil(fields[0], fields[1]) == -1) + err(1, "unveil(%s, %s)", fields[0], fields[1]); + } + free(line); + if (ferror(stdin)) err(1, "getline"); + + if (unveil(NULL, NULL) == -1) err(1, "unveil disable"); + + __sys_execve(prog, argv + optind, environ); + err(127, "execve"); +}